Users not getting organization "contact" role and re-direction

[jarias-lfx]

Summary

For CCLA contributors, they either proceed as CLA Manager to perform the CCLA signature or send an invitation to another user, either user don't get the ACS "contact" role assigned for the selected organization, making them unable to access the CLA Corporate Console https://organization.lfx.linuxfoundation.org.

Steps to Reproduce

1- Access the CLA Contributor Console from any PR.
2- Select Corporate Contributor.
3- Search and Select the organization from the list.
4- CLA contributor console asks:

5- Select NO.
6- Add the Name and Email for the CLA Manager.
7- The CLA Manager receives the following email:

8- The CLA Manager access "Accept Invite" URL, which will re-direct to https://myorg.lfx.dev/ for the user to create a LFID account.
9- The CLA Manager created the account and receives the Verification Email:

10- The verification link re-direct the user to the Organization Dashboard https://myorg.lfx.dev/.
11- The user gets:

Expected Behavior

1- The Link should send the user to the CLA Corporate Console https://organization.lfx.linuxfoundation.org not the Organization Dashboard. Note: Until both sites are merged in the future.
2- The verification link should send the user to the CLA Corporate Console https://organization.lfx.linuxfoundation.org not the Organization Dashboard.
3- The user needs to get the ACS role "contact" assigned to the LFID account. Without this role the user won't be able to access the CLA Corporate Console to start the signature process. Forcing the user to create a Support Ticket.

Additional Notes

The same scenario can occur directly from the CLA Corporate Console instead of the Contributor Console, when selecting another CLA Manager user.
The same scenario happens with already created LFID accounts.

[lukaszgryglicki]

I'm not sure what exactly should I change here:

1. The Link should send the user to the CLA Corporate Console https://organization.lfx.linuxfoundation.org/ not the Organization Dashboard. Note: Until both sites are merged in the future --> should I just change one link to another? Can you provide an example of 1st link (the one you are getting) and example of 2nd link (the one that you should be getting)?

2. The verification link should send the user to the CLA Corporate Console https://organization.lfx.linuxfoundation.org/ not the Organization Dashboard - same here, so I can find them in code and update.

3. The user needs to get the ACS role "contact" assigned to the LFID account. Without this role the user won't be able to access the CLA Corporate Console to start the signature process. Forcing the user to create a Support Ticket. - can you provide more details? Is this a role that we set in EasyCLA dynamoDB table? (if so, which one?) or is this some role assigned in user service/something else? Any feedback welcomed...

@jarias-lfx @mlehotskylf

[lukaszgryglicki]

The redirect URL issue (point (1) and (2)) is likely a configuration issue in the ACS service, where the USERACCEPTLINK placeholder redirects to the organization dashboard instead of the Corporate Console.

See: find.sh . '*.go' 'USERACCEPTLINK':

./v2/acs-service/client/invite/invite_client.go:94:  - `automate=false` Default email templates are sent to user. For custom email, enduser has to provide the tag `USERACCEPTLINK` in the `body` field to set the user accept link. The backend service will replace the tag with actual invite link.
./v2/acs-service/client/invite/invite_client.go:95:    e.g `<a href="USERACCEPTLINK">AcceptInvite</a>`
./v2/acs-service/client/invite/invite_client.go:308:  - `automate=false` Default email templates are sent to user. For custom email, enduser has to provide the tag `USERACCEPTLINK` in the `body` field to set the user accept link. The backend service will replace the tag with actual invite link.
./v2/acs-service/client/invite/invite_client.go:309:    e.g `<a href="USERACCEPTLINK">AcceptInvite</a>`
./v2/acs-service/models/create_bulk_invite.go:30:	// Example: \u003chtml\u003e\u003cbody\u003e\u003ch4\u003eUser Invite\u003c/h4\u003e \u003cp\u003e Welcome to platform. Click here to \u003ca href='USERACCEPTLINK'\u003eAcceptInvite\u003c/a\u003e \u003c/p\u003e \u003c/body\u003e\u003c/html\u003e or plain text
./v2/acs-service/models/create_invite_v2.go:30:	// Example: \u003chtml\u003e\u003cbody\u003e\u003ch4\u003eUser Invite\u003c/h4\u003e \u003cp\u003e Welcome to platform. Click here to \u003ca href='USERACCEPTLINK'\u003eAcceptInvite\u003c/a\u003e \u003c/p\u003e \u003c/body\u003e\u003c/html\u003e or plain text
./v2/acs-service/models/create_invite.go:34:	// Example: \u003chtml\u003e\u003cbody\u003e\u003ch4\u003eUser Invite\u003c/h4\u003e \u003cp\u003e Welcome to platform. Click here to \u003ca href='USERACCEPTLINK'\u003eAcceptInvite\u003c/a\u003e \u003c/p\u003e \u003c/body\u003e\u003c/html\u003e or plain text
./emails/v2_cla_manager_templates.go:209:<li>Please click on <a href="USERACCEPTLINK">Accept Invite</a> to create your LF Login.This is used to access the EasyCLA CLA Manager console.</li>
./emails/v2_cla_manager_templates.go:236:<li>Please click on <a href="USERACCEPTLINK">Accept Invite</a> to create your LF Login.This is used to access the EasyCLA CLA Manager console.</li>

This may require:

• ACS service configuration changes.
• Environment variable adjustments for redirect URLs.
• Coordination with the platform team to ensure proper redirects.

I'll try to address (3) for now...

[lukaszgryglicki]

PR for (3): #4825.

cc @mlehotskylf @jarias-lfx @ahmedomosanya