serializers.py

        note = Note.objects.create(
            created_by=self.context.get("request").user.username,
            **validated_data,
        )

        note.contributors.set(contributors)
        note.language.set(language)
        note.topic.set(topic)

        # optional nested objects
        for link_data in links_data:
            NoteLink.objects.create(note=note, **link_data)

        note.save()

        return note

    def update(self, instance, validated_data):
        """Update and return an existing Note instance, given the validated data."""

        user = self.context.get("request").user
        user_is_owner = user in instance.timeslot.schedule.show.owners.all()

        # Having the update_note permission overrides the ownership
        if not (user.has_perm("program.update_note") or user_is_owner):
            raise exceptions.PermissionDenied(detail="You are not allowed to update this note.")

        if "cba_id" in validated_data:
            instance.cba_id = validated_data.get("cba_id")

        if "content" in validated_data:
            instance.content = validated_data.get("content")

        if "image" in validated_data:
            instance.image = validated_data.get("image")

        if "summary" in validated_data:
            instance.summary = validated_data.get("summary")

        if "timeslot" in validated_data:
            instance.timeslot = validated_data.get("timeslot")

        if "tags" in validated_data:
            instance.tags = validated_data.get("tags")

        if "title" in validated_data:
            instance.title = validated_data.get("title")

        # optional many-to-many
        if "contributors" in validated_data:
            instance.contributors.set(validated_data.get("contributors", []))

        if "language" in validated_data:
            instance.language.set(validated_data.get("language", []))

        # Only update this field if the user has the update_note permission, ignore otherwise
        if "topic" in validated_data and user.has_perm("program.update_note"):
            instance.topic.set(validated_data.get("topic", []))

        # optional nested objects
        if "links" in validated_data:
            instance = delete_links(instance)

            for link_data in validated_data.get("links"):
                NoteLink.objects.create(note=instance, **link_data)

        instance.updated_by = self.context.get("request").user.username

        instance.save()

        return instance