Add test coverage

Signed-off-by: Lukasz Gryglicki <lgryglicki@cncf.io>

Assisted by [OpenAI](https://platform.openai.com/)

Assisted by [GitHub Copilot](https://github.com/features/copilot)

Assisted by [Claude](https://claude.ai)

Author: lukaszgryglicki

cla-backend-go/v2/sign/service_sss_test.go

@@ -5,6 +5,7 @@ package sign
 
 import (
 	"context"
+	"errors"
 	"sync"
 	"testing"
 	"time"
@@ -82,6 +83,42 @@ func newTestSSSClient(t *testing.T) *sss.Client {
 	return client
 }
 
+// checkCompanyCompliance routes an unexpected (non-clean/non-flagged) SSS status through
+// complianceUnavailable; these cover its decision so an ambiguous status never auto-clears
+// or caches a sanction.
+func TestComplianceUnavailableRequiredBlocks(t *testing.T) {
+	svc := &service{sssRequired: true}
+	blocked, err := svc.complianceUnavailable(logrus.Fields{}, &models.Company{CompanyID: "company-id"}, errors.New(`unexpected SSS status "weird"`))
+	if err == nil {
+		t.Fatal("expected required mode to block (error) on an ambiguous result")
+	}
+	if blocked {
+		t.Fatal("expected blocked=false alongside the error in required mode")
+	}
+}
+
+func TestComplianceUnavailableOptionalAllowsUnsanctioned(t *testing.T) {
+	svc := &service{sssRequired: false}
+	blocked, err := svc.complianceUnavailable(logrus.Fields{}, &models.Company{CompanyID: "company-id", IsSanctioned: false}, errors.New(`unexpected SSS status "weird"`))
+	if err != nil {
+		t.Fatalf("optional mode should not error on an ambiguous result, got %v", err)
+	}
+	if blocked {
+		t.Fatal("optional mode with no persisted sanction should allow")
+	}
+}
+
+func TestComplianceUnavailableOptionalHonorsPersistedSanction(t *testing.T) {
+	svc := &service{sssRequired: false}
+	blocked, err := svc.complianceUnavailable(logrus.Fields{}, &models.Company{CompanyID: "company-id", IsSanctioned: true, SanctionOrigin: "sss"}, errors.New(`unexpected SSS status "weird"`))
+	if err != nil {
+		t.Fatalf("optional mode should not error on an ambiguous result, got %v", err)
+	}
+	if !blocked {
+		t.Fatal("optional mode must keep blocking a persisted sanction (no auto-clear) on an ambiguous result")
+	}
+}
+
 func TestCheckCompanyComplianceRequiredBlocksMissingExternalID(t *testing.T) {
 	svc := &service{sssRequired: true, sssClient: newTestSSSClient(t)}