CLDR-18165 cla: add GitHub login

[srl295]

CLDR-18165

UI:

• CLA flow first offers to login with GitHub to validate signature. See CLA flow and screenshots below

Servlet:

• new servlet /cldr-apps/github-login to receive GitHub OAuth2 flow.

Under the hood:

• add LoginManager to manage login flow, in the future this could be leveraged to enable SSO (login to SurveyTool with Github, other providers).

• add STRestClient to add a simple JSON-based REST client. Just a refactor of some common code.

• we read from signatures.json which is a download from cla-assistant.io. We re-read this file on every successful GitHub login currently, so that this file can be updated by some process (this is part of the workflow challenge on our end).

• This PR completes the ticket.

• TODO in a future PR: document! especially GitHub app creation and setup. this article was used as a basis, but also need to document maintenance

This PR does NOT have an admin UI to let the administrator get users 'unstuck', that is a simple matter of SQL (SMOS) currently, with an admin UI for a future PR.

ALLOW_MANY_COMMITS=true

Review Screenshots

Note

Some screenshots may be out of date, see comments below.

New user readonly

• New user (not a corp signatory) when they haven't signed the CLA yet. They get a readonly experience.
  
  

Main menu

• Main menu item - this way we can ask people to click it for support.
  

Login with GitHub

• Clicking the "CLA must be signed" banner or visiting via the main menu presents this screen:
  
• Clicking Sign Manually goes to the Manual Sign page.
• Clicking Login with Github gives them the normal login flow (the app picture of me is temporary, tells you it's not the official app, and we would say "to continue to Unicode CLDR SurveyTool")
  

Successful sign with GitHub

• If the user has signed the CLA with GitHub, GitHub redirects to the github-login servlet, records the CLA signing in the database, and then shows this page:

The details (name, email, employer) are pulled from the GitHub signing data but are not editable. The "to view" link is the usual cla-assistant.io link which gives you the full text and more details.

What if I haven't signed with GitHub?

• Logging in with GitHub redirects you to this page if you have NOT signed the CLA:
  
• Clicking Change GitHub account gives you GitHub's account picker page, you can change accounts (would list multiple)
  
• Depending on the signatory status, you either get the Success page or loop back to the "CLA Signature Not Found" page"
• Clicking Sign Manually goes to the Manual Sign page, below
• Contact Us writes the same contact email recently established for CLDR cla.

Manual Sign

• See CLDR-17612 cla: update text, record version #4233 for the updates to this page
  

• One new button that takes you BACK to the Login with Github page
  

Corp users

• User of an org (ibm) that has already signed the Corp CLA (we don't show the CLA text, because it's not this CLA that was signed.). User would only see this if they click the CLA item in the main menu.

[srl295]

• needs major rebase on CLDR-17612 cla: update text, record version #4233 done

[jira-pull-request-webhook]

Notice: the branch changed across the force-push!

• tools/cldr-apps/js/src/views/SignCla.vue is no longer changed in the branch
• tools/cldr-apps/js/src/views/TestPanel.vue is no longer changed in the branch
• tools/cldr-apps/src/main/java/org/unicode/cldr/web/ClaSignature.java is different

View Diff Across Force-Push

~ Your Friendly Jira-GitHub PR Checker Bot

[srl295]

I think this is ready for review (fyi @annebright )

[btangmu]

Looks great, except some TODO comments and commented-out code worry me about what might need to be done before this is ready to use in production. This PR doesn't complete the ticket and it may help to have the work in progress committed for testing, so I'm approving, with the suggestion that each TODO either gets fleshed out soon with the ticket number and clarification when/why it needs doing, or gets removed or changed into a non-TODO comment

[srl295]

Looks great, except some TODO comments and commented-out code worry me about what might need to be done before this is ready to use in production. This PR doesn't complete the ticket and it may help to have the work in progress committed for testing, so I'm approving, with the suggestion that each TODO either gets fleshed out soon with the ticket number and clarification when/why it needs doing, or gets removed or changed into a non-TODO comment

I will either flesh out or remove the TODOs.

[annebright]

Hi Steven.

1. I think the first screen users see when they click the CLA banner is confusing in a couple of ways. I did not realize you planned screens before a user landed on the text of the SurveyTool-only mini-CLA. I think users need to encounter the introductory language ("Hello. We need your permission...") that I put in the mini-CLA right at the start of the process, and then be given options for affirming an existing CLA or agreeing to the mini-CLA. Can we add this intro language to the first screen users encounter?
2. I also would not use the term "sign manually" anywhere, as this suggests that the full CLA is being signed in PDF or something. Rather, what you want to do is distinguish between a "full" Unicode CLA that allows contribution to all Unicode projects and the "mini" CLA that is just for Survey Tool and does not allow contribution to other projects. For consistency, I would use the terms "Unicode CLA" and "Survey Tool only CLA" to distinguish between these two. I would make that change throughout the flow.
3. On the screen the user gets if no signature is found in Github, I would change the radio buttons to (i) Change Github Account, (ii) Sign the full Unicode CLA, (iii) sign the Survey Tool Only CLA, (iv) Contact Us.

Hope this makes sense - would obviously be a little easier to do in a call, but not possible at the moment....

[srl295]

@annebright thanks! I am going to work on the low level comments first (as those are in progress) and then get a new revision incorporating your comments.

I had interpreted the priority of GitHub signing as needing a previous screen to the CLA itself.

Since the update of the signing list is manual on our side, if the user signs up / newly signs the CLA with GitHub, that's potentially hours or more likely days before they can proceed, versus "Survey Tool only CLA" would be instant.

Thank you for the clarification on terms.

[srl295]

@btangmu take a look, addressed comments. Won't merge w/o approval of the flow.

[srl295]

Also… it actually looks like we might be able to let the SurveyTool update its CLA list itself. The token situation might be different than I thought.

If so, then we can have the SurveyTool automatically fetch the status… and even have a "recheck" button if the user has just signed. I will investigate - as a separate PR.

[srl295]

@annebright updated first screen:

if you sign in with GitHub but do NOT have a signature detected: (TC discussed and removed the "sign ST- only CLA" option here)

If they choose ST-only, it goes back to a similar page as before: