Struct UpstreamAllowEntry 

pub struct UpstreamAllowEntry {
    pub scheme: String,
    pub host_label_patterns: Vec<Pattern>,
    pub path: String,
}

One parsed allowlist entry. Allowlist CSV entries are operator-authored URL templates like https://parcha-tools-*.grep.ai/mcp. We parse them into (scheme, host_label_patterns, path) at load time so per-request validation can match each component separately:

• scheme: exact string match (case-insensitive per RFC 3986)
• host_label_patterns: per-DNS-label globs; the runtime URL’s host is split on . and each label matched against the corresponding pattern entry. * can never bridge labels because labels are matched independently.
• path: exact match against the URL’s path; query/fragment ignored

This is the secure shape; raw URL globs let * cross ./#/?/: (Greptile P0/P1 on #124). Per-label matching closes those bypasses.

Fields

scheme: String

"https" or "http" — operator-declared scheme. Exact match required.

host_label_patterns: Vec<Pattern>

One glob per DNS label, e.g. parcha-tools-*.grep.ai → ["parcha-tools-*", "grep", "ai"]. The runtime URL’s lowercased host is split on . and label-by-label matched against this Vec. Length must match exactly (no **-style multi-label wildcards).

path: String

Exact path match required. Empty operator path becomes "/".

Trait Implementations

impl Clone for UpstreamAllowEntry

fn clone(&self) -> UpstreamAllowEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UpstreamAllowEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.