From b10e64a90013f0e96dd97c4bbaa98f98e68a51ad Mon Sep 17 00:00:00 2001
From: Pauline Ribeyre <4224001+paulineribeyre@users.noreply.github.com>
Date: Wed, 27 May 2026 10:46:52 -0500
Subject: [PATCH] Status mismatch prevents reusing a draft request

---
 src/requestor/routes/manage.py | 12 ++++++++++++
 tests/test_manage.py           |  9 +++++++++
 2 files changed, 21 insertions(+)

diff --git a/src/requestor/routes/manage.py b/src/requestor/routes/manage.py
index bb4c89d..e48c4ff 100644
--- a/src/requestor/routes/manage.py
+++ b/src/requestor/routes/manage.py
@@ -238,6 +238,18 @@ async def create_request(
             f"Found a draft request with request_id: {draft_previous_requests[0].request_id}"
         )
         request = draft_previous_requests[0]
+        if request.status != data["status"]:
+            msg = f'A draft access request for username \'{data["username"]}\' and policy_id \'{data["policy_id"]}\' in status \'{request.status}\' already exists. Use the update endpoint instead if you want to update the status to \'{data["status"]}\'.'
+            logger.error(
+                msg
+                + f" body: {data}. existing requests: {[r.request_id for r in previous_requests]}",
+                exc_info=True,
+            )
+            raise HTTPException(
+                HTTP_409_CONFLICT,
+                msg,
+            )
+
     else:
         # create a new request
         data = {"request_id": request_id, **data}
diff --git a/tests/test_manage.py b/tests/test_manage.py
index ecf186f..96a737f 100644
--- a/tests/test_manage.py
+++ b/tests/test_manage.py
@@ -87,6 +87,15 @@ def test_create_duplicate_request(client):
     new_request_id = request_data.get("request_id")
     assert new_request_id == request_id
 
+    # create a request with the same username and policy_id, but a new status.
+    # since the status does not match, it should fail.
+    res = client.post(
+        "/request",
+        json={**data, "status": "INTERMEDIATE_STATUS"},
+        headers={"Authorization": f"bearer {fake_jwt}"},
+    )
+    assert res.status_code == 409, res.text
+
     # update the orignal request's status to a non-final, non-draft status
     res = client.put(f"/request/{request_id}", json={"status": "INTERMEDIATE_STATUS"})
     assert res.status_code == 200, res.text