fixes

Author: callicles

README.md

@@ -126,6 +126,7 @@ This section amends your scenario list and adds missing scenarios.
 - If signed out: user sees auth-required state and can start GitHub login.
 - If signed in and authorized on at least one installed account: user sees the account list and install button.
 - If signed in but authorized on zero installed accounts: user sees install CTA for GitHub App flow.
+- Newly installed accounts start with no CLA text. Maintainers must publish their own CLA before external contributors can sign.
 
 ### 3) User selects Contributor
 
@@ -189,6 +190,7 @@ This section amends your scenario list and adds missing scenarios.
 ### 12) Installation lifecycle scenarios
 
 - Installation `created` or `unsuspend`: account row is created/reactivated, installation ID refreshed, and installation target metadata (`organization` vs `user`) is persisted.
+- New installations are initialized with empty CLA text and `cla_text_sha256 = null` (no built-in agreement/template is auto-published).
 - Installation `deleted` or `suspend`: account is deactivated and installation ID cleared.
 - Installation repository-change events refresh installation linkage.
 

app/admin/[orgSlug]/actions.ts

@@ -10,7 +10,7 @@ import { getBaseUrlFromHeaders } from "@/lib/cla/signing"
 
 const updateClaSchema = z.object({
   orgSlug: z.string().min(1),
-  claMarkdown: z.string().min(1, "CLA text cannot be empty"),
+  claMarkdown: z.string().trim().min(1, "CLA text cannot be empty"),
 })
 
 const toggleActiveSchema = z.object({

app/api/orgs/[orgSlug]/route.ts

@@ -70,6 +70,9 @@ export async function PATCH(
   if (typeof claMarkdown !== "string") {
     return NextResponse.json({ error: "claMarkdown or isActive is required" }, { status: 400 })
   }
+  if (claMarkdown.trim().length === 0) {
+    return NextResponse.json({ error: "CLA text cannot be empty" }, { status: 400 })
+  }
 
   const org = await updateOrganizationCla(orgSlug, claMarkdown)
   if (!org) {

app/api/webhook/github/route.ts

@@ -380,6 +380,68 @@ async function handlePrCheck(params: {
     })
   }
 
+  if (!org.claTextSha256 || org.claText.trim().length === 0) {
+    const check = await github.createCheckRun({
+      owner: orgSlug,
+      repo: repoName,
+      name: CHECK_NAME,
+      head_sha: headSha,
+      status: "completed",
+      conclusion: "failure",
+      output: {
+        title: "CLA: Configuration required",
+        summary: `@${orgSlug} has not published a CLA yet. A maintainer must configure one before contributors can sign.`,
+      },
+    })
+
+    const commentBody = generateUnconfiguredClaComment({
+      prAuthor,
+      orgName: org.name,
+      orgSlug: org.githubOrgSlug,
+      appBaseUrl: baseUrl,
+    })
+    const existingComment = await github.findBotComment(orgSlug, repoName, prNumber)
+    const comment = existingComment
+      ? await github.updateComment({
+          owner: orgSlug,
+          repo: repoName,
+          comment_id: existingComment.id,
+          body: commentBody,
+        })
+      : await github.createComment({
+          owner: orgSlug,
+          repo: repoName,
+          issue_number: prNumber,
+          body: commentBody,
+        })
+
+    await createAuditEvent({
+      eventType: "webhook.pr_check",
+      orgId: org.id,
+      actorGithubId: prAuthorId ? String(prAuthorId) : null,
+      actorGithubUsername: prAuthor,
+      payload: {
+        owner: orgSlug,
+        repo: repoName,
+        prNumber,
+        decision: "cla_unconfigured",
+        checkConclusion: check.conclusion,
+        commentId: comment.id,
+      },
+    })
+
+    return NextResponse.json({
+      message: `CLA is not configured for ${orgSlug}. Check failed until maintainers publish one.`,
+      check: { id: check.id, status: "failure", conclusion: check.conclusion },
+      comment: { id: comment.id, commentMarkdown: comment.body },
+      orgMember: false,
+      accountOwner: false,
+      signed: false,
+      needsResign: false,
+      configRequired: true,
+    })
+  }
+
   const sigStatus =
     typeof prAuthorId === "number"
       ? await getSignatureStatusByGithubId(orgSlug, String(prAuthorId))
@@ -693,3 +755,23 @@ function getBaseUrl(request: NextRequest): string {
   const url = new URL(request.url)
   return `${url.protocol}//${url.host}`
 }
+
+function generateUnconfiguredClaComment(params: {
+  prAuthor: string
+  orgName: string
+  orgSlug: string
+  appBaseUrl: string
+}) {
+  const { prAuthor, orgName, orgSlug, appBaseUrl } = params
+  const adminUrl = `${appBaseUrl}/admin/${encodeURIComponent(orgSlug)}`
+
+  return `### CLA setup in progress
+
+Hey @${prAuthor}, thanks for contributing to **${orgName}**.
+
+This repository has not published a Contributor License Agreement yet, so we cannot validate signatures for external contributors at this time.
+
+A maintainer must publish the CLA first: ${adminUrl}
+
+<sub>Once the CLA is configured, this check will enforce contributor signing automatically.</sub>`
+}

