Update sanctioned message

[lukaszgryglicki]

Required by linuxfoundation/easycla-contributor-console#506, also mentioned here: #5108 (comment)

Signed-off-by: Łukasz Gryglicki lgryglicki@cncf.io

Assisted by OpenAI

Assisted by GitHub Copilot

Assisted by Claude

[coderabbitai]

Walkthrough

Updates Go and legacy signature compliance handling to describe companies requiring further trade compliance review, including revised blocked responses and corporate CLA finalization errors.

Changes

Trade compliance handling

Layer / File(s)	Summary
Compliance gating and callback handling cla-backend-go/v2/sign/service.go	Corporate signature initiation, callback finalization, and compliance screening logs use updated trade compliance review wording.
Blocked response mapping cla-backend-go/v2/sign/handlers.go, cla-backend-legacy/internal/api/handlers.go	Handlers recognize trade compliance review conditions and return revised forbidden response descriptions while preserving existing response structures and status behavior.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main change: updating the sanctioned/trade-compliance message wording.
Description check	✅ Passed	The description is related to the change and references the linked PRs driving it.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch unicron-fix-sanctioned-wording

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates user-facing messaging for organizations requiring additional trade-compliance review.

Changes:

• Replaces sanctioned-entity wording with trade-compliance review messaging.
• Updates corporate-signature error classification and blocked-signature descriptions.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
cla-backend-legacy/internal/api/handlers.go	Updates blocked employee-signature messaging.
cla-backend-go/v2/sign/handlers.go	Updates corporate-signature compliance error handling and messaging.

[lukaszgryglicki]

Good catch. This is a real compatibility issue because the error text is used to select the existing 403 response, while the producer-side wording is being changed separately in #5108.

I updated the condition to recognize both the current is sanctioned text and the revised requires further review for trade compliance text. This allows #5113 to merge first and preserves the existing 403 behavior before and after #5108. No HTTP status or other behavioral changes are intended.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

cla-backend-go/v2/sign/handlers.go:140

• Please add a regression test for this new error-to-403 mapping. The status depends on matching service error text, and that coupling already produced the earlier mismatch in this PR; currently no *_test.go exercises RequestCorporateSignature through this handler. Have the service return the new trade-compliance error and assert the forbidden response and description.

				if strings.Contains(err.Error(), "is sanctioned") || strings.Contains(err.Error(), "requires further review for trade compliance") {
					desc := "We're sorry, but this organization requires additional trade compliance review, so the Contributor License Agreement (CLA) cannot be completed at this time. If you believe this is an error, please contact EasyCLA Support via the chat widget."
					return sign.NewRequestCorporateSignatureForbidden().WithPayload(errorResponseWithDesc(reqID, err, desc))

[lukaszgryglicki]

Updated. Since #5113 now changes the RequestCorporateSignature producer and its handler together, the handler matches only requires further review for trade compliance. The obsolete is sanctioned fallback has been removed.

The existing NewRequestCorporateSignatureForbidden() response remains unchanged, so the path continues to return HTTP 403. The legacy errors.sanctioned property remains only as the API compatibility key consumed by the contributor console.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cla-backend-go/v2/sign/handlers.go`:
- Around line 138-140: Update the trade-compliance condition in the sign request
handler to match both the revised “requires further review for trade compliance”
wording and the legacy “is sanctioned” wording. Preserve the existing 403
response and descriptive payload through
sign.NewRequestCorporateSignatureForbidden for either match.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 941b811e-c9ef-43d2-97d4-bf3b72002c10

📥 Commits

Reviewing files that changed from the base of the PR and between 6f9f46b and 9b7c7f1.

📒 Files selected for processing (1)

• cla-backend-go/v2/sign/handlers.go

[lukaszgryglicki]

@ahmedomosanya @mlehotskylf PTAL.