[api] support changing from "declined" state to "revoked" or "superse…

…ded" (or "new/review" like before)

src/api/app/controllers/request_controller.rb

@@ -955,9 +955,8 @@ def command_changestate
 
     # do not allow direct switches from a final state to another one to avoid races and double actions.
     # request needs to get reopened first.
-    finalStates = [ "accepted", "declined", "superseded", "revoked" ]
-    if finalStates.include? req.state.name
-       if finalStates.include? params[:newstate]
+    if [ "accepted", "superseded", "revoked" ].include? req.state.name
+       if [ "accepted", "declined", "superseded", "revoked" ].include? params[:newstate]
           render_error :status => 403, :errorcode => "post_request_no_permission",
             :message => "set state to #{params[:newstate]} from a final state is not allowed."
           return

src/api/test/functional/request_controller_test.rb

@@ -464,7 +464,7 @@ def test_change_review_state_after_leaving_review_phase
     prepare_request_with_user 'tom', 'thunder'
     post "/request/#{id}?cmd=changereviewstate&newstate=declined&by_group=test_group"
     assert_response 403
-    assert_tag :tag => "status", :attributes => { :code => "post_request_no_permission" }
+    assert_tag :tag => "status", :attributes => { :code => "review_change_state_no_permission" }
   end
 
   def test_search_and_involved_requests
@@ -1338,13 +1338,20 @@ def test_branch_and_submit_request_to_linked_project_and_delete_it_again
     assert_tag( :tag => "status", :attributes => { :code => 'not_existing_target' } )
 
     # decline the request
-    prepare_request_with_user "king", "sunflower"
     post "/request/#{id2}?cmd=changestate&newstate=declined"
     assert_response :success
     get "/request/#{id2}"
     assert_response :success
     assert_tag( :tag => "state", :attributes => { :name => 'declined' } )
-    # do not allow to do it again
+
+    # submitter is accepting the decline => revoke
+    post "/request/#{id2}?cmd=changestate&newstate=revoked"
+    assert_response :success
+    get "/request/#{id2}"
+    assert_response :success
+    assert_tag( :tag => "state", :attributes => { :name => 'revoked' } )
+
+    # try to decline it again
     post "/request/#{id2}?cmd=changestate&newstate=declined"
     assert_response 403
     assert_match( /set state to declined from a final state is not allowed./, @response.body )