Keep the ignore authorization policy visible in debug output

Author: lelia

CHANGELOG.md

@@ -23,6 +23,8 @@
 - Configuration debug output masks credential fields, including nested plugin
   settings, and integration URL paths. Slack configuration environment contents
   are reported only as set or unset.
+- The ignore-command authorization policy remains visible in configuration
+  debug output so comment-handling decisions can be diagnosed.
 - Alert timestamps retain their leading and trailing characters when the
   optional timezone suffix is removed.
 - Slack, Teams, Jira, webhook, and GitLab commit-status requests use a 30-second

socketsecurity/redaction.py

@@ -23,6 +23,9 @@
 def is_sensitive_name(name: str) -> bool:
     """Whether a field name looks like it holds a credential."""
     lowered = name.lower()
+    # The ignore-command authorization policy is public configuration.
+    if lowered == "ignore_authorization":
+        return False
     return any(marker in lowered for marker in _SENSITIVE_NAME_MARKERS)
 
 

tests/unit/test_redaction.py

@@ -35,13 +35,36 @@ def _clear_token_env(monkeypatch):
 
 @pytest.mark.parametrize(
     "name",
-    ["api_token", "API_TOKEN", "github_token", "slack_webhook", "client_secret", "password", "auth_header", "api_key"],
+    [
+        "api_token",
+        "API_TOKEN",
+        "github_token",
+        "slack_webhook",
+        "client_secret",
+        "password",
+        "auth_header",
+        "api_key",
+        "authorization",
+        "ignore_authorization_token",
+    ],
 )
 def test_credential_field_names_are_recognized(name):
     assert is_sensitive_name(name)
 
 
-@pytest.mark.parametrize("name", ["repo", "branch", "commit_sha", "target_path", "scm", "enable_debug"])
+@pytest.mark.parametrize(
+    "name",
+    [
+        "repo",
+        "branch",
+        "commit_sha",
+        "target_path",
+        "scm",
+        "enable_debug",
+        "ignore_authorization",
+        "IGNORE_AUTHORIZATION",
+    ],
+)
 def test_ordinary_field_names_are_not_recognized(name):
     assert not is_sensitive_name(name)
 
@@ -107,6 +130,15 @@ def test_config_to_redacted_dict_masks_the_api_token():
     assert TOKEN not in str(config.to_redacted_dict())
 
 
+@pytest.mark.parametrize("policy", ["enforce", "strict", "off"])
+def test_ignore_authorization_policy_remains_visible_in_config_debug_output(policy):
+    config = CliConfig.from_args(["--api-token", TOKEN, "--repo", "widgets", "--ignore-authorization", policy])
+    view = config.to_redacted_dict()
+    assert view["ignore_authorization"] == policy
+    assert view["api_token"] == REDACTED
+    assert redact_mapping({"authorization": f"Bearer {TOKEN}"})["authorization"] == REDACTED
+
+
 def test_every_credential_field_on_cliconfig_is_redacted():
     """All credential-named config fields must be masked by the logging view."""
     config = CliConfig.from_args(["--api-token", TOKEN, "--repo", "widgets"])