FOUR-28073: Canceled case still progresses to Completed

ProcessMaker/Jobs/CancelRequest.php

@@ -43,6 +43,8 @@ public function action(ProcessRequest $instance)
 
         // Close all active tokens
         $instance->close();
+        $instance->status = 'CANCELED';
+        $instance->save();
 
         // Persist closed tokens
         $tokenRepo = new TokenRepository(new ExecutionInstanceRepository());

tests/Feature/Api/ProcessRequestsTest.php

@@ -14,6 +14,7 @@
 use ProcessMaker\Models\Process;
 use ProcessMaker\Models\ProcessRequest;
 use ProcessMaker\Models\ProcessRequestToken;
+use ProcessMaker\Models\ProcessTaskAssignment;
 use ProcessMaker\Models\User;
 use Tests\Feature\Shared\RequestHelper;
 use Tests\TestCase;
@@ -466,6 +467,42 @@ public function testUpdateProcessRequestStatus()
         $response->assertStatus(204);
     }
 
+    /**
+     * Test that cancel action closes active tokens and marks the request as CANCELED.
+     */
+    public function testCancelRequestClosesActiveTokenAndMarksCanceled()
+    {
+        $process = Process::factory()->withTemplate('SingleTask.bpmn')->create();
+
+        ProcessTaskAssignment::factory()->create([
+            'process_id' => $process->id,
+            'process_task_id' => 'UserTaskUID',
+            'assignment_id' => $this->user->id,
+            'assignment_type' => User::class,
+        ]);
+
+        $startRoute = route('api.process_events.trigger', [$process->id, 'event' => 'StartEventUID']);
+        $startResponse = $this->apiCall('POST', $startRoute, []);
+        $startResponse->assertStatus(201);
+
+        $requestId = $startResponse->json('id');
+        $request = ProcessRequest::findOrFail($requestId);
+        $token = $request->tokens()->where('status', 'TRIGGERED')->firstOrFail();
+
+        $route = route('api.requests.update', [$request->id]);
+        $response = $this->apiCall('PUT', $route, [
+            'status' => 'CANCELED',
+        ]);
+
+        $response->assertStatus(204);
+
+        $request->refresh();
+        $this->assertEquals('CANCELED', $request->status);
+
+        $token->refresh();
+        $this->assertEquals('TRIGGERED', $token->status);
+    }
+
     /**
      * test to be sure that you cannot cancel a request until you have been given permission
      */