Struct Allowlist 

pub struct Allowlist {
    pub credential_hashes: HashSet<[u8; 32]>,
    pub ignored_detectors: HashSet<String>,
    pub ignored_paths: Vec<String>,
}

User-defined suppressions loaded from .keyhogignore: credential hashes, detector IDs, and path globs.

Examples

use keyhog_core::allowlist::Allowlist;

let allowlist = Allowlist::parse("detector:demo-token\npath:**/*.md\n");
assert!(allowlist.ignored_detectors.contains("demo-token"));

Fields

credential_hashes: HashSet<[u8; 32]>

SHA-256 hashes of credentials to ignore.

ignored_detectors: HashSet<String>

Detector IDs to ignore entirely.

ignored_paths: Vec<String>

Glob patterns for paths to ignore.

Implementations

impl Allowlist

pub fn empty() -> Self

Create an empty allowlist with no suppressed hashes, detectors, or paths.

Examples

use keyhog_core::allowlist::Allowlist;

let allowlist = Allowlist::empty();
assert!(allowlist.ignored_paths.is_empty());

pub fn load(path: &Path) -> Result<Self, Error>

Load from a .keyhogignore file.

Examples

use keyhog_core::allowlist::Allowlist;
use std::path::Path;

let _allowlist = Allowlist::load(Path::new(".keyhogignore")).unwrap();

pub fn parse(content: &str) -> Self

Parse allowlist from string content.

Examples

use keyhog_core::allowlist::Allowlist;

let allowlist = Allowlist::parse("path:**/.env\ndetector:demo-token\n");
assert!(allowlist.is_path_ignored("app/.env"));

pub fn is_allowed(&self, finding: &VerifiedFinding) -> bool

Check whether detector or path rules suppress a verified finding.

Hash-based suppression is evaluated earlier on crate::RawMatch values because VerifiedFinding stores only redacted credentials.

Examples

use keyhog_core::allowlist::Allowlist;
use keyhog_core::{MatchLocation, Severity, VerificationResult, VerifiedFinding};
use std::collections::HashMap;

let allowlist = Allowlist::parse("detector:demo-token\n");
let finding = VerifiedFinding {
    detector_id: "demo-token".into(),
    detector_name: "Demo Token".into(),
    service: "demo".into(),
    severity: Severity::High,
    credential_redacted: "demo_...1234".into(),
    location: MatchLocation {
        source: "fs".into(),
        file_path: Some("src/main.rs".into()),
        line: Some(1),
        offset: 0,
        commit: None,
        author: None,
        date: None,
    },
    verification: VerificationResult::Unverifiable,
    metadata: std::collections::HashMap::new(),
    additional_locations: Vec::new(),
    confidence: None,
    credential_hash: "hash".to_string(),
};
assert!(allowlist.is_allowed(&finding));

pub fn is_hash_allowed(&self, credential: &str) -> bool

Check if a raw credential hash is allowlisted.

Examples

use keyhog_core::allowlist::Allowlist;

let allowlist = Allowlist::parse("");
assert!(!allowlist.is_hash_allowed("demo_ABC12345"));

pub fn is_raw_hash_ignored(&self, hash_hex: &str) -> bool

Check if a hex-encoded SHA-256 hash is allowlisted.

pub fn is_path_ignored(&self, path: &str) -> bool

Check whether a raw path matches an ignored-path glob.

Examples

use keyhog_core::allowlist::Allowlist;

let allowlist = Allowlist::parse("path:**/*.md\n");
assert!(allowlist.is_path_ignored("docs/README.md"));

Trait Implementations

impl Clone for Allowlist

fn clone(&self) -> Allowlist

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Allowlist

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for Allowlist

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.