Add server-side validation to prevent deletion of built-in device models

Co-authored-by: kbeaugrand <9513635+kbeaugrand@users.noreply.github.com>

Author: Copilot

src/IoTHub.Portal.Server/Services/DeviceModelService.cs

@@ -127,6 +127,12 @@ public async Task DeleteDeviceModel(string deviceModelId)
                 return;
             }
 
+            if (deviceModelEntity.IsBuiltin)
+            {
+                throw new ResourceAlreadyExistsException(
+                    $"The device model {deviceModelId} is a built-in model and cannot be deleted");
+            }
+
             var devices = await this.externalDeviceService.GetAllDevice();
 
             if (devices.Items.Any(x => DeviceHelper.RetrieveTagValue(x, "modelId") == deviceModelId))

src/IoTHub.Portal.Tests.Unit/Server/Services/DeviceModelServiceTests.cs

@@ -466,6 +466,28 @@ public async Task DeleteDeviceModelShouldNotDeleteNonExistingDevice()
             MockRepository.VerifyAll();
         }
 
+        [Test]
+        public async Task DeleteDeviceModelShouldThrowResourceAlreadyExistsExceptionWhenDeviceModelIsBuiltin()
+        {
+            // Arrange
+            var deviceModelDto = Fixture.Create<DeviceModelDto>();
+
+            _ = this.mockDeviceModelRepository.Setup(repository => repository.GetByIdAsync(deviceModelDto.ModelId, d => d.Labels))
+                .ReturnsAsync(new DeviceModel
+                {
+                    IsBuiltin = true,
+                    Labels = new List<Label>()
+                });
+
+            // Act
+            var act = () => this.deviceModelService.DeleteDeviceModel(deviceModelDto.ModelId);
+
+            // Assert
+            _ = await act.Should().ThrowAsync<ResourceAlreadyExistsException>()
+                .WithMessage($"The device model {deviceModelDto.ModelId} is a built-in model and cannot be deleted");
+            MockRepository.VerifyAll();
+        }
+
         [Test]
         public async Task GetDeviceModelAvatarShouldReturnDeviceModelAvatar()
         {