After a corporate CLA signing, EasyCLA returns the signatory to /org/easycla with the organization named on the address, so the page can restore the selection the cross-site redirect lost.
That name is resolved against AccountContextService.availableAccounts, which is the persona-seeded set. Org Lens access does not require it to be populated — a direct writer or auditor grant qualifies on its own, and so does the staff grant. For those viewers the named organization is never matched, the parameter is stripped, and they stay on the list they left.
It degrades safely: no wrong organization is selected, and a crafted link still cannot select one. But the feature does not work for them.
The access-aware source is OrgNavigationService, whose catalogue is filtered server-side by the same grants and, for staff, resolves a single organization by uid. Resolving through it would cover every class of viewer.
Not done in #2306 because it reverses the order of two things that PR deliberately sequences: the organization is adopted first and the catalogue re-pinned second, so the selector's pending default selection cannot reassign it a beat later. Resolving through the catalogue means reloading first and selecting after, which reworks that arbitration rather than extending it.
Scope: the corporate signing endpoint disallows platform admins, so staff cannot complete this flow to begin with. The affected population is holders of a direct writer or auditor grant with no persona-seeded accounts.
Adjacent — preview switch tears down an open hand-off
A related consequence of the same missing arbitration: an organization change on the preview route calls leaveForList(), which navigates away and destroys the component-scoped DialogService and the dialog with it. If the hand-off is open at that moment, the only copy of signUrl is discarded and the in-flight requestCorporateSignature is unsubscribed — the envelope EasyCLA already created is then unreachable.
The access-aware rework that this issue covers is the substrate for the fix: once the catalogue re-pin sequences the two sides of an organization change explicitly, teardown-during-hand-off becomes a case of that same coordination rather than a race.
After a corporate CLA signing, EasyCLA returns the signatory to
/org/easyclawith the organization named on the address, so the page can restore the selection the cross-site redirect lost.That name is resolved against
AccountContextService.availableAccounts, which is the persona-seeded set. Org Lens access does not require it to be populated — a direct writer or auditor grant qualifies on its own, and so does the staff grant. For those viewers the named organization is never matched, the parameter is stripped, and they stay on the list they left.It degrades safely: no wrong organization is selected, and a crafted link still cannot select one. But the feature does not work for them.
The access-aware source is
OrgNavigationService, whose catalogue is filtered server-side by the same grants and, for staff, resolves a single organization by uid. Resolving through it would cover every class of viewer.Not done in #2306 because it reverses the order of two things that PR deliberately sequences: the organization is adopted first and the catalogue re-pinned second, so the selector's pending default selection cannot reassign it a beat later. Resolving through the catalogue means reloading first and selecting after, which reworks that arbitration rather than extending it.
Scope: the corporate signing endpoint disallows platform admins, so staff cannot complete this flow to begin with. The affected population is holders of a direct writer or auditor grant with no persona-seeded accounts.
Adjacent — preview switch tears down an open hand-off
A related consequence of the same missing arbitration: an organization change on the preview route calls
leaveForList(), which navigates away and destroys the component-scopedDialogServiceand the dialog with it. If the hand-off is open at that moment, the only copy ofsignUrlis discarded and the in-flightrequestCorporateSignatureis unsubscribed — the envelope EasyCLA already created is then unreachable.The access-aware rework that this issue covers is the substrate for the fix: once the catalogue re-pin sequences the two sides of an organization change explicitly, teardown-during-hand-off becomes a case of that same coordination rather than a race.