Fix: allow removing dead document links from UI, validate via API (#8081)

src/documents/serialisers.py

@@ -651,6 +651,14 @@ class CustomFieldInstanceSerializer(serializers.ModelSerializer):
                     raise serializers.ValidationError(
                         f"Value must be index of an element in {select_options}",
                     )
+            elif field.data_type == CustomField.FieldDataType.DOCUMENTLINK:
+                doc_ids = data["value"]
+                if Document.objects.filter(id__in=doc_ids).count() != len(
+                    data["value"],
+                ):
+                    raise serializers.ValidationError(
+                        "Some documents in value don't exist or were specified twice.",
+                    )
 
         return data
 

src/documents/tests/test_api_custom_fields.py

@@ -740,6 +740,42 @@ class TestCustomFieldsAPI(DirectoriesMixin, APITestCase):
         self.assertEqual(CustomFieldInstance.objects.count(), 0)
         self.assertEqual(len(doc.custom_fields.all()), 0)
 
+    def test_custom_field_value_documentlink_validation(self):
+        """
+        GIVEN:
+            - Document & custom field exist
+        WHEN:
+            - API request to set a field value to a document that does not exist
+        THEN:
+            - HTTP 400 is returned
+            - No field instance is created or attached to the document
+        """
+
+        doc = Document.objects.create(
+            title="WOW",
+            content="the content",
+            checksum="123",
+            mime_type="application/pdf",
+        )
+        custom_field_documentlink = CustomField.objects.create(
+            name="Test Custom Field Doc Link",
+            data_type=CustomField.FieldDataType.DOCUMENTLINK,
+        )
+
+        resp = self.client.patch(
+            f"/api/documents/{doc.id}/",
+            data={
+                "custom_fields": [
+                    {"field": custom_field_documentlink.id, "value": [999]},
+                ],
+            },
+            format="json",
+        )
+
+        self.assertEqual(resp.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertEqual(CustomFieldInstance.objects.count(), 0)
+        self.assertEqual(len(doc.custom_fields.all()), 0)
+
     def test_custom_field_not_null(self):
         """
         GIVEN: