Fix pre-existing legacy 502

[lukaszgryglicki]

cc @mlehotskylf @ahmedomosanya

Signed-off-by: Łukasz Gryglicki lgryglicki@cncf.io

Assisted by OpenAI

Assisted by GitHub Copilot

Assisted by Claude

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 704deb85-a49f-4fad-811b-9b05f38b0d34

📥 Commits

Reviewing files that changed from the base of the PR and between ae37751 and 405d87c.

📒 Files selected for processing (1)

• utils/prod_acs_role_flip.sh

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

Walkthrough

The handler now returns 404 when no signed and approved CCLA is found. The pull request also adds a production-only shell utility for ACS role operations and warden probes.

Changes

CCLA auto-create handling

Layer / File(s)	Summary
Handle missing CCLA lookup results cla-backend-go/v2/signatures/handlers.go, cla-backend-go/v2/signatures/handlers_sanctions_test.go	The handler returns 404 when the corporate-signature lookup finds no signed and approved CCLA. The test checks the error response and confirms that the auto-create service is not called.

Production ACS role utility

Layer / File(s)	Summary
Production checks and token retrieval utils/prod_acs_role_flip.sh	The script documents its command forms and defaults, checks production stage and AWS account settings, and retrieves and caches an M2M token.
ACS role operations utils/prod_acs_role_flip.sh	The script provides ACS request helpers and role and object-type ID lookup. It supports role-scope retrieval, grants, revocations, and warden probes.
Role status and command handling utils/prod_acs_role_flip.sh	The script reports role status and supports admin toggles with verification polling. It dispatches status, roles, admin, grant, revoke, and warden commands.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Operator
  participant prod_acs_role_flip.sh
  participant ACS
  Operator->>prod_acs_role_flip.sh: Request admin on or off
  prod_acs_role_flip.sh->>ACS: Grant or revoke system-admin and lf-staff
  ACS-->>prod_acs_role_flip.sh: Return role operation responses
  prod_acs_role_flip.sh->>ACS: Check system-admin state
  ACS-->>prod_acs_role_flip.sh: Return role state

Loading

Merge Risk: ⚪ Minimal · up to 405d8

No actionable merge-blocking issue is established for this change. The production utility may warn when it cannot confirm a role change.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description contains reviewer mentions and attribution only. It does not describe the handler fix, the added test, or the production ACS script.	Add a concise summary of the changes, including the missing signed CCLA 404 handling, the regression test, and the production ACS role-management utility. Include validation results if available.
Docstring Coverage	⚠️ Warning	Docstring coverage is 5.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 20 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title identifies the main defect fix and matches the handler change that prevents the pre-existing legacy 502 condition.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

The nil result is handled consistently with the API contract and covered by a focused regression test.

0 open findings

What changed in this PR

Prevents a pre-existing 502 when auto-ECLA creation cannot find a signed, approved CCLA, and adds a production ACS role-management helper.

Changes:

• Return HTTP 404 for missing CCLAs.
• Add regression coverage.
• Add a production ACS role helper.

File	Description
utils/​prod_acs_role_flip.sh	Adds production ACS role operations.
cla-backend-go/​v2/​signatures/​handlers.go	Handles missing CCLAs safely.
cla-backend-go/​v2/​signatures/​handlers_sanctions_test.go	Tests the new 404 response.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[mlehotskylf]

Handler fix LGTM: GetCorporateSignature returns (nil, nil) when no CCLA exists, which caused the 502. The 404 and the test are right.

Before approval, please drop utils/prod_acs_role_flip.sh from this PR and from #5247. It's unrelated to the 502 and needs its own PR and review (see inline).

The cypress-functional failure is unrelated (Auth0 dev /oauth/token returned 403), so a re-run should fix it.

[lukaszgryglicki]

Replied inline: the script is a local-only util (needs the operator's own tokens, mirrors the merged dev one, not deployed, bots flagged nothing harmful) and stays in this PR - please re-review.

[Copilot]

🟢 Approval recommended

The focused nil guard matches repository behavior and is covered by a targeted regression test.

0 open findings

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.