[#5034] Fix object ownership in Objects API

src/openforms/registrations/contrib/objects_api/plugin.py

@@ -62,6 +62,10 @@ def set_defaults(options: RegistrationOptions) -> None:
     def verify_initial_data_ownership(
         self, submission: Submission, options: RegistrationOptions
     ) -> None:
+        # Object's ownership validation makes sense if we want to update an object
+        if not options["update_existing_object"]:
+            return
+
         assert submission.initial_data_reference
         api_group = options["objects_api_group"]
         assert api_group, "Can't do anything useful without an API group"

src/openforms/registrations/contrib/objects_api/tests/test_backend_v1.py

@@ -11,6 +11,8 @@
 from openforms.contrib.objects_api.tests.factories import ObjectsAPIGroupConfigFactory
 from openforms.payments.constants import PaymentStatus
 from openforms.payments.tests.factories import SubmissionPaymentFactory
+from openforms.submissions.constants import PostSubmissionEvents
+from openforms.submissions.tasks import pre_registration
 from openforms.submissions.tests.factories import (
     SubmissionFactory,
     SubmissionFileAttachmentFactory,
@@ -1029,6 +1031,29 @@ def test_submission_with_auth_context_data_not_authenticated(self):
 
         self.assertEqual(result["record"]["data"]["auth"], None)
 
+    @tag("gh-5034")
+    def test_object_ownership_not_validated_if_new_object(self):
+        submission = SubmissionFactory.from_components(
+            [{"key": "textfield", "type": "textfield"}],
+            completed_not_preregistered=True,
+            form__registration_backend=PLUGIN_IDENTIFIER,
+            form__registration_backend_options={
+                "objects_api_group": self.objects_api_group.pk,
+                "version": 1,
+                "objecttype": "8faed0fa-7864-4409-aa6d-533a37616a9e",
+                "objecttype_version": 1,
+                "update_existing_object": False,
+                "auth_attribute_path": [],
+            },
+            submitted_data={"textfield": "test"},
+            initial_data_reference="some ref",
+        )
+
+        try:
+            pre_registration(submission.pk, PostSubmissionEvents.on_retry)
+        except AssertionError:
+            self.fail("Assertion should have passed.")
+
 
 class V1HandlerTests(TestCase):
     """

src/openforms/registrations/contrib/objects_api/tests/test_backend_v2.py

@@ -12,6 +12,8 @@
 from openforms.contrib.objects_api.tests.factories import ObjectsAPIGroupConfigFactory
 from openforms.payments.constants import PaymentStatus
 from openforms.payments.tests.factories import SubmissionPaymentFactory
+from openforms.submissions.constants import PostSubmissionEvents
+from openforms.submissions.tasks import pre_registration
 from openforms.submissions.tests.factories import (
     SubmissionFactory,
     SubmissionFileAttachmentFactory,
@@ -514,6 +516,30 @@ def test_addressNl_legacy_before_of_30(self):
             },
         )
 
+    @tag("gh-5034")
+    def test_object_ownership_not_validated_if_new_object(self):
+        submission = SubmissionFactory.from_components(
+            [{"key": "textfield", "type": "textfield"}],
+            completed_not_preregistered=True,
+            form__registration_backend=PLUGIN_IDENTIFIER,
+            form__registration_backend_options={
+                "objects_api_group": self.objects_api_group.pk,
+                "version": 2,
+                "objecttype": "8faed0fa-7864-4409-aa6d-533a37616a9e",
+                "objecttype_version": 1,
+                "update_existing_object": False,
+                "auth_attribute_path": [],
+                "variables_mapping": [],
+            },
+            submitted_data={"textfield": "test"},
+            initial_data_reference="some ref",
+        )
+
+        try:
+            pre_registration(submission.pk, PostSubmissionEvents.on_retry)
+        except AssertionError:
+            self.fail("Assertion should have passed.")
+
 
 class V2HandlerTests(TestCase):
     """