Repository: learningequality/kolibri
Issue: Device management PIN - A change or removal of the PIN is not recognized by the Learn-only device

## Observed behavior
If as a super admin I change the PIN of a facility and restart the server then the user on the Learn-only device is not able to use the newly created PIN because only the previously created one is accepted as valid. I have restarted both servers multiple times but still the newly created PIN is not being synced correctly. The same is also valid if I simply remove the PIN.

## Expected behavior
Fully functional PIN functionality. Changing the PIN on the server should result in requesting the new PIN on the Learn-only device and accepting only the latest one as valid. Removing the PIN on the server should result in not requiring a PIN on the Learn-only device.

## Steps to reproduce the issue
1. Install the the [following build ](https://buildkite.com/organizations/learningequality/pipelines/kolibri-debian/builds/6331/jobs/0186ea8c-f487-468c-b52d-856b7f05e1b7/artifacts/0186eeb5-7c32-43b9-bc8b-bea11c9d2234) 
2.  Setup a full facility and add a Device management PIN at Facility > Settings
3. Setup a Learn-only facility and attempt to import a channel.
4. Input the PIN to ensure that it's working.
5. As a super admin go back to the main facility and change the PIN. Restart the server.
6. As a learner on the learn-only device attempt to import a channel - the old PIN value will be required instead of the new one.

## Video

https://user-images.githubusercontent.com/79847249/225883694-4d34bcf0-fc9c-4981-8f2e-87d86708faea.mp4

## Logs
[LearnerLogs.zip](https://github.com/learningequality/kolibri/files/11000543/LearnerLogs.zip)
[ServerLogs.zip](https://github.com/learningequality/kolibri/files/11000544/ServerLogs.zip)


## Usage Details
Windows 10, Ubuntu 22  - Chrome

Changed files:
kolibri/core/device/test/test_api.py, kolibri/core/device/serializers.py

diff --git a/kolibri/core/device/serializers.py b/kolibri/core/device/serializers.py
index 86f616d99c..4494ec3612 100644
--- a/kolibri/core/device/serializers.py
+++ b/kolibri/core/device/serializers.py
@@ -116,22 +116,33 @@ class DeviceProvisionSerializer(DeviceSerializerMixin, serializers.Serializer):
                 # We've already imported the facility to the device before provisioning
                 facility = Facility.objects.get(pk=facility_id)
                 preset = facility.dataset.preset
+                facility_created = False
             else:
                 facility = Facility.objects.create(**facility_data)
                 preset = validated_data.pop("preset")
                 facility.dataset.preset = preset
                 facility.dataset.reset_to_default_settings(preset)
+                facility_created = True
 
             custom_settings = validated_data.pop("settings")
 
-            if "on_my_own_setup" in custom_settings:
-                facility.on_my_own_setup = custom_settings.pop("on_my_own_setup")
+            if facility_created:
+                # We only want to update things about the facility or the facility dataset in the case
+                # that we are creating the facility during this provisioning process.
+                # If it has been imported as part of a whole facility import, then we should not be
+                # making edits just now.
+                # If it has been imported as part of a learner only device import, then editing
+                # these things now will a) not be synced back, and b) will actively block future
+                # syncing of updates to the facility or facility dataset from our 'upstream'.
 
-            # overwrite the settings in dataset_data with validated_data.settings
-            for key, value in custom_settings.items():
-                if value is not None:
-                    setattr(facility.dataset, key, value)
-            facility.dataset.save()
+                if "on_my_own_setup" in custom_settings:
+                    facility.on_my_own_setup = custom_settings.pop("on_my_own_setup")
+
+                # overwrite the settings in dataset_data with validated_data.settings
+                for key, value in custom_settings.items():
+                    if value is not None:
+                        setattr(facility.dataset, key, value)
+                facility.dataset.save()
 
             if not validated_data.get("os_user"):
                 # We've imported a facility if the username exists
@@ -159,7 +170,9 @@ class DeviceProvisionSerializer(DeviceSerializerMixin, serializers.Serializer):
                     is_super = False
                 else:
                     is_super = True
-                    facility.add_role(superuser, user_kinds.ADMIN)
+                    if facility_created:
+                        # Only do this if this is a created, not imported facility.
+                        facility.add_role(superuser, user_kinds.ADMIN)
 
                 if DevicePermissions.objects.count() == 0:
                     DevicePermissions.objects.create(
diff --git a/kolibri/core/device/test/test_api.py b/kolibri/core/device/test/test_api.py
index b45f869e2f..2da959dac9 100644
--- a/kolibri/core/device/test/test_api.py
+++ b/kolibri/core/device/test/test_api.py
@@ -215,6 +215,25 @@ class DeviceProvisionTestCase(APITestCase):
             )
             self.assertTrue(FacilityUser.objects.get().os_user)
 
+    def test_imported_facility_no_update(self):
+        facility = Facility.objects.create(name="This is a test")
+        settings = FacilityDataset.objects.get()
+        settings.learner_can_edit_username = True
+        settings.save()
+        data = self._default_provision_data()
+        data["facility_id"] = facility.id
+        del data["facility"]
+        # Client should pass an empty Dict for settings
+        data["settings"] = {
+            "learner_can_edit_username": False,
+            "on_my_own_setup": True,
+        }
+        settings.refresh_from_db()
+        facility.refresh_from_db()
+        self._post_deviceprovision(data)
+        self.assertEqual(settings.learner_can_edit_username, True)
+        self.assertEqual(facility.on_my_own_setup, False)
+
 
 class DeviceSettingsTestCase(APITestCase):
     @classmethod