components/admin/org-manage-client.tsx

@@ -80,6 +80,7 @@ export function OrgManageClient({
     () => signers.filter((signature) => signature.claSha256 !== currentClaSha256),
     [signers, currentClaSha256]
   )
+  const hasConfiguredCla = Boolean(currentClaSha256 && currentClaMarkdown.trim().length > 0)
 
   function handleSave() {
     startTransition(async () => {
@@ -221,7 +222,7 @@ export function OrgManageClient({
         <Card>
           <CardContent className="py-4 text-center">
             <p className="font-mono text-2xl font-bold text-foreground" data-testid="version-count">
-              {currentClaSha256 ? currentClaSha256.slice(0, 7) : "---"}
+              {currentClaSha256 ? currentClaSha256.slice(0, 7) : "unset"}
             </p>
             <p className="text-xs text-muted-foreground">CLA Version</p>
           </CardContent>
@@ -305,8 +306,9 @@ export function OrgManageClient({
                 )}
               </CardTitle>
               <CardDescription>
-                This is the agreement contributors must sign before their PRs are accepted. Saving
-                creates a new version; existing signers will need to re-sign.
+                {hasConfiguredCla
+                  ? "This is the agreement contributors must sign before their PRs are accepted. Saving creates a new version; existing signers will need to re-sign."
+                  : "No CLA is configured yet. Publish your own CLA below to start enforcement."}
               </CardDescription>
             </div>
             {!isEditing ? (
@@ -365,7 +367,14 @@ export function OrgManageClient({
               />
             ) : (
               <div className="rounded-lg border bg-background p-6" data-testid="cla-preview">
-                <MarkdownRenderer content={claContent} />
+                {hasConfiguredCla ? (
+                  <MarkdownRenderer content={claContent} />
+                ) : (
+                  <p className="text-sm text-muted-foreground">
+                    No CLA configured yet. Click <strong>Edit</strong> and paste your own CLA in
+                    Markdown.
+                  </p>
+                )}
               </div>
             )}
           </CardContent>

components/sign/sign-cla-client.tsx

@@ -67,8 +67,9 @@ export function SignClaClient({
   const [actionError, setActionError] = useState<string | null>(null)
   const [isPending, startTransition] = useTransition()
 
+  const hasConfiguredCla = Boolean(currentSha256 && org.claMarkdown.trim().length > 0)
   const signed = alreadySigned || justSigned
-  const showSignAction = !signed
+  const showSignAction = !signed && hasConfiguredCla
 
   const signedBannerText = useMemo(() => {
     if (existingSignature && !justSigned) {
@@ -90,7 +91,7 @@ export function SignClaClient({
   }, [])
 
   function handleSign() {
-    if (!currentSha256) return
+    if (!currentSha256 || !hasConfiguredCla) return
 
     startTransition(async () => {
       setActionError(null)
@@ -142,6 +143,19 @@ export function SignClaClient({
         </div>
       )}
 
