feat(comments): add --ignore-authorization

The write-access gate had no escape hatch, and its GitLab behavior when project
membership cannot be read -- honor the command with a warning -- was the one
deliberate weakness in it. Both are now a choice:

  enforce (default)  require write access; honor with a warning where the
                     provider cannot report it
  strict             reject in that case instead
  off                perform no check

enforce closes the hole wherever the provider can answer without breaking a
pipeline whose token cannot read membership, which is why it is the default.
strict closes it everywhere and will fail those pipelines. off restores the prior
behavior for anyone who needs comment-driven ignores from unverified authors.

Threaded through the adapter constructors as a keyword argument with a default, so
existing call sites keep working. With off the predicate is never handed to
check_for_socket_comments at all, so nothing is filtered and no rejection is
logged, rather than a gate that silently approves everything.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: lelia

CHANGELOG.md

@@ -60,7 +60,11 @@
   enabling this does not silently break pipelines that relied on ignore commands.
   Use a `GITLAB_TOKEN` with API read access to get enforcement.
 - A rejected command is logged and is also absent from the ignore telemetry, which
-  records what was acted on.
+  records what was acted on. No acknowledgement reaction is added to a comment that
+  was not honored.
+- `--ignore-authorization` selects the policy: `enforce` (default) requires write
+  access and honors the command with a warning where the provider cannot report it,
+  `strict` rejects it in that case instead, and `off` performs no check.
 
 ### Fixed: pull request and merge request comment accuracy
 

docs/cli-reference.md

@@ -432,6 +432,7 @@ The launcher can be tuned via the `SOCKET_CLI_COANA_LAUNCHER` environment variab
 | `--ignore-commit-files`    | False    | False   | Ignore commit files                                                   |
 | `--disable-blocking`       | False    | False   | Non-blocking CI mode: the CLI always exits **0**, even when blocking alerts are present (including with `--strict-blocking`). Also exits 0 on uncaught runtime errors and Socket API failures, so the job is treated as successful while findings and errors are still logged. Takes precedence over `--strict-blocking`. |
 | `--disable-ignore`         | False    | False   | Disable support for `@SocketSecurity ignore` commands in PR comments. When set, alerts cannot be suppressed via comments and ignore instructions are hidden from comment output. See [Who can ignore an alert](#who-can-ignore-an-alert). |
+| `--ignore-authorization`   | False    | enforce | Who may suppress alerts with `@SocketSecurity ignore`. `enforce` requires write access and honors the command with a warning when the provider cannot report it; `strict` rejects it in that case; `off` honors any commenter. See [Who can ignore an alert](#who-can-ignore-an-alert). |
 | `--strict-blocking`        | False    | False   | Fail on ANY security policy violations (blocking severity), not just new ones. Only works in diff mode. See [Strict Blocking Mode](#strict-blocking-mode) for details. |
 | `--enable-diff`            | False    | False   | Enable diff mode even when using `--integration api` (forces diff mode without SCM integration) |
 | `--scm`                    | False    | api     | Source control management type                                        |
@@ -704,10 +705,21 @@ reported. `--disable-ignore` turns the feature off entirely.
 | GitLab | Project membership, read once per run when an ignore command is present. Developer (30) or above is honored. | The command is honored and a warning is logged. |
 
 GitLab notes carry no permission field, so the check needs a `GITLAB_TOKEN` that
-can read `GET /projects/:id/members/all`. A `CI_JOB_TOKEN` generally cannot, and
-in that case the CLI logs a warning and still honors the command rather than
-breaking a pipeline that was already relying on it. Use a personal or group access
-token with API read access to get enforcement.
+can read `GET /projects/:id/members/all`. A `CI_JOB_TOKEN` generally cannot.
+
+`--ignore-authorization` decides what happens when access cannot be determined:
+
+| Value | Verified write access | Access cannot be determined |
+|:------|:----------------------|:----------------------------|
+| `enforce` (default) | Honored | Honored, with a warning naming the author |
+| `strict` | Honored | Rejected |
+| `off` | Honored | Honored, no check performed |
+
+`enforce` closes the hole wherever the provider can answer, without breaking a
+pipeline whose token cannot read membership. `strict` closes it everywhere, at the
+cost of failing those pipelines. `off` restores the prior behavior and should be
+paired with `--disable-ignore` unless you specifically need comment-driven ignores
+from unverified authors.
 
