fix(company): return 404 when a CLA group's project is gone

[ahmedomosanya]

GET /v4/company/{companyID}/project/{projectSFID}/cla-managers now returns 404 when the project service reports the CLA Group's project no longer exists, instead of the generic 400. The permission check still runs first, and every other error stays 400. The swagger already declared this 404, so there is no API contract change.

This lets LFX Self Serve fall back to the CLA-group manager list for these CLA Groups without treating genuine bad requests the same way.

Refs linuxfoundation/lfx-self-serve#2953

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 524bebe8-d3ee-4e62-af41-d1cdb71e955a

📥 Commits

Reviewing files that changed from the base of the PR and between f04d728 and 33076cb.

📒 Files selected for processing (2)

• cla-backend-go/v2/company/handlers.go
• cla-backend-go/v2/company/handlers_test.go

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

Walkthrough

The company project CLA-managers handler now returns 404 for project-service project-not-found errors. Other service errors retain the existing 400 response path. Tests cover successful lookup, error cases, and permission denial before lookup.

Changes

Company project CLA managers

Layer / File(s)	Summary
Project-not-found response cla-backend-go/v2/company/handlers.go	The handler detects project-service project-not-found errors and returns 404. Other errors continue through the existing bad-request path.
Handler test coverage cla-backend-go/v2/company/handlers_test.go	The fake service supports configurable company data and CLA-manager lookup errors. Tests check success, direct and wrapped project-not-found errors, other service failures, and permission denial before lookup.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 33076

Missing projects now return 404 so clients can use their intended fallback, while other failures remain distinguishable. No actionable merge-blocking risk was identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely states the main change: return 404 when the CLA group's project no longer exists.
Description check	✅ Passed	The description directly explains the 404 behavior, preserved permission and error handling, API contract, and intended fallback behavior.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused implementation matches the existing API contract and includes appropriate regression coverage.

Review effort: Balanced
Findings: None

What changed in this PR

Returns the documented 404 when a project-service lookup fails because the project is missing.

Changes:

• Detects direct and wrapped project-not-found errors.
• Preserves permission-first behavior and existing 400 handling.
• Adds handler coverage for success, authorization, and error paths.

File	Description
cla-backend-go/​v2/​company/​handlers.go	Maps project-service not-found errors to HTTP 404.
cla-backend-go/​v2/​company/​handlers_test.go	Tests status mapping and permission ordering.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ahmedomosanya]

cypress-functional is failing for a reason unrelated to this change. Every spec fails in its before all hook, before any test runs, because the Cypress test user's login to the DEV Auth0 tenant (/oauth/token) returns 403 Forbidden. This workflow runs against the currently deployed DEV API rather than this PR's code, and the same job was passing on other PRs earlier today. A re-run of the failed job gave the same 403.

This looks like the test account or its credentials being refused by Auth0 (blocked user, rotated password, or grant setting), so it likely needs someone with access to the DEV Auth0 tenant to check.

[lukaszgryglicki]

LGTM: permission check stays first, errors.As catches direct and wrapped project-service NotFound, swagger already declares 404, handler tests pass locally on the PR head; the Cypress failure is the known flaky run against the deployed dev API.

[lukaszgryglicki]

That cypress failure happened before (many times) and it seems to be related to cypress itself - the next day it just works OK and all same failures are green then.