+      {!hasConfiguredCla && (
+        <div className="mb-6 flex items-center gap-3 rounded-xl border border-amber-500/30 bg-amber-500/5 px-5 py-4">
+          <AlertTriangle className="h-5 w-5 shrink-0 text-amber-500" />
+          <div>
+            <p className="text-sm font-medium text-foreground">CLA not configured yet</p>
+            <p className="text-xs text-muted-foreground">
+              A maintainer needs to publish this organization&apos;s CLA before contributors can
+              sign.
+            </p>
+          </div>
+        </div>
+      )}
+
       {needsResign && !justSigned && (
         <div
           className="mb-6 flex items-center gap-3 rounded-xl border border-amber-500/30 bg-amber-500/5 px-5 py-4"
@@ -192,18 +206,26 @@ export function SignClaClient({
             )}
           </CardTitle>
           <CardDescription>
-            Please read the full agreement below.
+            {hasConfiguredCla
+              ? "Please read the full agreement below."
+              : "No CLA has been published for this organization yet."}
             {showSignAction && " Scroll to the bottom to enable signing."}
           </CardDescription>
         </CardHeader>
         <CardContent>
-          <div
-            className="max-h-[500px] overflow-y-auto rounded-lg border bg-background p-6"
-            onScroll={handleScroll}
-            data-testid="cla-scroll-area"
-          >
-            <MarkdownRenderer content={org.claMarkdown} />
-          </div>
+          {hasConfiguredCla ? (
+            <div
+              className="max-h-[500px] overflow-y-auto rounded-lg border bg-background p-6"
+              onScroll={handleScroll}
+              data-testid="cla-scroll-area"
+            >
+              <MarkdownRenderer content={org.claMarkdown} />
+            </div>
+          ) : (
+            <div className="rounded-lg border border-dashed border-border bg-background/40 p-6 text-sm text-muted-foreground">
+              This page will show the agreement once a maintainer adds it in the admin dashboard.
+            </div>
+          )}
         </CardContent>
       </Card>
 

lib/db/queries.ts

@@ -189,8 +189,6 @@ export async function createOrganization(data: {
   installationId?: number
 }) {
   const db = await ensureDbReady()
-  const { DEFAULT_CLA_MARKDOWN } = await import("./seed")
-  const hash = await sha256Hex(DEFAULT_CLA_MARKDOWN)
 
   const rows = await db
     .insert(organizations)
@@ -208,8 +206,8 @@ export async function createOrganization(data: {
       adminUserId: data.adminUserId,
       isActive: true,
       installationId: data.installationId ?? null,
-      claText: DEFAULT_CLA_MARKDOWN,
-      claTextSha256: hash,
+      claText: "",
+      claTextSha256: null,
     })
     .returning()
 

tests/integration/api-suite.test.ts

@@ -1282,15 +1282,51 @@ test("Webhook: missing pull_request payload fields returns 400", async (baseUrl)
 
 test("Webhook: installation created registers new org", async (baseUrl) => {
   await resetDb(baseUrl)
-  const { data } = await sendWebhook(baseUrl, "installation", {
+  const { res, data } = await sendWebhook(baseUrl, "installation", {
     action: "created",
     installation: { account: { login: "new-org" } },
+    sender: { id: 1001, login: "orgadmin" },
   })
+  assertEqual(res.status, 200, "status")
   assert(data.message.includes("new-org"), "message references org")
   assert(data.org !== undefined, "org object returned")
+  assertEqual(data.org.claText, "", "no built-in CLA text")
+  assertEqual(data.org.claTextSha256, null, "no built-in CLA hash")
 
   const orgRes = await fetch(`${baseUrl}/api/orgs/new-org`)
+  const orgData = await orgRes.json()
   assertEqual(orgRes.status, 200, "new org accessible")
+  assertEqual(orgData.currentClaMarkdown, "", "org details expose empty CLA")
+  assertEqual(orgData.currentClaSha256, null, "org details expose null CLA hash")
+})
+
+test("Webhook: non-member PR on org without configured CLA fails with config required", async (baseUrl) => {
+  await resetDb(baseUrl)
+  await sendWebhook(baseUrl, "installation", {
+    action: "created",
+    installation: {
+      id: 33001,
+      account: { login: "new-org", id: 3301, type: "Organization" },
+    },
+    sender: { id: 1001, login: "orgadmin" },
+  })
+
+  const { res, data } = await sendWebhook(
+    baseUrl,
+    "pull_request",
+    makePrPayload({
+      action: "opened",
+      prAuthor: "new-contributor",
+      orgSlug: "new-org",
+      repoName: "starter-kit",
+      prNumber: 7,
+    })
+  )
+  assertEqual(res.status, 200, "status")
+  assertEqual(data.check.status, "failure", "check fails")
+  assertEqual(data.configRequired, true, "config required flag set")
+  assert(data.comment !== null, "bot comment posted")
+  assert(data.comment.commentMarkdown.includes("not published"), "comment explains missing CLA")
 })
 
 test("Webhook: personal-account installation stores user target metadata", async (baseUrl) => {