 ## GitLab Token Configuration
 

socketsecurity/config.py

@@ -144,6 +144,7 @@ class CliConfig:
     ignore_commit_files: bool = False
     disable_blocking: bool = False
     disable_ignore: bool = False
+    ignore_authorization: str = "enforce"
     # Tri-state log-upload preference: True = --upload-logs, False = --no-upload-logs,
     # None = neither (server-side override decides).
     upload_logs: Optional[bool] = None
@@ -305,6 +306,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'ignore_commit_files': args.ignore_commit_files,
             'disable_blocking': args.disable_blocking,
             'disable_ignore': args.disable_ignore,
+            'ignore_authorization': args.ignore_authorization,
             'upload_logs': args.upload_logs,
             'strict_blocking': args.strict_blocking,
             'integration_type': integration_type,
@@ -724,6 +726,19 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="If true, the new scan will be set as the branch's head scan"
     )
+    config_group.add_argument(
+        "--ignore-authorization",
+        dest="ignore_authorization",
+        choices=["enforce", "strict", "off"],
+        default="enforce",
+        help=(
+            "Who may suppress alerts with @SocketSecurity ignore comments. "
+            "'enforce' (default) requires write access, and honors the command with "
+            "a warning when the provider cannot report the commenter's access. "
+            "'strict' rejects the command in that case instead. "
+            "'off' honors a command from any commenter."
+        )
+    )
     config_group.add_argument(
         "--pending_head",
         dest="pending_head",

socketsecurity/core/scm/github.py

@@ -154,9 +154,15 @@ def from_env(cls, pr_number: Optional[str] = None) -> 'GithubConfig':
 
 
 class Github:
-    def __init__(self, client: CliClient, config: Optional[GithubConfig] = None):
+    def __init__(
+        self,
+        client: CliClient,
+        config: Optional[GithubConfig] = None,
+        ignore_authorization: str = "enforce",
+    ):
         self.config = config or GithubConfig.from_env()
         self.client = client
+        self.ignore_authorization = ignore_authorization
 
         if not self.config.token:
             log.error("Unable to get Github API Token")
@@ -224,7 +230,8 @@ def get_comments_for_pr(self) -> dict:
         else:
             log.error(raw_comments)
 
-        return Comments.check_for_socket_comments(comments, self.is_ignore_authorized)
+        gate = None if self.ignore_authorization == "off" else self.is_ignore_authorized
+        return Comments.check_for_socket_comments(comments, gate)
 
     def is_ignore_authorized(self, comment: Comment) -> bool:
         """Whether a commenter may suppress alerts with @SocketSecurity ignore.

socketsecurity/core/scm/gitlab.py

@@ -134,9 +134,15 @@ class Gitlab:
     MEMBER_PAGE_SIZE = 100
     MEMBER_PAGE_LIMIT = 10
 
-    def __init__(self, client: CliClient, config: Optional[GitlabConfig] = None):
+    def __init__(
+        self,
+        client: CliClient,
+        config: Optional[GitlabConfig] = None,
+        ignore_authorization: str = "enforce",
+    ):
         self.config = config or GitlabConfig.from_env()
         self.client = client
+        self.ignore_authorization = ignore_authorization
         # None until the first ignore comment forces a lookup; stays None when the
         # members API cannot be read, which is the "undetermined" state.
         self._member_access: Optional[dict] = None
@@ -268,7 +274,8 @@ def get_comments_for_pr(self) -> dict:
                 comment.body_list = comment.body.split("\n")
         else:
             log.error(raw_comments)
-        return Comments.check_for_socket_comments(comments, self.is_ignore_authorized)
+        gate = None if self.ignore_authorization == "off" else self.is_ignore_authorized
+        return Comments.check_for_socket_comments(comments, gate)
 
