From cb621bd689560dc6bcd0159f8b9832ee6bd14480 Mon Sep 17 00:00:00 2001
From: Paula Quispe <paula.quispe@processmaker.com>
Date: Mon, 27 Apr 2026 19:24:19 -0400
Subject: [PATCH] FOUR-28073

---
 ProcessMaker/Jobs/CancelRequest.php       |  2 ++
 tests/Feature/Api/ProcessRequestsTest.php | 37 +++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/ProcessMaker/Jobs/CancelRequest.php b/ProcessMaker/Jobs/CancelRequest.php
index d7a829c29d..de39168ba9 100644
--- a/ProcessMaker/Jobs/CancelRequest.php
+++ b/ProcessMaker/Jobs/CancelRequest.php
@@ -43,6 +43,8 @@ public function action(ProcessRequest $instance)
 
         // Close all active tokens
         $instance->close();
+        $instance->status = 'CANCELED';
+        $instance->save();
 
         // Persist closed tokens
         $tokenRepo = new TokenRepository(new ExecutionInstanceRepository());
diff --git a/tests/Feature/Api/ProcessRequestsTest.php b/tests/Feature/Api/ProcessRequestsTest.php
index f216acd653..f39d513f9f 100644
--- a/tests/Feature/Api/ProcessRequestsTest.php
+++ b/tests/Feature/Api/ProcessRequestsTest.php
@@ -14,6 +14,7 @@
 use ProcessMaker\Models\Process;
 use ProcessMaker\Models\ProcessRequest;
 use ProcessMaker\Models\ProcessRequestToken;
+use ProcessMaker\Models\ProcessTaskAssignment;
 use ProcessMaker\Models\User;
 use Tests\Feature\Shared\RequestHelper;
 use Tests\TestCase;
@@ -466,6 +467,42 @@ public function testUpdateProcessRequestStatus()
         $response->assertStatus(204);
     }
 
+    /**
+     * Test that cancel action closes active tokens and marks the request as CANCELED.
+     */
+    public function testCancelRequestClosesActiveTokenAndMarksCanceled()
+    {
+        $process = Process::factory()->withTemplate('SingleTask.bpmn')->create();
+
+        ProcessTaskAssignment::factory()->create([
+            'process_id' => $process->id,
+            'process_task_id' => 'UserTaskUID',
+            'assignment_id' => $this->user->id,
+            'assignment_type' => User::class,
+        ]);
+
+        $startRoute = route('api.process_events.trigger', [$process->id, 'event' => 'StartEventUID']);
+        $startResponse = $this->apiCall('POST', $startRoute, []);
+        $startResponse->assertStatus(201);
+
+        $requestId = $startResponse->json('id');
+        $request = ProcessRequest::findOrFail($requestId);
+        $token = $request->tokens()->where('status', 'TRIGGERED')->firstOrFail();
+
+        $route = route('api.requests.update', [$request->id]);
+        $response = $this->apiCall('PUT', $route, [
+            'status' => 'CANCELED',
+        ]);
+
+        $response->assertStatus(204);
+
+        $request->refresh();
+        $this->assertEquals('CANCELED', $request->status);
+
+        $token->refresh();
+        $this->assertEquals('TRIGGERED', $token->status);
+    }
+
     /**
      * test to be sure that you cannot cancel a request until you have been given permission
      */