Return 403 for unauthorized CLA manager removal (main)

[mlehotskylf]

Same change as #5243, against main, because the M3 features are already in prod. The commit is cherry-picked unchanged; the v2/cla_manager code is identical on main and dev.

Summary

• DELETE /v4/company/{companyID}/project/{projectSFID}/cla-manager/{userLFID} answered an authorization denial with 400. It now returns the 403 the spec already documents (forbidden-or-company-sanctioned).
• The POST .../cla-manager denial message said DeleteCLAManager. It now says CreateCLAManager.
• Both messages now print the company SFID that the scope check uses, instead of the internal company ID.

Who is allowed does not change. Found by the M3 API role-matrix run against dev (linuxfoundation/lfx-self-serve#1968).

Clients

• Org Lens: classifyOrgClaManagerRefusal (packages/shared/src/utils/org-cla-manager.utils.ts in linuxfoundation/lfx-self-serve) checks the body text before the status, so it classifies the refusal the same way.
• Corporate Console: remove-cla-manager.ts passes the status through as the result code and does not branch on it.
• Cypress v4 suite: no test expects 400 for a denied delete. The positive delete is still 204.

Test plan

• go test ./v2/cla_manager/ on this branch: TestClaManagerCreateDeleteHandlersRejectUnauthorizedUsers covers an LF admin and an unrelated-company scope on create and delete. It expects 403, no service call, and a message that names the operation and the SFID.
• go build ./...
• After the prod deploy, a denied cla-manager delete returns 403.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 24ffdc56-fe59-4a7c-8538-41f42f47b081

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

The minimal implementation matches the API specification and includes focused regression coverage.

0 open findings

What changed in this PR

Corrects unauthorized CLA-manager responses to match the documented v4 API contract.

Changes:

• Returns HTTP 403 for unauthorized manager deletion.
• Corrects operation names and company SFIDs in denial messages.
• Adds focused authorization regression tests.

File	Description
cla-backend-go/​v2/​cla_manager/​handlers.go	Corrects authorization responses and messages.
cla-backend-go/​v2/​cla_manager/​handlers_test.go	Covers unauthorized create/delete requests.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[lukaszgryglicki]

/lgtm