serializers.py

        for link_data in links_data:
            NoteLink.objects.create(note=note, **link_data)

        note.save()

        return note

    def update(self, instance, validated_data):
        """Update and return an existing Note instance, given the validated data.

        A `PermissionDenied` exception will be raised if the user is not privileged or the owner of
        a show.
        """

        show = validated_data["timeslot"].schedule.show
        user = self.context.get("request").user
        user_is_privileged = user.groups.filter(name=settings.PRIVILEGED_GROUP).exists()
        user_is_owner = user in show.owners

        # Only privileged users and owners of a show are allowed to update a note
        # Being a privileged user overrides the ownership
        if not (user_is_privileged or user_is_owner):
            raise exceptions.PermissionDenied(detail="You are not allowed to update this note.")

        instance.cba_id = validated_data.get("cba_id", instance.cba_id)
        instance.content = validated_data.get("content", instance.content)
        instance.image = validated_data.get("image_id", instance.image)
        instance.slug = validated_data.get("slug", instance.slug)
        instance.summary = validated_data.get("summary", instance.summary)
        instance.timeslot = validated_data.get("timeslot_id", instance.timeslot)
        instance.tags = validated_data.get("tags", instance.tags)
        instance.title = validated_data.get("title", instance.title)

        # optional many-to-many
        if contributors := validated_data.get("contributors"):
            instance.contributors.set(contributors)

        if language := validated_data.get("language"):
            instance.language.set(language)

        # Only update this field if the user is privileged, ignore otherwise
        if topic := validated_data.get("topic") and user_is_privileged:
            instance.topic.set(topic)

        if cba_id := validated_data.get("cba_id"):
            if audio_url := get_audio_url(cba_id):
                NoteLink.objects.create(note=instance, type="CBA", url=audio_url)

        if links_data := validated_data.get("links"):
            instance = delete_links(instance)

            for link_data in links_data:
                NoteLink.objects.create(note=instance, **link_data)

        instance.updated_by = self.context.get("request").user.username

        instance.save()

        return instance