Struct LayeredAllowlist 

pub struct LayeredAllowlist {
    pub layers: Vec<LoadedAllowlistLayer>,
}

All allowlist layers, ordered by precedence (project > user > system).

Fields

layers: Vec<LoadedAllowlistLayer>

Implementations

impl LayeredAllowlist

pub fn load_from_paths( project: Option<PathBuf>, user: Option<PathBuf>, system: Option<PathBuf>, ) -> Self

Construct a layered allowlist from explicit file paths.

Any missing path is treated as an empty allowlist for that layer.

pub fn lookup_rule( &self, rule: &RuleId, ) -> Option<(&AllowEntry, AllowlistLayer)>

Find the first matching rule entry across layers (project > user > system).

Note: This performs exact rule ID matching without wildcard expansion. Use match_rule for wildcard-aware matching.

This is a backward-compatible wrapper around lookup_rule_at_path with cwd = None. For path-aware matching, use lookup_rule_at_path instead.

Skips entries that are expired, have unmet conditions, or lack risk ack.

pub fn match_rule_at_path( &self, pack_id: &str, pattern_name: &str, cwd: Option<&Path>, ) -> Option<AllowlistHit<'_>>

Find the first allowlist entry that matches a (pack_id, pattern_name) match identity.

Matching supports:

• Exact rule IDs: core.git:reset-hard
• Pack-scoped wildcard: core.git:* (matches any pattern in that pack)

An entry is skipped if:

• It has expired (expires_at is in the past)
• Its conditions are not met (env vars don’t match)
• It’s a regex pattern without risk_acknowledged = true
• It has path restrictions that don’t match the current working directory

Arguments

• pack_id - The pack identifier to match
• pattern_name - The pattern name to match (supports wildcard *)
• cwd - Optional current working directory for path-based filtering. If None, path restrictions are ignored (backward compatibility).

pub fn match_rule( &self, pack_id: &str, pattern_name: &str, ) -> Option<AllowlistHit<'_>>

Find the first allowlist entry that matches a rule (backward-compatible, no path filtering).

This is a convenience wrapper around match_rule_at_path with cwd = None. For path-aware matching, use match_rule_at_path instead.

pub fn match_exact_command(&self, command: &str) -> Option<AllowlistHit<'_>>

Find the first allowlist entry that matches an exact command string.

This is a backward-compatible wrapper around match_exact_command_at_path with cwd = None. For path-aware matching, use match_exact_command_at_path instead.

pub fn match_command_prefix(&self, command: &str) -> Option<AllowlistHit<'_>>

Find the first allowlist entry that matches a command prefix.

pub fn lookup_rule_at_path( &self, rule: &RuleId, cwd: Option<&Path>, ) -> Option<(&AllowEntry, AllowlistLayer)>

Find the first matching rule entry at a specific path.

Like lookup_rule, but also checks if the CWD matches the entry’s path patterns.

pub fn match_exact_command_at_path( &self, command: &str, cwd: Option<&Path>, ) -> Option<AllowlistHit<'_>>

Find the first allowlist entry that matches an exact command string at a specific path.

pub fn match_command_prefix_at_path( &self, command: &str, cwd: Option<&Path>, ) -> Option<AllowlistHit<'_>>

Find the first allowlist entry that matches a command prefix at a specific path.

Trait Implementations

impl Clone for LayeredAllowlist

fn clone(&self) -> LayeredAllowlist

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LayeredAllowlist

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LayeredAllowlist

fn default() -> LayeredAllowlist

Returns the “default value” for a type.