🐛(backend) prevent privileged users from requesting access

Privileged users of a document (owners and admins) should not be
allowed to create an access request on a document they already control.
Without aguardrail, they could inadvertently inflate the access
request queue with redundant entries.

More critically, if an owner submits an access request on their own
document, another admin could accept it and grant them a lower role
(e.g. reader), which would silently strip them of their ownership.

Signed-off-by: Mohamed El Amine BOUKERFA <boukerfa.ma@gmail.com>

src/backend/core/api/viewsets.py

@@ -2523,6 +2523,12 @@ class DocumentAskForAccessViewSet(
         """Create a document ask for access resource."""
         document = self.get_document_or_404()
 
+        if document.get_role(request.user) in models.PRIVILEGED_ROLES:
+            return drf.response.Response(
+                {"detail": "You already have privileged access to this document."},
+                status=drf.status.HTTP_400_BAD_REQUEST,
+            )
+
         serializer = serializers.DocumentAskForAccessCreateSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)