Organization application automation

[JacobCoffee]

There is a lot of time we spend while reviewing org apps

We have to

• check the URL
• make sure the email aligns with that URL

So mycoolorg.com applies for MyCoolOrg but the user has no @mycoolorg.com email.
This takes 3-4 clicks to then add a info request to the user but we could surface it much sooner!

Do it for us:

• Add a banner or similar that shows: domain match or not, unverified email or not
• When there is no match, a button to jump to the speicfic info request pre-filled

More?

• It might be nice to let turbo mode skip clean apps to approve so that it is much more streamlined, and when time permits we can go through the ones that need more info.

Inverse

Sometimes they have @mycoolorg.com email but the org URL doesn't match or is some GitHub repo, PyPI project, etc.

Similarly for this we could do the whole banner / button thing but it would fill in the unverifiable URL reason

[JacobCoffee]

Additional, probably to be tracked in another issue, it would be nice to have a list of OFAC non-compliant domain TLDs to more easily track and defer those with an automatically added internal note

[JacobCoffee]

At a higher level, it might make sense to not allow submission of a company org if the verified email and supplied domain do not already match

[MohitSutharOfficial]

Thanks for opening this — I'd like to pick this up if it's not already spoken for.

Core ask (Phase 1):

• Banner on the org-application review page showing: email/domain match (yes/no), email verified (yes/no), URL verifiable (yes/no)
• When something fails, a button that opens a pre-filled info-request for that specific issue
• Same for the inverse case (verified email, but URL is a GitHub repo/PyPI project/otherwise unverifiable)

I'd leave turbo/fast-approve out of the first PR and treat it as a fast-follow — happy to open a separate issue for it once the banner ships, so we're not blocking the main win on the more debatable auto-approve behavior.

A few things I'd like to confirm before coding:

1. Domain matching — should subdomains count as a match (dept.myorg.com vs myorg.com)? I'll normalize case and strip + addressing by default unless you'd rather not.
2. Unverifiable URL list — is there an existing denylist/heuristic anywhere in Warehouse I should reuse, or should I start one (github.com, github.io, pypi.org/project, gitlab.com, bitbucket.org, npmjs.com)?
3. Prefill mechanism — should the info-request draft be created server-side (auditable) or just prefilled client-side in the composer?

If no one's already working on this, I'll start with the verification logic + banner behind a flag and open a draft PR early for feedback rather than all at once. Let me know if this scope looks right or if I'm missing anything.