Struct Allowlist 

pub struct Allowlist {
    pub credential_hashes: HashSet<CredentialHash>,
    pub ignored_detectors: HashSet<String>,
    pub ignored_paths: ObservedPaths,
    pub rules: Vec<AllowlistRule>,
    /* private fields */
}

Parsed .keyhogignore rules with compiled lookup structures and attribution.

Fields

credential_hashes: HashSet<CredentialHash>

SHA-256 hashes of credentials to ignore.

ignored_detectors: HashSet<String>

Detector IDs to ignore entirely.

ignored_paths: ObservedPaths

Glob patterns for paths to ignore (raw, as authored). Kept as the public Vec-compatible contract + serialized form; the matcher consumes the precompiled [PathGlobIndex] built from these in Allowlist::parse.

rules: Vec<AllowlistRule>

Parsed suppression rules with match attribution tracking.

Implementations

impl Allowlist

pub fn load_with_metadata_policy( path: &Path, require_reason: bool, require_approved_by: bool, max_expires_days: Option<u64>, ) -> Result<Self, Error>

Load from a .keyhogignore file and enforce metadata governance.

pub fn parse(content: &str) -> Self

Parse allowlist from string content.

Examples

use keyhog_core::Allowlist;

let path = std::env::temp_dir().join(format!(
    "keyhog_allowlist_parse_{}.keyhogignore",
    std::process::id()
));
std::fs::write(&path, "path:**/.env\ndetector:demo-token\n")?;
let allowlist = Allowlist::load_with_metadata_policy(&path, false, false, None)?;
std::fs::remove_file(&path)?;
assert!(allowlist.is_path_ignored("app/.env"));

pub fn is_path_ignored(&self, path: &str) -> bool

Check whether a raw path matches an ignored-path glob.

Examples

use keyhog_core::Allowlist;

let path = std::env::temp_dir().join(format!(
    "keyhog_allowlist_path_{}.keyhogignore",
    std::process::id()
));
std::fs::write(&path, "path:**/*.md\n")?;
let allowlist = Allowlist::load_with_metadata_policy(&path, false, false, None)?;
std::fs::remove_file(&path)?;
assert!(allowlist.is_path_ignored("docs/README.md"));

pub fn record_match(&self, finding: &VerifiedFinding) -> bool

Record a match against allowlist rules for a verified finding.

pub fn record_path_match(&self, path: &str) -> bool

Record a match on an ignored path.

pub fn record_detector_match(&self, detector_id: &str) -> bool

Record a match on an ignored detector.

pub fn record_hash_match(&self, hash: &CredentialHash) -> bool

Record a match on an ignored credential hash.

pub fn unused_entries(&self) -> Vec<UnusedAllowlistEntry>

Retrieve all allowlist entries that matched zero times during the scan.

pub fn attributed_match_counts(&self) -> Vec<(String, usize)>

Retrieve match attribution for every registered allowlist entry.

Trait Implementations

impl Clone for Allowlist

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Allowlist

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Allowlist

fn default() -> Self

Returns the “default value” for a type.

impl Serialize for Allowlist

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.