From 3c0233f08736f5f8a7844af129129c64945f900c Mon Sep 17 00:00:00 2001
From: Dominic Ferrando <mail@dominicferrando.com>
Date: Sat, 19 Sep 2026 18:03:41 -0400
Subject: [PATCH] Ensure action requested status readonly as well

---
 apps/api/src/server.ts                              |  6 ++++--
 .../(app)/verification/requests/[id]/+page.svelte   | 13 +++++++++----
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/apps/api/src/server.ts b/apps/api/src/server.ts
index 166ccd9..fc61ece 100644
--- a/apps/api/src/server.ts
+++ b/apps/api/src/server.ts
@@ -565,7 +565,8 @@ export const app = new Elysia()
             .post("/:id/request-action", async ({ params: { id }, body: { reviewerNotes, activityVerifications } }) => {
                 const verification = await s.Verifications.get(id);
                 if (!verification) throw new NotFoundError("Verification not found");
-                if (verification.status === "completed") throw status(409, { error: "Cannot modify a completed verification" });
+                if (verification.status === "completed" || verification.status === "action_requested")
+                    throw status(409, { error: "Cannot modify a completed or action-requested verification" });
 
                 const updated = await s.Verifications.requestAction(id, reviewerNotes ?? null, activityVerifications);
                 if (!updated) throw new NotFoundError("Verification not found");
@@ -579,7 +580,8 @@ export const app = new Elysia()
             .post("/:id/complete", async ({ params: { id }, body: { activityVerifications }, accountId }) => {
                 const verification = await s.Verifications.get(id);
                 if (!verification) throw new NotFoundError("Verification not found");
-                if (verification.status === "completed") throw status(409, { error: "Cannot modify a completed verification" });
+                if (verification.status === "completed" || verification.status === "action_requested")
+                    throw status(409, { error: "Cannot modify a completed or action-requested verification" });
 
                 const updated = await s.Verifications.complete(id, accountId, activityVerifications);
                 if (!updated) throw new NotFoundError("Verification not found");
diff --git a/apps/portal/src/routes/(app)/verification/requests/[id]/+page.svelte b/apps/portal/src/routes/(app)/verification/requests/[id]/+page.svelte
index 60e9c12..6636453 100644
--- a/apps/portal/src/routes/(app)/verification/requests/[id]/+page.svelte
+++ b/apps/portal/src/routes/(app)/verification/requests/[id]/+page.svelte
@@ -120,7 +120,10 @@
         ACTIVITIES.filter((a) => verf[a] !== "unset").length,
     );
     const allReviewed = $derived(reviewedCount === ACTIVITIES.length);
-    const isReadOnly = $derived(verification?.status === "completed");
+    const isReadOnly = $derived(
+        verification?.status === "completed" ||
+            verification?.status === "action_requested",
+    );
 
     async function load() {
         loading = true;
@@ -421,9 +424,11 @@
                 </button>
 
                 {#if isReadOnly}
-                    <span class="text-sm opacity-70"
-                        >This verification is completed and read-only.</span
-                    >
+                    <span class="text-sm opacity-70">
+                        {v.status === "completed"
+                            ? "This verification is completed and read-only."
+                            : "This verification is waiting on the player to resubmit and is read-only."}
+                    </span>
                 {:else}
                     <div class="flex items-center gap-2">
                         {#if !allReviewed}