From 64852bf7f948d8dbcc546d2d644e1dae893d40f3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C5=81ukasz=20Gryglicki?= Date: Wed, 22 Jul 2026 07:48:07 +0200 Subject: [PATCH 1/2] EasyCLA release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Łukasz Gryglicki Assisted by [OpenAI](https://platform.openai.com/) Assisted by [GitHub Copilot](https://github.com/features/copilot) Assisted by [Claude](https://claude.ai) --- .gitignore | 1 - CLAUDE.md | 92 ++++++++ cla-backend-go/emails/docusign_templates.go | 20 +- .../emails/docusign_templates_test.go | 223 ++++++++++++++++++ cla-backend-go/emails/prefill_test.go | 76 ++++++ cla-backend-go/v2/sign/handlers.go | 4 +- cla-backend-go/v2/sign/service.go | 18 +- cla-backend-legacy/internal/api/handlers.go | 4 +- 8 files changed, 420 insertions(+), 18 deletions(-) create mode 100644 CLAUDE.md create mode 100644 cla-backend-go/emails/docusign_templates_test.go create mode 100644 cla-backend-go/emails/prefill_test.go diff --git a/.gitignore b/.gitignore index fbebf19c8..a72907ca2 100755 --- a/.gitignore +++ b/.gitignore @@ -286,6 +286,5 @@ spans*.json *.dylib *.test *.out -CLAUDE.md .claude/* /*user_emails.json diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 000000000..7ad0e5a70 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,92 @@ +# CLAUDE.md + +Copyright The Linux Foundation and each contributor to CommunityBridge. + +SPDX-License-Identifier: CC-BY-4.0 + +This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. + +## Overview + +EasyCLA is the Linux Foundation's Contributor License Agreement service. It lets contributors sign ICLAs/CCLAs and gates GitHub PRs and Gerrit/GitLab reviews on CLA authorization. Third-party integrations: DocuSign (e-sign), DocRaptor (PDF), GitHub, Gerrit, GitLab, Auth0 (SSO), and Salesforce via the LFX Platform APIs. + +The frontend consoles (Project/Corporate/Contributor) live in **separate repositories** — this repo is backend-only plus supporting scripts/infra. Do not look for UI code here. + +## Repository Layout + +- `cla-backend-go/` — **primary backend**, Go. Powers `/v3` (EasyCLA v1, us-east-1) and `/v4` (EasyCLA v2, us-east-2, integrates with LFX Platform + Salesforce). Deployed as AWS Lambdas. +- `cla-backend/` — Serverless Framework **deployment stack** (us-east-1). The Python backend has been removed; the sole application code it still owns is the API Gateway authorizer (`cla-backend/auth/main.go`, `cla-backend/auth/authorizer/`). Otherwise it deploys Go binaries built elsewhere — the `/v3` API and worker lambdas (dynamo-events, metrics, zipbuilder, gitlab-repository-check, user-subscribe) from `cla-backend-go/`, and the `/v1`/`/v2` `legacy-api-lambda` from `cla-backend-legacy/`. +- `cla-backend-legacy/` — Go module (own `go.mod`): the Go implementation of the legacy `/v1`/`/v2` API surface (replaced the Python backend). Built as `bin/legacy-api-lambda` and deployed via `cla-backend/serverless.yml` on the original `api.*` domains. Responses carry `X-EasyCLA-Backend: cla-backend-legacy` headers; parity tooling lives under `internal/parity`. +- `cla-sss-base/` — standalone Go module (own `go.mod`): client for the Sanctions Screening Service (SSS). +- `scripts/`, `utils/` — operational shell/Python scripts (data audits, DynamoDB manipulation, deploys, credential rotation). Many `utils/*.sh` scripts operate directly against AWS environments. +- `infra/` — infrastructure config. +- `tests/` — functional/REST tests, Postman collections, py2go comparison tests. + +## Go Backend (cla-backend-go) — Primary Workflow + +Requires Go 1.25+. All commands run from `cla-backend-go/`. + +```bash +make setup # one-time: install swagger, golangci-lint, goimports; sets up swagger venv +make swagger # regenerate API models/clients from swagger specs into gen/ (see below) +make build-mac # build local binary -> bin/cla-mac (build-linux for Linux) +make test # go test -v ./... with coverage +make lint # golangci-lint (v1.64.8, config .golangci.yaml) + license header check +make fmt # gofmt + goimports +make mock # regenerate mocks via tools/regenmocks.sh +make all-mac # full pipeline: clean swagger deps fmt build test lint (all-linux on Linux) +``` + +Run a single test: `go test -v ./signatures/ -run TestName` + +Run locally (points at a real AWS environment — see below): build, set env, then `./bin/cla-mac` (from `make build-mac`) or `./bin/cla` (from `make build-linux`). Health checks at `http://localhost:8080/v3/ops/health` and `/v4/ops/health`. Set `GH_ORG_VALIDATION=false` to bypass GitHub auth checks for local curl/Postman testing. + +### Swagger code generation (important) + +The API is **swagger-first**. `gen/` is fully generated and is deleted/rebuilt by `make swagger` — never hand-edit files under `gen/`. Source specs are multi-file YAML under `swagger/` (`cla.v1.yaml`, `cla.v2.yaml`) compiled via `swagger/multi-file-swagger.py`. `make swagger` also downloads and generates clients for external LFX platform services (project-service, organization-service, user-service, acs-service) from their live dev swagger endpoints, so it requires network access. After changing an endpoint's spec, regenerate before implementing handlers. + +### Module architecture pattern + +Domain feature modules (e.g. `signatures/`, `approval_list/`, `company/`, `project/`, and most packages under `v2/`) follow a consistent three-layer split, though a module omits a layer it doesn't need (e.g. `v2/health` is handler-only, `v2/project-service` is a generated client with no handlers/service/repository): + +- `handlers.go` — a `Configure(api, service, ...)` function that wires generated swagger operations to service calls. Handlers do request/response translation only. +- `service.go` — business logic, defined behind an interface; the unit-testable layer. +- `repository.go` — DynamoDB access. `dbmodels.go` holds table row structs; `converters.go` maps between DB models, generated API models, and internal models. +- `mocks/` — generated mocks (regenerate with `make mock`, don't edit by hand). + +`v2/` packages are the newer LFX-Platform-integrated implementations; top-level packages are v1/legacy. Both are wired together in `cmd/server.go`. + +`cmd/` holds `main.go` entrypoints for the many Lambda binaries (metrics, dynamo-events, zipbuilder, gitlab-repository-check, user-subscribe, etc.) plus the main API server (`cmd/server.go`, `cmd/server_standalone.go`, `cmd/server_aws_lambda.go`). Config is loaded from SSM via the `init` + `config` + `token` packages at startup. + +## Legacy Go Backend (cla-backend-legacy) + +Serves the legacy `/v1`/`/v2` API surface (the Python backend it replaced is gone). From the repo root: + +```bash +source setenv.sh +cd cla-backend-legacy +go mod tidy +make lambdas # build deployment artifact bin/legacy-api-lambda +STAGE=dev ADDR=":5000" make run-local # run locally on :5000 pointing at dev environment +``` + +Health check: `http://localhost:5000/v2/health` (response includes `X-EasyCLA-Backend: cla-backend-legacy`). Port 5000 matches the Cypress functional-test helpers (`tests/functional/utils/run-single-test-local.sh` with `V=1`/`V=2`). + +Deployment: the built binary is copied into `cla-backend/bin/` and deployed from the `cla-backend` Serverless stack (`yarn deploy:dev`, `yarn deploy:staging`, or `yarn deploy:prod` from `cla-backend/`). + +## AWS Environments & Local Development + +Local backend runs point at **real shared AWS environments** (dev/test/staging/prod), not a local stack. The four environments map to AWS accounts via `~/.aws` profiles `lfproduct-dev`, `lfproduct-test`, `lfproduct-staging`, `lfproduct-prod` (assume-role from `lfproduct` base profile, MFA required). See `aws_env.md` for the profile setup and `dev.md` for the assume-role helper script and required env vars (`AWS_REGION`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `PRODUCT_DOMAIN`, `ROOT_DOMAIN`, `STAGE`). + +Be careful: scripts in `utils/` and `scripts/` can mutate DynamoDB in whichever environment your profile targets, including prod. + +## Conventions + +- **License headers are enforced in CI for source files** (`.go`, `.py`, `.sh`, `.yaml`/`.yml`, `.txt` — Markdown docs are not scanned) via `check-headers.sh`, which only checks for the `Copyright The Linux Foundation` line, not the SPDX identifier. New code files need `// SPDX-License-Identifier: MIT`; docs need `SPDX-License-Identifier: CC-BY-4.0` by convention, but the checker does not verify this. Only `cla-backend-go`'s `make lint` invokes `check-headers.sh`; `cla-backend-legacy`'s `make lint` (go fmt + go vet) does not. +- **DCO required** — every commit needs `Signed-off-by`. +- Use "Approved List" terminology, not "whitelist" (renamed across code, APIs, and specs as of 8/2025). +- Bot CLA exemptions: see `BOT_ALLOWLIST.md`. Co-authors support: see `CO_AUTHORS.md`. PR-check author/co-author caching design: see `COMMIT_AUTHORS_CACHING.md`. + +## CI + +GitHub Actions in `.github/workflows/`: `build-pr.yml` (build/test/lint), `cypress-functional-pr.yml` (functional E2E), CodeQL/security/license scans for the Go backends, and `deploy-dev.yml` / `deploy-prod.yml` for deployment (both build `cla-backend-go` and `cla-backend-legacy`, then deploy through the `cla-backend` stack). diff --git a/cla-backend-go/emails/docusign_templates.go b/cla-backend-go/emails/docusign_templates.go index b96781297..6e638049b 100644 --- a/cla-backend-go/emails/docusign_templates.go +++ b/cla-backend-go/emails/docusign_templates.go @@ -3,6 +3,8 @@ package emails +import "github.com/linuxfoundation/easycla/cla-backend-go/utils" + type DocumentSignedTemplateParams struct { CommonEmailParams CLAGroupTemplateParams @@ -17,25 +19,35 @@ const ( // DocumentSignedTemplate is email template for DocumentSignedICLATemplate = `

Hello {{.RecipientName}},

-

This is a notification email from EasyCLA regarding the project {{.Project.ExternalProjectName}}.

+

This is a notification email from EasyCLA regarding the {{if eq .Version "v2"}}CLA Group {{.CLAGroupName}}{{else}}project {{.Project.ExternalProjectName}}{{end}}.

The CLA has now been signed. You can download the signed CLA as a PDF here.

` DocumentSignedCCLATemplate = `

Hello {{.RecipientName}},

-

This is a notification email from EasyCLA regarding the project {{.Project.ExternalProjectName}}.

+

This is a notification email from EasyCLA regarding the {{if eq .Version "v2"}}CLA Group {{.CLAGroupName}}{{else}}project {{.Project.ExternalProjectName}}{{end}}.

The CLA has now been signed. You can download the signed CLA as a PDF here, or from within the EasyCLA CLA Manager console .