     def _load_member_access(self) -> Optional[dict]:
         """Map project member user id -> access level, or None if unreadable.
@@ -331,11 +338,18 @@ def is_ignore_authorized(self, comment: Comment) -> bool:
         """
         access = self._load_member_access()
         if access is None:
+            author = Comments.comment_author_name(comment)
+            if self.ignore_authorization == "strict":
+                log.warning(
+                    f"Rejecting @SocketSecurity ignore from {author}: GitLab project "
+                    "membership could not be read and --ignore-authorization is strict."
+                )
+                return False
             log.warning(
-                "Honoring @SocketSecurity ignore from "
-                f"{Comments.comment_author_name(comment)} without verifying write "
-                "access: GitLab project membership could not be read. Use a token "
-                "with API read access to enforce this."
+                f"Honoring @SocketSecurity ignore from {author} without verifying "
+                "write access: GitLab project membership could not be read. Use a "
+                "token with API read access, or --ignore-authorization strict to "
+                "reject instead."
             )
             return True
 

socketsecurity/socketcli.py

@@ -563,11 +563,11 @@ def main_code():
             # Only pass pr_number if it's not "0" (the default)
             pr_number = config.pr_number if config.pr_number != "0" else None
             github_config = GithubConfig.from_env(pr_number=pr_number)
-            scm = Github(client=client, config=github_config)
+            scm = Github(client=client, config=github_config, ignore_authorization=config.ignore_authorization)
         elif config.scm == 'gitlab':
             from socketsecurity.core.scm.gitlab import Gitlab, GitlabConfig
             gitlab_config = GitlabConfig.from_env()
-            scm = Gitlab(client=client, config=gitlab_config)
+            scm = Gitlab(client=client, config=gitlab_config, ignore_authorization=config.ignore_authorization)
         # Don't override config.default_branch if it was explicitly set via --default-branch flag
         # Only use SCM detection if --default-branch wasn't provided
         if scm is not None and not config.default_branch:

tests/unit/test_ignore_authorization.py

@@ -72,9 +72,10 @@ def test_ignore_all_from_an_outsider_is_rejected_too():
 # --- GitLab: notes carry no permission field, so membership is looked up -----
 
 
-def _gitlab(members_pages=None, raises=None):
+def _gitlab(members_pages=None, raises=None, policy="enforce"):
     gitlab = Gitlab.__new__(Gitlab)
     gitlab.config = SimpleNamespace(mr_project_id="42", headers={}, api_url="https://gl/api/v4")
+    gitlab.ignore_authorization = policy
     gitlab._member_access = None
     gitlab._member_lookup_attempted = False
 
@@ -142,3 +143,47 @@ def test_gitlab_oversized_membership_is_undetermined():
     # Undetermined falls back to honoring the command, same as an API failure.
     assert gitlab.is_ignore_authorized(_comment(author={"id": 999})) is True
     assert len(gitlab.calls) == Gitlab.MEMBER_PAGE_LIMIT
+
+
+# --- --ignore-authorization ---------------------------------------------------
+
+
+def test_strict_rejects_when_membership_cannot_be_read(caplog):
+    """strict closes the gap enforce leaves open, at the cost of breaking a
+    pipeline whose token cannot read members."""
+    gitlab = _gitlab(raises=Exception("403 Forbidden"), policy="strict")
+
+    with caplog.at_level("WARNING", logger="socketcli"):
+        allowed = gitlab.is_ignore_authorized(_comment(author={"id": 7, "username": "dev"}))
+
+    assert allowed is False
+    assert "strict" in caplog.text
+
+
+def test_strict_still_honors_a_verified_member():
+    gitlab = _gitlab([[{"id": 7, "access_level": 40}]], policy="strict")
+
+    assert gitlab.is_ignore_authorized(_comment(author={"id": 7})) is True
+
+
+def test_off_skips_the_gate_entirely():
+    """off restores the prior behavior: no predicate reaches the bucketing, so
+    nothing is filtered and no rejection is logged."""
+    github = Github.__new__(Github)
+    github.ignore_authorization = "off"
+    github.config = SimpleNamespace(owner="o", repository="r", pr_number="1",
+                                    headers={}, api_url="https://api.github.com")
+    github.client = SimpleNamespace(request=lambda **kw: SimpleNamespace(
+        json=lambda: [{"id": 1, "body": "@SocketSecurity ignore npm/lodash@4.17.21",
+                       "author_association": "NONE", "user": {"login": "outsider"}}],
+        text=""))
+
+    bucketed = github.get_comments_for_pr()
+
+    assert len(bucketed.get("ignore", [])) == 1
+
+
+def test_enforce_is_the_default_policy():
+    from socketsecurity.config import CliConfig
+
+    assert CliConfig.from_args(["--api-token", "t"]).ignore_authorization == "enforce"