M2 prod BE

[lukaszgryglicki]

M2 BE prod. After merging this, all M2 features will be on prod/main.

Signed-off-by: Łukasz Gryglicki lgryglicki@cncf.io

Assisted by OpenAI

Assisted by GitHub Copilot

Assisted by Claude

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 32dbee13-ba43-4afc-bc10-d4889a5d1250

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Rolls the M2 backend features into production, covering Self Serve signing, My CLAs, CLA search, sanctions, and ICLA invalidation.

Changes:

• Adds Self Serve signing and trusted-caller authorization.
• Expands My CLAs, CLA manager requests, search, and sanctions handling.
• Adds invalidation metadata, audit events, tests, documentation, and operational utilities.

Reviewed changes

Copilot reviewed 76 out of 79 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
cla-backend-go/auth/trusted_caller.go	Adds trusted-client JWT verification.
cla-backend-go/auth/trusted_caller_test.go	Tests trusted-caller verification.
cla-backend-go/cmd/server.go	Wires M2 services and routes.
cla-backend-go/company/models.go	Adds sanction metadata fields.
cla-backend-go/company/projections.go	Projects sanction metadata.
cla-backend-go/company/repository.go	Updates sanction persistence semantics.
cla-backend-go/company/repository_test.go	Tests sanction updates.
cla-backend-go/config/config.go	Adds trusted-caller configuration.
cla-backend-go/config/ssm.go	Loads trusted-caller settings.
cla-backend-go/config/ssm_test.go	Tests SSM configuration loading.
cla-backend-go/emails/contact_cla_manager_templates.go	Adds CLA manager email templates.
cla-backend-go/events/event_data.go	Adds M2 audit event data.
cla-backend-go/events/event_data_test.go	Tests event details.
cla-backend-go/events/event_types.go	Defines new event types.
cla-backend-go/go.mod	Updates the Go toolchain patch.
cla-backend-go/signatures/dbmodels.go	Adds invalidation metadata fields.
cla-backend-go/signatures/mocks/mock_repo.go	Updates repository mocks.
cla-backend-go/signatures/mocks/mock_service.go	Updates service mocks.
cla-backend-go/signatures/repository.go	Persists invalidation metadata.
cla-backend-go/signatures/repository_test.go	Tests signature persistence.
cla-backend-go/signatures/service.go	Expands approval evaluation.
cla-backend-go/signatures/service_test.go	Tests approval behavior.
cla-backend-go/swagger/cla.v2.yaml	Defines the M2 API surface.
cla-backend-go/swagger/common/cla-search-list.yaml	Defines search-list responses.
cla-backend-go/swagger/common/cla-search-org.yaml	Defines search organizations.
cla-backend-go/swagger/common/cla-search-result.yaml	Defines search results.
cla-backend-go/swagger/common/company.yaml	Exposes sanction metadata.
cla-backend-go/swagger/common/icla-invalidation-input.yaml	Defines invalidation input.
cla-backend-go/swagger/common/my-cla-list.yaml	Expands My CLAs responses.
cla-backend-go/swagger/common/my-cla-manager-list.yaml	Defines manager lists.
cla-backend-go/swagger/common/my-cla-manager-request-result.yaml	Defines manager-request results.
cla-backend-go/swagger/common/my-cla-manager-request.yaml	Defines manager requests.
cla-backend-go/swagger/common/my-cla-manager.yaml	Defines CLA managers.
cla-backend-go/swagger/common/my-cla.yaml	Expands CLA status details.
cla-backend-go/swagger/common/prepare-sign-input.yaml	Defines prepare-sign input.
cla-backend-go/swagger/common/prepare-sign.yaml	Defines prepare-sign output.
cla-backend-go/utils/const.go	Adds Self Serve constants.
cla-backend-go/utils/const_test.go	Tests Self Serve metadata helpers.
cla-backend-go/utils/string_utils.go	Adds text sanitization helpers.
cla-backend-go/utils/string_utils_test.go	Tests text sanitization.
cla-backend-go/v2/cla_search/cache.go	Adds search caching.
cla-backend-go/v2/cla_search/cache_test.go	Tests cache behavior.
cla-backend-go/v2/cla_search/handlers.go	Adds the search handler.
cla-backend-go/v2/cla_search/handlers_test.go	Tests search HTTP handling.
cla-backend-go/v2/cla_search/repository.go	Implements search data access.
cla-backend-go/v2/cla_search/service.go	Implements search matching.
cla-backend-go/v2/cla_search/service_test.go	Tests search results.
cla-backend-go/v2/my_clas/cla_managers_test.go	Tests manager workflows.
cla-backend-go/v2/my_clas/handlers.go	Expands My CLAs endpoints.
cla-backend-go/v2/my_clas/handlers_test.go	Tests My CLAs handlers.
cla-backend-go/v2/my_clas/prefetch.go	Adds concurrent dependency prefetching.
cla-backend-go/v2/my_clas/sanctions.go	Adds listing-time screening.
cla-backend-go/v2/my_clas/sanctions_test.go	Tests screening behavior.
cla-backend-go/v2/my_clas/service.go	Implements expanded My CLAs logic.
cla-backend-go/v2/my_clas/service_test.go	Tests My CLAs behavior.
cla-backend-go/v2/project-service/client.go	Synchronizes cache-size access.
cla-backend-go/v2/self_serve_sign/handlers.go	Adds prepare-sign handling.
cla-backend-go/v2/self_serve_sign/service.go	Implements Self Serve preparation.
cla-backend-go/v2/self_serve_sign/service_test.go	Tests preparation and ownership.
cla-backend-go/v2/sign/handlers.go	Adds the Self Serve callback.
cla-backend-go/v2/sign/helpers.go	Adds Self Serve signing helpers.
cla-backend-go/v2/sign/icla_block_test.go	Tests invalidated-ICLA blocking.
cla-backend-go/v2/sign/self_serve_test.go	Tests Self Serve signing integration.
cla-backend-go/v2/sign/service.go	Integrates callbacks, sanctions, and blocking.
cla-backend-go/v2/signatures/handlers.go	Accepts invalidation metadata.
cla-backend-go/v2/signatures/service.go	Records invalidation metadata and events.
cla-backend-go/v2/signatures/service_test.go	Tests invalidation behavior.
cla-backend-legacy/go.mod	Refreshes legacy dependencies.
cla-backend-legacy/go.sum	Updates dependency checksums.
cla-backend-legacy/internal/api/handlers.go	Aligns legacy sanctions behavior.
cla-backend-legacy/internal/api/handlers_self_serve_test.go	Tests legacy Self Serve behavior.
cla-backend-legacy/internal/store/companies.go	Adds legacy sanction update semantics.
cla-backend-legacy/internal/store/companies_test.go	Tests legacy sanction updates.
docs/MY_CLAS_API.md	Documents the expanded APIs.
utils/cla_search.sh	Adds a search diagnostic utility.
utils/my_cla_manager_request.sh	Adds a manager-request utility.
utils/my_cla_managers.sh	Adds a manager lookup utility.
utils/prepare_sign.sh	Adds a signing-flow utility.
utils/update_company_is_sanctioned.sh	Aligns manual sanction updates.

Files not reviewed (2)

• cla-backend-go/signatures/mocks/mock_repo.go: Generated file
• cla-backend-go/signatures/mocks/mock_service.go: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.