` ) // RenderDocumentSignedTemplate renders RenderDocumentSignedTemplate -func RenderDocumentSignedTemplate(svc EmailTemplateService, claGroupModelVersion, projectSFID string, params DocumentSignedTemplateParams) (string, error) { - claGroupParams, err := svc.GetCLAGroupTemplateParamsFromProjectSFID(claGroupModelVersion, projectSFID) +func RenderDocumentSignedTemplate(svc EmailTemplateService, claGroupModelVersion, claGroupID, projectSFID string, params DocumentSignedTemplateParams) (string, error) { + var ( + claGroupParams CLAGroupTemplateParams + err error + ) + + if claGroupModelVersion == utils.V2 { + claGroupParams, err = svc.GetCLAGroupTemplateParamsFromCLAGroup(claGroupID) + } else { + claGroupParams, err = svc.GetCLAGroupTemplateParamsFromProjectSFID(claGroupModelVersion, projectSFID) + } if err != nil { return "", err } params.CLAGroupTemplateParams = claGroupParams + params.Version = claGroupModelVersion var template string if params.ICLA { template = DocumentSignedICLATemplate diff --git a/cla-backend-go/emails/docusign_templates_test.go b/cla-backend-go/emails/docusign_templates_test.go new file mode 100644 index 000000000..9a87488ac --- /dev/null +++ b/cla-backend-go/emails/docusign_templates_test.go @@ -0,0 +1,223 @@ +// Copyright The Linux Foundation and each contributor to CommunityBridge. +// SPDX-License-Identifier: MIT + +package emails + +import ( + "errors" + "strings" + "testing" + + "github.com/linuxfoundation/easycla/cla-backend-go/utils" +) + +type documentSignedTemplateServiceStub struct { + projectParams CLAGroupTemplateParams + claGroupParams CLAGroupTemplateParams + projectErr error + claGroupErr error + + projectLookupCalls int + claGroupLookupCalls int + requestedVersion string + requestedProjectID string + requestedCLAGroupID string +} + +var _ EmailTemplateService = (*documentSignedTemplateServiceStub)(nil) + +func (s *documentSignedTemplateServiceStub) PrefillV2CLAProjectParams(_ []string) ([]CLAProjectParams, error) { + panic("unexpected PrefillV2CLAProjectParams call") +} + +func (s *documentSignedTemplateServiceStub) GetCLAGroupTemplateParamsFromProjectSFID(claGroupVersion, projectSFID string) (CLAGroupTemplateParams, error) { + s.projectLookupCalls++ + s.requestedVersion = claGroupVersion + s.requestedProjectID = projectSFID + return s.projectParams, s.projectErr +} + +func (s *documentSignedTemplateServiceStub) GetCLAGroupTemplateParamsFromCLAGroup(claGroupID string) (CLAGroupTemplateParams, error) { + s.claGroupLookupCalls++ + s.requestedCLAGroupID = claGroupID + return s.claGroupParams, s.claGroupErr +} + +func TestRenderDocumentSignedTemplateUsesVersionAppropriateLookupAndName(t *testing.T) { + const ( + claGroupID = "d8cead54-92b7-48c5-a2c8-b1e295e8f7f1" + projectSFID = "a0941000002wBz4AAE" + claGroupName = "Cloud Native Computing Foundation (CNCF)" + projectName = "OpenTelemetry" + pdfLink = "https://example.test/signed-cla.pdf" + v1Console = "https://legacy-console.example.test" + v2Console = "https://organization.example.test" + ) + + projectText := "regarding the project " + projectName + "." + claGroupText := "regarding the CLA Group " + claGroupName + "." + + testCases := []struct { + name string + version string + projectID string + icla bool + want string + doNotWant string + console string + }{ + { + name: "V1 ICLA keeps project lookup and project name", + version: utils.V1, + projectID: projectSFID, + icla: true, + want: projectText, + doNotWant: claGroupText, + }, + { + name: "V1 CCLA keeps project lookup and project name", + version: utils.V1, + projectID: projectSFID, + want: projectText, + doNotWant: claGroupText, + console: v1Console, + }, + { + name: "V2 ICLA uses exact CLA Group and ignores project mapping", + version: utils.V2, + projectID: "malformed-project-sfid-is-ignored-for-v2", + icla: true, + want: claGroupText, + doNotWant: projectText, + }, + { + name: "V2 CCLA uses exact CLA Group and ignores project mapping", + version: utils.V2, + projectID: "malformed-project-sfid-is-ignored-for-v2", + want: claGroupText, + doNotWant: projectText, + console: v2Console, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + svc := &documentSignedTemplateServiceStub{ + projectParams: CLAGroupTemplateParams{ + CLAGroupName: claGroupName, + CorporateConsole: v1Console, + Version: utils.V2, // deliberately wrong; the renderer argument is authoritative + Projects: []CLAProjectParams{ + {ExternalProjectName: projectName}, + }, + }, + claGroupParams: CLAGroupTemplateParams{ + CLAGroupName: claGroupName, + CorporateConsole: v2Console, + Version: utils.V1, // deliberately wrong; the renderer argument is authoritative + // No Projects are supplied. V2 rendering must not evaluate Project(). + }, + } + + result, err := RenderDocumentSignedTemplate( + svc, + tc.version, + claGroupID, + tc.projectID, + DocumentSignedTemplateParams{ + CommonEmailParams: CommonEmailParams{RecipientName: "Heather"}, + ICLA: tc.icla, + PdfLink: pdfLink, + }, + ) + if err != nil { + t.Fatalf("RenderDocumentSignedTemplate() error = %v", err) + } + + for _, expected := range []string{"Hello Heather", tc.want, pdfLink} { + if !strings.Contains(result, expected) { + t.Errorf("rendered email does not contain %q: %s", expected, result) + } + } + if strings.Contains(result, tc.doNotWant) { + t.Errorf("rendered email unexpectedly contains %q: %s", tc.doNotWant, result) + } + if tc.console != "" && !strings.Contains(result, tc.console) { + t.Errorf("rendered email does not contain corporate console %q: %s", tc.console, result) + } + + if tc.version == utils.V2 { + if svc.projectLookupCalls != 0 { + t.Errorf("project lookup calls = %d, want 0", svc.projectLookupCalls) + } + if svc.claGroupLookupCalls != 1 { + t.Errorf("CLA Group lookup calls = %d, want 1", svc.claGroupLookupCalls) + } + if svc.requestedCLAGroupID != claGroupID { + t.Errorf("requested CLA Group ID = %q, want %q", svc.requestedCLAGroupID, claGroupID) + } + } else { + if svc.projectLookupCalls != 1 { + t.Errorf("project lookup calls = %d, want 1", svc.projectLookupCalls) + } + if svc.claGroupLookupCalls != 0 { + t.Errorf("CLA Group lookup calls = %d, want 0", svc.claGroupLookupCalls) + } + if svc.requestedVersion != tc.version { + t.Errorf("requested version = %q, want %q", svc.requestedVersion, tc.version) + } + if svc.requestedProjectID != tc.projectID { + t.Errorf("requested project SFID = %q, want %q", svc.requestedProjectID, tc.projectID) + } + } + }) + } +} + +func TestRenderDocumentSignedTemplatePropagatesLookupError(t *testing.T) { + projectLookupErr := errors.New("project lookup failed") + claGroupLookupErr := errors.New("CLA Group lookup failed") + + testCases := []struct { + name string + version string + svc *documentSignedTemplateServiceStub + wantErr error + }{ + { + name: "V1 project lookup error", + version: utils.V1, + svc: &documentSignedTemplateServiceStub{projectErr: projectLookupErr}, + wantErr: projectLookupErr, + }, + { + name: "V2 exact CLA Group lookup error", + version: utils.V2, + svc: &documentSignedTemplateServiceStub{claGroupErr: claGroupLookupErr}, + wantErr: