Enum ReadPathEntry 

pub enum ReadPathEntry {
    Exact(PathBuf),
    Glob {
        pattern: Pattern,
        options: MatchOptions,
    },
    Regex(Regex),
}

One compiled allowlist entry. Only ReadPathSet constructs these; the enum is public so a set’s contents are inspectable, not so callers build entries by hand (compilation is where ~/relative resolution and anchoring happen).

Variants

Exact(PathBuf)

An exact root: grants the subtree under it. Stored as resolved at compile time (tilde/workdir applied) but uncanonicalized - the root is canonicalized at match time so a root created after spawn still works, and a root that cannot be verified never matches.

Glob

A glob over the normalized real path.

Fields

pattern: Pattern

The compiled pattern, already /-separated and prefixed with the escaped home or workdir when the source entry was ~/ or relative.

options: MatchOptions

Match options: require_literal_separator always, case sensitivity per platform semantics.

Regex(Regex)

A regex over the normalized real path, anchored at compile time.

Implementations

impl ReadPathEntry

pub fn sample_path(&self) -> Option<PathBuf>

One concrete path this entry matches, or None when none can be synthesized from the pattern alone.

This exists for reporting, not for enforcement: to say whether a config grant covers what a blueprint declares, something has to stand in for “a path the declaration would let through”, and the honest stand-in is a path built from the declaration itself. Every synthesized sample is checked back against its own entry, so a sample that cannot be trusted comes back as None and the caller reports “cannot tell” rather than guessing.

Trait Implementations

impl Clone for ReadPathEntry

fn clone(&self) -> ReadPathEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ReadPathEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.