Struct GitWritePolicy 

pub struct GitWritePolicy {
    pub allowed: Vec<GitWritePolicyEntry>,
}

The parsed [git_write] allowlist.

allowed.is_empty() is the fail-closed default — both “no [git_write] section at all” and “[git_write] present with an empty allowed list” collapse to the same empty policy, and GitWritePolicy::check denies unconditionally in that state.

Fields

allowed: Vec<GitWritePolicyEntry>

Implementations

impl GitWritePolicy

pub fn check( &self, repo: &Path, branch: &str, ) -> Result<PathBuf, GitWritePolicyError>

Deny-by-default check: fails with GitWritePolicyError::NotConfigured when the policy is empty, otherwise requires repo to canonicalize to an allowlisted entry and branch to match one of that entry’s patterns. On success, returns the canonical repo path — callers must use this returned path for every subsequent git invocation for the call, never the raw repo argument (ADR-108 review r2 High finding): using the raw caller path after only canonicalizing it for the comparison is a symlink TOCTOU – a symlink that resolved to an allowlisted repo at check time can be retargeted to an unallowlisted repo before the mutating git command runs, which would then silently operate on the retargeted path if handlers kept using repo instead of the resolved identity this function already computed.

repo is canonicalized before comparison, and so is every allowlisted entry’s repo_path — a symlink that resolves to an allowlisted repo’s real path is accepted (it names the same repo); a symlink that resolves anywhere else is denied exactly as if the caller had passed that other path directly. Canonicalization never widens what is reachable, only normalizes how the same repo can be spelled.

impl GitWritePolicy

pub fn from_config(section: &GitWriteSectionConfig) -> Self

Pure, I/O-free conversion from an already-resolved [git_write] section (RuntimeConfig::git_write, threaded in at boot from KhiveConfig — see the module doc). Performs no discovery and reads no environment variables: the handler passes in whatever self.runtime().config().git_write already holds.

Trait Implementations

impl Clone for GitWritePolicy

fn clone(&self) -> GitWritePolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for GitWritePolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for GitWritePolicy

fn default() -> GitWritePolicy

Returns the “default value” for a type.