claGroupLookupErr, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + _, err := RenderDocumentSignedTemplate( + tc.svc, + tc.version, + "cla-group-id", + "project-sfid", + DocumentSignedTemplateParams{}, + ) + if !errors.Is(err, tc.wantErr) { + t.Fatalf("RenderDocumentSignedTemplate() error = %v, want %v", err, tc.wantErr) + } + + if tc.version == utils.V2 { + if tc.svc.projectLookupCalls != 0 || tc.svc.claGroupLookupCalls != 1 { + t.Errorf("lookup calls: project=%d CLAGroup=%d, want project=0 CLAGroup=1", tc.svc.projectLookupCalls, tc.svc.claGroupLookupCalls) + } + } else if tc.svc.projectLookupCalls != 1 || tc.svc.claGroupLookupCalls != 0 { + t.Errorf("lookup calls: project=%d CLAGroup=%d, want project=1 CLAGroup=0", tc.svc.projectLookupCalls, tc.svc.claGroupLookupCalls) + } + }) + } +} diff --git a/cla-backend-go/emails/prefill_test.go b/cla-backend-go/emails/prefill_test.go new file mode 100644 index 000000000..0f2575fef --- /dev/null +++ b/cla-backend-go/emails/prefill_test.go @@ -0,0 +1,76 @@ +// Copyright The Linux Foundation and each contributor to CommunityBridge. +// SPDX-License-Identifier: MIT + +package emails + +import ( + "errors" + "testing" + + "github.com/golang/mock/gomock" + v1Models "github.com/linuxfoundation/easycla/cla-backend-go/gen/v1/models" + projectMocks "github.com/linuxfoundation/easycla/cla-backend-go/project/mocks" + "github.com/linuxfoundation/easycla/cla-backend-go/utils" +) + +func TestGetCLAGroupTemplateParamsFromCLAGroupUsesAuthoritativeCLAGroup(t *testing.T) { + const ( + claGroupID = "b941159a-7bb9-4a07-bc03-6fcce4431434" + claGroupName = "ACES" + v1Console = "https://legacy-console.example.test" + v2Console = "https://organization.example.test" + ) + + ctrl := gomock.NewController(t) + defer ctrl.Finish() + + claGroupRepository := projectMocks.NewMockProjectRepository(ctrl) + claGroupRepository.EXPECT(). + GetCLAGroupByID(gomock.Any(), claGroupID, false). + Return(&v1Models.ClaGroup{ + ProjectID: claGroupID, + ProjectName: claGroupName, + ProjectExternalID: "malformed-project-mapping-is-not-used", + Version: utils.V2, + }, nil) + + // Mapping and project services are intentionally nil. The exact CLA Group + // lookup must not depend on either service. + svc := NewEmailTemplateService(claGroupRepository, nil, nil, v1Console, v2Console) + params, err := svc.GetCLAGroupTemplateParamsFromCLAGroup(claGroupID) + if err != nil { + t.Fatalf("GetCLAGroupTemplateParamsFromCLAGroup() error = %v", err) + } + + if params.CLAGroupName != claGroupName { + t.Errorf("CLA Group name = %q, want %q", params.CLAGroupName, claGroupName) + } + if params.CorporateConsole != v2Console { + t.Errorf("corporate console = %q, want %q", params.CorporateConsole, v2Console) + } + if params.Version != utils.V2 { + t.Errorf("version = %q, want %q", params.Version, utils.V2) + } + if len(params.Projects) != 0 { + t.Errorf("Projects length = %d, want 0", len(params.Projects)) + } +} + +func TestGetCLAGroupTemplateParamsFromCLAGroupPropagatesRepositoryError(t *testing.T) { + const claGroupID = "missing-cla-group-id" + lookupErr := errors.New("CLA Group lookup failed") + + ctrl := gomock.NewController(t) + defer ctrl.Finish() + + claGroupRepository := projectMocks.NewMockProjectRepository(ctrl) + claGroupRepository.EXPECT(). + GetCLAGroupByID(gomock.Any(), claGroupID, false). + Return(nil, lookupErr) + + svc := NewEmailTemplateService(claGroupRepository, nil, nil, "v1-console", "v2-console") + _, err := svc.GetCLAGroupTemplateParamsFromCLAGroup(claGroupID) + if !errors.Is(err, lookupErr) { + t.Fatalf("GetCLAGroupTemplateParamsFromCLAGroup() error = %v, want %v", err, lookupErr) + } +} diff --git a/cla-backend-go/v2/sign/handlers.go b/cla-backend-go/v2/sign/handlers.go index 7028f7bea..786e9639b 100644 --- a/cla-backend-go/v2/sign/handlers.go +++ b/cla-backend-go/v2/sign/handlers.go @@ -135,8 +135,8 @@ func Configure(api *operations.EasyclaAPI, service Service, userService users.Se if strings.Contains(err.Error(), "internal server error") { return sign.NewRequestCorporateSignatureInternalServerError().WithPayload(errorResponse(reqID, err)) } - if strings.Contains(err.Error(), "is sanctioned") { - desc := "We’re sorry, but you are currently unable to sign the Corporate Contributor License Agreement (CCLA). If you believe this may be an error, please reach out to support" + if strings.Contains(err.Error(), "requires further review for trade compliance") { + desc := "We're sorry, but this organization requires additional trade compliance review, so the Contributor License Agreement (CLA) cannot be completed at this time. If you believe this is an error, please contact EasyCLA Support via the chat widget." return sign.NewRequestCorporateSignatureForbidden().WithPayload(errorResponseWithDesc(reqID, err, desc)) } if err == projects_cla_groups.ErrProjectNotAssociatedWithClaGroup { diff --git a/cla-backend-go/v2/sign/service.go b/cla-backend-go/v2/sign/service.go index 4f016f1e4..825648544 100644 --- a/cla-backend-go/v2/sign/service.go +++ b/cla-backend-go/v2/sign/service.go @@ -278,11 +278,11 @@ func (s *service) RequestCorporateSignature(ctx context.Context, lfUsername stri } if sanctioned { if input.CompanySfid != nil { - err = fmt.Errorf("company %s is sanctioned", *input.CompanySfid) + err = fmt.Errorf("company %s requires further review for trade compliance", *input.CompanySfid) } else { - err = fmt.Errorf("company is sanctioned") + err = fmt.Errorf("company requires further review for trade compliance") } - log.WithFields(f).WithError(err).Error("company is sanctioned") + log.WithFields(f).WithError(err).Error("company requires further review for trade compliance") return nil, err } @@ -603,7 +603,7 @@ func (s *service) SignedIndividualCallbackGithub(ctx context.Context, payload [] recipients := []string{utils.GetBestEmail(claUser)} - body, err := emails.RenderDocumentSignedTemplate(s.emailTemplateService, claGroup.Version, claGroup.ProjectExternalID, emailParams) + body, err := emails.RenderDocumentSignedTemplate(s.emailTemplateService, claGroup.Version, signature.ProjectID, claGroup.ProjectExternalID, emailParams) if err != nil { log.WithFields(f).WithError(err).Warnf("unable to render document signed template for project version: %s, project ID: %s", claGroup.Version, claGroup.ProjectID) return err @@ -881,7 +881,7 @@ func (s *service) SignedIndividualCallbackGitlab(ctx context.Context, payload [] recipients := []string{utils.GetBestEmail(claUser)} - body, err := emails.RenderDocumentSignedTemplate(s.emailTemplateService, claGroup.Version, claGroup.ProjectExternalID, emailParams) + body, err := emails.RenderDocumentSignedTemplate(s.emailTemplateService, claGroup.Version, signature.ProjectID, claGroup.ProjectExternalID, emailParams) if err != nil { log.WithFields(f).WithError(err).Warnf("unable to render document signed template for project version: %s, project ID: %s", claGroup.Version, claGroup.ProjectID) return err @@ -1044,7 +1044,7 @@ func (s *service) SignedIndividualCallbackGerrit(ctx context.Context, payload [] recipients := []string{utils.GetBestEmail(claUser)} - body, err := emails.RenderDocumentSignedTemplate(s.emailTemplateService, claGroup.Version, claGroup.ProjectExternalID, emailParams) + body, err := emails.RenderDocumentSignedTemplate(s.emailTemplateService, claGroup.Version, signature.ProjectID, claGroup.ProjectExternalID, emailParams) if err != nil { log.WithFields(f).WithError(err).Warnf("unable to render document signed template for project version: %s, project ID: %s", claGroup.Version, claGroup.ProjectID) return err @@ -1226,8 +1226,8 @@ func (s *service) SignedCorporateCallback(ctx context.Context, payload []byte, c log.WithFields(f).WithError(complianceErr).Warnf("company compliance check failed in corporate callback for company %s; not finalizing CCLA", companyID) return complianceErr } else if sanctioned { - log.WithFields(f).Warnf("company %s is sanctioned; refusing to finalize corporate CLA in callback", companyID) - return fmt.Errorf("company %s is sanctioned; corporate CLA cannot be finalized", companyID) + log.WithFields(f).Warnf("company %s requires further review for trade compliance; refusing to finalize corporate CLA in callback", companyID) + return fmt.Errorf("company %s requires further review for trade compliance; corporate CLA cannot be finalized", companyID) } _, currentTime := utils.CurrentTime() @@ -2996,7 +2996,7 @@ func (s *service) checkCompanyCompliance(ctx context.Context, company *v1Models. "companyExternalID": company.CompanyExternalID, "sssMode": sssMode, } - log.WithFields(f).Debugf("starting company sanctions screening (mode=%s)", sssMode) + log.WithFields(f).Debugf("starting company trade compliance screening (mode=%s)", sssMode) // Short-circuit for manually/admin-set blocks (sanction_origin != "sss" or no origin). // SSS-origin blocks fall through so a now-clean result can clear them. diff --git a/cla-backend-legacy/internal/api/handlers.go b/cla-backend-legacy/internal/api/handlers.go index 042c13768..100e07858 100644 --- a/cla-backend-legacy/internal/api/handlers.go +++ b/cla-backend-legacy/internal/api/handlers.go @@ -8897,8 +8897,8 @@ func (h *Handlers) employeeSignaturePrecheck(ctx context.Context, projectID, com if blocked { fn := "employeeSignaturePrecheck" sanctioned := map[string]any{ - "sanctioned": fmt.Sprintf("%s - user %s, company %s is sanctioned", fn, userID, companyID), - "description": "We’re sorry, but you are currently unable to sign the Employee Contributor License Agreement (ECLA). If you believe this may be an error, please reach out to support", + "sanctioned": fmt.Sprintf("%s - user %s, company %s requires further review for trade compliance", fn, userID, companyID), + "description": "We're sorry, but this organization requires additional trade compliance review, so the Contributor License Agreement (CLA) cannot be completed at this time. If you believe this is an error, please contact EasyCLA Support via the chat widget.", "user_id": userID, "company_id": companyID, } From ae1c50eb9cbaa3157af69d104543275a14eab439 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C5=81ukasz=20Gryglicki?= Date: Wed, 22 Jul 2026 10:27:28 +0200 Subject: [PATCH 2/2] Add .venv to .gitignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Łukasz Gryglicki Assisted by [OpenAI](https://platform.openai.com/) Assisted by [GitHub Copilot](https://github.com/features/copilot) Assisted by [Claude](https://claude.ai) --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index a72907ca2..81a54d2f1 100755 --- a/.gitignore +++ b/.gitignore @@ -288,3 +288,4 @@ spans*.json *.out .claude/* /*user_emails.json +.venv