Return 403 for unauthorized CLA manager removal

[mlehotskylf]

Summary

• DELETE /v4/company/{companyID}/project/{projectSFID}/cla-manager/{userLFID} answered an authorization denial with 400. It now returns the 403 the spec already documents (forbidden-or-company-sanctioned).
• The POST .../cla-manager denial message said DeleteCLAManager. It now says CreateCLAManager.
• Both messages now print the company SFID that the scope check uses, instead of the internal company ID.

Who is allowed does not change. Found by the M3 API role-matrix run against dev (linuxfoundation/lfx-self-serve#1968).

Clients

• Org Lens: classifyOrgClaManagerRefusal (packages/shared/src/utils/org-cla-manager.utils.ts in linuxfoundation/lfx-self-serve) checks the body text before the status, so it classifies the refusal the same way.
• Corporate Console: remove-cla-manager.ts passes the status through as the result code and does not branch on it.
• Cypress v4 suite: no test expects 400 for a denied delete. The positive delete is still 204.

Test plan

• go test ./v2/cla_manager/: new TestClaManagerCreateDeleteHandlersRejectUnauthorizedUsers covers an LF admin and an unrelated-company scope on create and delete. It expects 403, no service call, and a message that names the operation and the SFID. It failed before the fix.
• go build ./...
• After the dev deploy, the role-matrix cla-manager.delete deny cells show 403.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 0eb50fa9-4ca4-4afb-989f-04029d67f1e9

📥 Commits

Reviewing files that changed from the base of the PR and between 1cb72b3 and b0432d9.

📒 Files selected for processing (2)

• cla-backend-go/v2/cla_manager/handlers.go
• cla-backend-go/v2/cla_manager/handlers_test.go

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

Walkthrough

The CLA Manager create and delete handlers now report the company external ID in authorization-denial messages. Delete authorization failures return Forbidden. Tests cover unauthorized requests for both operations.

Changes

CLA Manager authorization denials

Layer / File(s)	Summary
Handler denials and validation cla-backend-go/v2/cla_manager/handlers.go, cla-backend-go/v2/cla_manager/handlers_test.go	Create denials identify CreateCLAManager and the company external ID. Delete denials use the company external ID and return HTTP 403. Tests verify the denial responses and messages, and confirm that no service calls occur.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b0432

The CLA manager denial changes appear ready to merge after normal checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: unauthorized CLA manager removal now returns HTTP 403.
Description check	✅ Passed	The description accurately covers the response-code change, denial-message corrections, affected clients, and test plan.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

The narrow changes preserve authorization logic and have focused regression coverage, with no unresolved findings.

0 open findings

What changed in this PR

Aligns CLA manager authorization-denial responses with the API contract without changing permissions.

Changes:

• Returns 403 instead of 400 for unauthorized removal.
• Corrects denial messages to identify the operation and company SFID.
• Adds regression tests for unauthorized create and delete requests.

File	Description
cla-backend-go/​v2/​cla_manager/​handlers.go	Corrects denial status and messages.
cla-backend-go/​v2/​cla_manager/​handlers_test.go	Verifies 403 responses, messages, and no service calls.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lukaszgryglicki]

/lgtm - provide the same PR for the main branch @mlehotskylf as we now also have M3 features in prod.