From b1f6f52486d5ba5c04af99b41315eb6428fd1fa8 Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Tue, 19 Dec 2023 13:53:56 -0800
Subject: [PATCH] Fix: Dont allow null custom_fields property via API (#5063)

---
 src/documents/serialisers.py                  |  6 ++++-
 src/documents/tests/test_api_custom_fields.py | 26 +++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/src/documents/serialisers.py b/src/documents/serialisers.py
index b1cc1d7f0..c6837b247 100644
--- a/src/documents/serialisers.py
+++ b/src/documents/serialisers.py
@@ -591,7 +591,11 @@ class DocumentSerializer(
     archived_file_name = SerializerMethodField()
     created_date = serializers.DateField(required=False)
 
-    custom_fields = CustomFieldInstanceSerializer(many=True, allow_null=True)
+    custom_fields = CustomFieldInstanceSerializer(
+        many=True,
+        allow_null=False,
+        required=False,
+    )
 
     owner = serializers.PrimaryKeyRelatedField(
         queryset=User.objects.all(),
diff --git a/src/documents/tests/test_api_custom_fields.py b/src/documents/tests/test_api_custom_fields.py
index 2eb46e388..15abcd053 100644
--- a/src/documents/tests/test_api_custom_fields.py
+++ b/src/documents/tests/test_api_custom_fields.py
@@ -400,6 +400,32 @@ class TestCustomField(DirectoriesMixin, APITestCase):
         self.assertEqual(CustomFieldInstance.objects.count(), 0)
         self.assertEqual(len(doc.custom_fields.all()), 0)
 
+    def test_custom_field_not_null(self):
+        """
+        GIVEN:
+            - Existing document
+        WHEN:
+            - API request with custom_fields set to null
+        THEN:
+            - HTTP 400 is returned
+        """
+        doc = Document.objects.create(
+            title="WOW",
+            content="the content",
+            checksum="123",
+            mime_type="application/pdf",
+        )
+
+        resp = self.client.patch(
+            f"/api/documents/{doc.id}/",
+            data={
+                "custom_fields": None,
+            },
+            format="json",
+        )
+
+        self.assertEqual(resp.status_code, status.HTTP_400_BAD_REQUEST)
+
     def test_bidirectional_doclink_fields(self):
         """
         GIVEN: