EasyCLA Bug Report Inconsistence announcement for "whitelist" removal

[mlehotskylf]

Summary

Announcement from 6/20/2020 doesn't seem to be correct. I still found many references to "whitelist" in the code.

Changing all sources will be relatively easy - the biggest issue are API endpoints that contain “whitelist” keyworld in their URLs - for them we must update: BE, acs-cli, lfx-gateway and all consumers accordingly.

See these Slack conversations for more details:

• https://linuxfoundation.slack.com/archives/C0697E1QHNG/p1754145688657439
• https://linuxfoundation.slack.com/archives/C0697E1QHNG/p1754145765592609

[lukaszgryglicki]

On it.

[lukaszgryglicki]

I will 1st create version that replaces maximum possible things and only leaving actual API URLs untouched - so that will not need consumers updates nor acs-cli, lfx-gateway.

I'm changing words: (?i)master, (?i)slave, (?i)black(_-)?list, (?i)white(_-)?list.

[lukaszgryglicki]

There is even a DynamoDB table cla-{stage}-ccla-whitelist-requests - should I rename it as well - this can be quite dangerous... and requires prod DynamoDB access and can only be done during deployment @mlehotskylf ?

[lukaszgryglicki]

Also some property names inside cla-{stage}-signatures table are using non-inclusive words like:

  EmailApprovalList             []string `json:"email_whitelist,omitempty"`                                                                                                                  
  EmailDomainApprovalList       []string `json:"domain_whitelist,omitempty"`                                                                                                                               
  GitHubUsernameApprovalList    []string `json:"github_whitelist,omitempty"`                                                                                                                                                            
  GitHubOrgApprovalList         []string `json:"github_org_whitelist,omitempty"`  

Changing them will also be dangerous as it is a DB change that needs to be in sync with the deployment.

We need to discuss this and decide how deep should we go with this, especially those items:

• Changing AWS DynamoDB table names (dangerous IMHO, needs to sync deployment with DB updates, needs to preserve all data we have).
• Changing AWS DynamoDB item properties (even more dangerous IMHO: the same as above plus we need to convert existing data to a new format which must be done basically during the deployment "on-the-fly" and preserve all structure, indices, projections, etc.).
• Changing API endpoints URLs (requires updates to acs-cli, lfx-gateway, consumers - all of this needs to be done in sync).
• Update all texts, log messages, comments - very safe.
• Update all internal method names, function signatures - safe.

cc @mlehotskylf

[lukaszgryglicki]

Those are endpoints that needs URL updates:

V1:                                                                                   
  /company/{company_id}/import/whitelist/csv                                                         
  /signature/ (in JSON body)                                                                                       
V2:                                                                                                                      
  /user/{user_id}/request-company-whitelist/{company_id}                                                                
V3:                                                                                      
  /signatures/{signatureID}/gh-org-whitelist                                           
  /company/{companyID}/ccla-whitelist-requests/{projectID}                                     
  /company/{companyID}/ccla-whitelist-requests/{projectID}/user/{userID}                                                                                           
  /company/{companyID}/ccla-whitelist-requests/{projectID}/{requestID}/approve                                                                                                                       
  /company/{companyID}/ccla-whitelist-requests/{projectID}/{requestID}/reject                                                                                                                                        
  /company/{companyID}/ccla-whitelist-requests                                                                                                                                                                                                                    
V4:                                                                                                                                                                                                                     
  /signatures/{signatureID}/gh-org-whitelist   

[lukaszgryglicki]

Merged & deployed to dev - confirmed that it works correctly. Will create a PR for prod.