fix(self-serve-sign): skip attestation when sending the CCLA by email

[ahmedomosanya]

When send_as_email is true, POST /v4/self-serve/request-corporate-signature no longer requires authority_acked and embargo_acked. Name and email remain required on that path; self-sign is unchanged.

Refs linuxfoundation/lfx-self-serve#2590

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 11bb773f-e1f2-4914-a60f-10aa6dbf8d91

📥 Commits

Reviewing files that changed from the base of the PR and between 4fda6d7 and 3b20aed.

📒 Files selected for processing (8)

• cla-backend-go/swagger/cla.v2.yaml
• cla-backend-go/swagger/common/self-serve-corporate-signature-input.yaml
• cla-backend-go/v2/self_serve_sign/handlers.go
• cla-backend-go/v2/self_serve_sign/handlers_test.go
• cla-backend-go/v2/self_serve_sign/service.go
• cla-backend-go/v2/self_serve_sign/service_test.go
• docs/M3_ORG_LENS_API.md
• utils/self_serve_request_corporate_signature.sh

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

Walkthrough

Changes

Corporate signature validation

Layer / File(s)	Summary
Conditional request validation cla-backend-go/v2/self_serve_sign/service.go, cla-backend-go/v2/self_serve_sign/service_test.go	Email requests now require nonblank authority_name and authority_email. Self-sign requests require both attestations. Tests cover both paths.
Signatory error mapping cla-backend-go/v2/self_serve_sign/handlers.go, cla-backend-go/v2/self_serve_sign/handlers_test.go	Missing email signatory details now return HTTP 400 with the ErrSignatoryRequired message.
Request contract documentation cla-backend-go/swagger/..., docs/M3_ORG_LENS_API.md, utils/self_serve_request_corporate_signature.sh	API specifications and utility documentation describe the conditional requirements for email and self-sign requests.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 3b20a

The conditional validation, error mapping, tests, and documented API contract align with the intended email-signing flow.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 5 files. (3 skipped: 3…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: email-based CCLA signing skips the attestation requirement.
Description check	✅ Passed	The description accurately explains the conditional attestation behavior and the required name and email fields.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 5 files. (3 skipped: 3 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/GH-2590-skip-attestation-on-send-as-email

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates the Self Serve CCLA flow so email-based signing requires signatory details instead of attestations, while preserving self-sign behavior.

Changes:

• Adds conditional signatory/attestation validation and HTTP 400 mapping.
• Adds service and handler tests.
• Updates Swagger, documentation, and utility guidance.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
utils/self_serve_request_corporate_signature.sh	Documents conditional requirements.
docs/M3_ORG_LENS_API.md	Updates endpoint behavior.
cla-backend-go/v2/self_serve_sign/service.go	Implements conditional validation.
cla-backend-go/v2/self_serve_sign/service_test.go	Tests both signing paths.
cla-backend-go/v2/self_serve_sign/handlers.go	Maps missing signatory details to 400.
cla-backend-go/v2/self_serve_sign/handlers_test.go	Tests error mapping.
cla-backend-go/swagger/common/self-serve-corporate-signature-input.yaml	Documents conditional fields.
cla-backend-go/swagger/cla.v2.yaml	Updates endpoint description.

Note

Copilot is running an experiment and ran this review at Balanced.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lukaszgryglicki]

/lgtm