Allow DefaultOff detectors to be filtered and run exclusively

[RKS (rksharma-owg)]

Summary

Allows DefaultOff detectors to be filtered and run exclusively via --DetectorsFilter and/or --DetectorArgs <DetectorId>=EnableIfDefaultOff.

Fixes #1457

Problem

In DetectorRestrictionService.ApplyRestrictions, all detectors implementing IDefaultOffComponentDetector were removed from the candidate detectors list before AllowedDetectorIds (specified via --DetectorsFilter) or AllowedDetectorCategories were evaluated:

1. If a user specified --DetectorsFilter <DefaultOffDetector> (with or without --DetectorArgs <DefaultOffDetector>=EnableIfDefaultOff), detectors.Where(d => allowedIds.Contains(...)) resulted in an empty match because the detector had already been stripped.
2. The subsequent validation loop threw an InvalidDetectorFilterException: Detector '<DetectorId>' was not found.
3. The union operation restoring ExplicitlyEnabledDetectorIds was located at the very end of ApplyRestrictions, meaning it was never reached when --DetectorsFilter was provided, and if reached without --DetectorsFilter, bypassed any category filtering.

Solution

1. In DetectorRestrictionService.ApplyRestrictions, identify and add any DefaultOff detectors that are present in restrictions.ExplicitlyEnabledDetectorIds or restrictions.AllowedDetectorIds (using case-insensitive comparison) into detectors before applying the AllowedDetectorIds and AllowedDetectorCategories filters.
2. Remove the trailing duplicate union block at the end of ApplyRestrictions so that explicitly enabled detectors are subject to the normal filtering pipeline.

Tests

Added comprehensive test cases to DetectorRestrictionServiceTests:

• WithRestrictions_AllowsDefaultOffWhenFilteredExclusively: verifies a DefaultOff detector can be filtered exclusively with both AllowedDetectorIds and ExplicitlyEnabledDetectorIds.
• WithRestrictions_AllowsDefaultOffWhenInAllowedDetectorIds: verifies a DefaultOff detector is allowed when requested via AllowedDetectorIds.
• WithRestrictions_AllowsDefaultOffCaseInsensitive: verifies case-insensitive handling of detector IDs.
• WithRestrictions_DefaultOffFilteredOutWhenOtherDetectorRequested: verifies DefaultOff detector is excluded if a different detector is filtered.
• WithRestrictions_DefaultOffFilteredOutWhenCategoryDoesNotMatch: verifies DefaultOff detector is excluded if category filter does not match.

[Copilot]

🟢 Approval recommended

The implementation matches the stated requirements and is covered by focused tests.

Pull request overview

Updates detector restriction handling so DefaultOff detectors can be explicitly enabled or selected exclusively through detector filters while still respecting category filters.

Changes:

• Includes matching DefaultOff detectors before ID/category filtering with case-insensitive matching.
• Removes the trailing union that bypassed filters.
• Adds comprehensive restriction-service tests.

File summaries

File	Description
src/Microsoft.ComponentDetection.Orchestrator/Services/DetectorRestrictionService.cs	Corrects DefaultOff detector inclusion and filtering order.
test/Microsoft.ComponentDetection.Orchestrator.Tests/Services/DetectorRestrictionServiceTests.cs	Tests exclusive selection, case handling, and filter exclusion behavior.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.