Merge pull request #4564 from open-formulieren/issue/4555-fix-integri…

…ty-error-crash

Fix integrity error crash by using proper validation

src/openforms/forms/api/serializers/form_variable.py

@@ -177,4 +177,18 @@ def validate(self, attrs):
                     }
                 )
 
+        # prefill plugin and attribute must both or both not be set
+        prefill_plugin = attrs.get("prefill_plugin") or ""
+        prefill_attribute = attrs.get("prefill_attribute") or ""
+        if (prefill_plugin and not prefill_attribute) or (
+            not prefill_plugin and prefill_attribute
+        ):
+            raise ValidationError(
+                {
+                    "prefill_attribute": _(
+                        "Prefill plugin and attribute must both be specified."
+                    ),
+                }
+            )
+
         return attrs

src/openforms/forms/tests/variables/test_viewset.py

@@ -900,3 +900,39 @@ def test_validators_accepts_only_numeric_keys(self):
 
         # The variable is considered valid
         self.assertEqual(status.HTTP_200_OK, response.status_code)
+
+    def test_validate_prefill_consistency(self):
+        user = SuperUserFactory.create()
+        self.client.force_authenticate(user)
+        form = FormFactory.create()
+        form_path = reverse("api:form-detail", kwargs={"uuid_or_slug": form.uuid})
+        form_url = f"http://testserver.com{form_path}"
+        data = [
+            {
+                "form": form_url,
+                "form_definition": "",
+                "name": "Variable 1",
+                "key": "variable1",
+                "source": FormVariableSources.user_defined,
+                "dataType": FormVariableDataTypes.string,
+                "prefillPlugin": "demo",
+                "prefillAttribute": "",
+            }
+        ]
+
+        response = self.client.put(
+            reverse(
+                "api:form-variables",
+                kwargs={"uuid_or_slug": form.uuid},
+            ),
+            data=data,
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        error = response.json()
+        self.assertEqual(error["code"], "invalid")
+        self.assertEqual(len(error["invalidParams"]), 1)
+        self.assertEqual(
+            error["invalidParams"][0]["name"],
+            "0.prefillAttribute",
+        )