From cc287920e18c866ed7ba6242d1c378a9b8db486e Mon Sep 17 00:00:00 2001
From: David Whittaker <dwhittaker@netflix.com>
Date: Thu, 7 Nov 2024 17:43:00 -0800
Subject: [PATCH] Check if challenge is already approved before raising
 exception

---
 src/dispatch/plugins/dispatch_core/plugin.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/dispatch/plugins/dispatch_core/plugin.py b/src/dispatch/plugins/dispatch_core/plugin.py
index 1bb18284799e..ec3db480c076 100644
--- a/src/dispatch/plugins/dispatch_core/plugin.py
+++ b/src/dispatch/plugins/dispatch_core/plugin.py
@@ -379,6 +379,9 @@ def validate_mfa_token(
             raise ActionMismatchError("Action mismatch")
         if not challenge.valid:
             raise ExpiredChallengeError("Challenge is no longer valid")
+        if challenge.status == MfaChallengeStatus.APPROVED:
+            # Challenge has already been approved
+            return challenge.status
         if challenge.status != MfaChallengeStatus.PENDING:
             raise InvalidChallengeStateError(f"Challenge is in invalid state: {challenge.status}")