From ca286b6de7b3a4643c32d9f07d95b166c60121ac Mon Sep 17 00:00:00 2001
From: Mohamed El Amine BOUKERFA <boukerfa.ma@gmail.com>
Date: Thu, 19 Feb 2026 13:50:29 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B(backend)=20prevent=20privileged=20?=
 =?UTF-8?q?users=20from=20requesting=20access?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Privileged users of a document (owners and admins) should not be
allowed to create an access request on a document they already control.
Without aguardrail, they could inadvertently inflate the access
request queue with redundant entries.

More critically, if an owner submits an access request on their own
document, another admin could accept it and grant them a lower role
(e.g. reader), which would silently strip them of their ownership.

Signed-off-by: Mohamed El Amine BOUKERFA <boukerfa.ma@gmail.com>
---
 CHANGELOG.md                                  |  2 +-
 src/backend/core/api/viewsets.py              |  6 +++++
 .../test_api_documents_ask_for_access.py      | 22 +++++++++++++++++++
 3 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 47679f4b..771fb919 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,7 +53,7 @@ and this project adheres to
 - ♿️(frontend) add focus on open to modals #1948
 
 ### Fixed
-
+- 🐛 (backend) prevent privileged users from requesting access #1898
 - 🐛(frontend) fix broadcast store sync #1846
 - 🐛(helm) use celery resources instead of backend resources #1887
 - 🐛(helm) reverse liveness and readiness for backend deployment #1887
diff --git a/src/backend/core/api/viewsets.py b/src/backend/core/api/viewsets.py
index bef130b0..3b36c456 100644
--- a/src/backend/core/api/viewsets.py
+++ b/src/backend/core/api/viewsets.py
@@ -2523,6 +2523,12 @@ class DocumentAskForAccessViewSet(
         """Create a document ask for access resource."""
         document = self.get_document_or_404()
 
+        if document.get_role(request.user) in models.PRIVILEGED_ROLES:
+            return drf.response.Response(
+                {"detail": "You already have privileged access to this document."},
+                status=drf.status.HTTP_400_BAD_REQUEST,
+            )
+
         serializer = serializers.DocumentAskForAccessCreateSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
diff --git a/src/backend/core/tests/documents/test_api_documents_ask_for_access.py b/src/backend/core/tests/documents/test_api_documents_ask_for_access.py
index c5aad35f..9c260f40 100644
--- a/src/backend/core/tests/documents/test_api_documents_ask_for_access.py
+++ b/src/backend/core/tests/documents/test_api_documents_ask_for_access.py
@@ -9,6 +9,7 @@ import pytest
 from rest_framework.test import APIClient
 
 from core.api.serializers import UserSerializer
+from core.choices import PRIVILEGED_ROLES
 from core.factories import (
     DocumentAskForAccessFactory,
     DocumentFactory,
@@ -199,6 +200,27 @@ def test_api_documents_ask_for_access_create_authenticated_already_has_ask_for_a
     assert response.json() == {"detail": "You already ask to access to this document."}
 
 
+@pytest.mark.parametrize("role", PRIVILEGED_ROLES)
+def test_api_documents_ask_for_access_create_authenticated_already_has_privileged_access(
+    role,
+):
+    """
+    Authenticated users with privileged access (owner or admin) should not be able to
+    create a document ask for access.
+    """
+    user = UserFactory()
+    document = DocumentFactory(users=[(user, role)])
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(f"/api/v1.0/documents/{document.id}/ask-for-access/")
+    assert response.status_code == 400
+    assert response.json() == {
+        "detail": "You already have privileged access to this document."
+    }
+
+
 ## List