Struct Allowlist 

pub struct Allowlist {
    pub credential_hashes: HashSet<[u8; 32]>,
    pub ignored_detectors: HashSet<String>,
    pub ignored_paths: Vec<String>,
}

User-defined suppressions loaded from .keyhogignore: credential hashes, detector IDs, and path globs.

Examples

use keyhog_core::allowlist::Allowlist;

let allowlist = Allowlist::parse("detector:demo-token\npath:**/*.md\n");
assert!(allowlist.ignored_detectors.contains("demo-token"));

Fields

credential_hashes: HashSet<[u8; 32]>

SHA-256 hashes of credentials to ignore.

ignored_detectors: HashSet<String>

Detector IDs to ignore entirely.

ignored_paths: Vec<String>

Glob patterns for paths to ignore.

Implementations

impl Allowlist

pub fn empty() -> Self

Create an empty allowlist with no suppressed hashes, detectors, or paths.

Examples

use keyhog_core::allowlist::Allowlist;

let allowlist = Allowlist::empty();
assert!(allowlist.ignored_paths.is_empty());

pub fn load(path: &Path) -> Result<Self, Error>

Load from a .keyhogignore file.

Examples

use keyhog_core::allowlist::Allowlist;
use std::path::Path;

let _allowlist = Allowlist::load(Path::new(".keyhogignore")).unwrap();

pub fn parse(content: &str) -> Self

Parse allowlist from string content.

Examples

use keyhog_core::allowlist::Allowlist;

let allowlist = Allowlist::parse("path:**/.env\ndetector:demo-token\n");
assert!(allowlist.is_path_ignored("app/.env"));

Examples found in repository

examples/core_standalone.rs (line 24)

fn main() {
    let detector = DetectorSpec {
        id: "demo-token".into(),
        name: "Demo Token".into(),
        service: "demo".into(),
        severity: Severity::High,
        patterns: vec![PatternSpec {
            regex: "demo_[A-Z0-9]{8}".into(),
            description: Some("Simple standalone example".into()),
            group: None,
        }],
        companion: None,
        verify: None,
        keywords: vec!["demo_".into()],
    };

    let issues = validate_detector(&detector);
    let allowlist = Allowlist::parse("path:**/*.md\n");
    let maybe_detectors = load_detectors_with_gate(Path::new("detectors"), true).ok();

    println!("detector={} issues={}", detector.id, issues.len());
    println!("redacted={}", redact("demo_ABC12345"));
    println!(
        "ignores_docs={}",
        allowlist.is_path_ignored("docs/README.md")
    );
    println!(
        "workspace_detectors_loaded={}",
        maybe_detectors.as_ref().map_or(0, Vec::len)
    );
}

pub fn is_allowed(&self, finding: &VerifiedFinding) -> bool

Check whether detector or path rules suppress a verified finding.

Hash-based suppression is evaluated earlier on crate::RawMatch values because VerifiedFinding stores only redacted credentials.

Examples

use keyhog_core::allowlist::Allowlist;
use keyhog_core::{MatchLocation, Severity, VerificationResult, VerifiedFinding};
use std::collections::HashMap;

let allowlist = Allowlist::parse("detector:demo-token\n");
let finding = VerifiedFinding {
    detector_id: "demo-token".into(),
    detector_name: "Demo Token".into(),
    service: "demo".into(),
    severity: Severity::High,
    credential_redacted: "demo_...1234".into(),
    location: MatchLocation {
        source: "filesystem".into(),
        file_path: Some(".env".into()),
        line: Some(1),
        offset: 0,
        commit: None,
        author: None,
        date: None,
    },
    verification: VerificationResult::Skipped,
    metadata: HashMap::new(),
    additional_locations: Vec::new(),
    confidence: None,
};

assert!(allowlist.is_allowed(&finding));

pub fn is_hash_allowed(&self, credential: &str) -> bool

Check if a raw credential hash is allowlisted.

Examples

use keyhog_core::allowlist::Allowlist;

let allowlist = Allowlist::parse("");
assert!(!allowlist.is_hash_allowed("demo_ABC12345"));

pub fn is_path_ignored(&self, path: &str) -> bool

Check whether a raw path matches an ignored-path glob.

Examples

use keyhog_core::allowlist::Allowlist;

let allowlist = Allowlist::parse("path:**/*.md\n");
assert!(allowlist.is_path_ignored("docs/README.md"));

Examples found in repository

examples/core_standalone.rs (line 31)

fn main() {
    let detector = DetectorSpec {
        id: "demo-token".into(),
        name: "Demo Token".into(),
        service: "demo".into(),
        severity: Severity::High,
        patterns: vec![PatternSpec {
            regex: "demo_[A-Z0-9]{8}".into(),
            description: Some("Simple standalone example".into()),
            group: None,
        }],
        companion: None,
        verify: None,
        keywords: vec!["demo_".into()],
    };

    let issues = validate_detector(&detector);
    let allowlist = Allowlist::parse("path:**/*.md\n");
    let maybe_detectors = load_detectors_with_gate(Path::new("detectors"), true).ok();

    println!("detector={} issues={}", detector.id, issues.len());
    println!("redacted={}", redact("demo_ABC12345"));
    println!(
        "ignores_docs={}",
        allowlist.is_path_ignored("docs/README.md")
    );
    println!(
        "workspace_detectors_loaded={}",
        maybe_detectors.as_ref().map_or(0, Vec::len)
    );
}

Trait Implementations

impl Clone for Allowlist

fn clone(&self) -> Allowlist

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Allowlist

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for Allowlist

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.