Struct AllowlistMatcher 

pub struct AllowlistMatcher { /* private fields */ }

Compiled allowlist that can be queried concurrently.

Exact patterns are stored in a HashSet for O(1) lookup. Glob patterns (those containing *) are stored in a Vec and scanned linearly after the hash check misses. Regex patterns (regex: prefix) are stored in a separate Vec and tried last. This means allowlists with many exact entries — the common case — pay no linear scan cost.

Case sensitivity

By default the matcher is case-insensitive: patterns and query values are both lowercased before comparison (applies to exact and glob patterns only). Use AllowlistMatcher::new_case_sensitive when exact-case matching is required. Regex patterns (regex: prefix) are always case-sensitive; use the (?i) flag inside the pattern for case-insensitive regex matching.

Implementations

impl AllowlistMatcher

pub fn new(patterns: Vec<String>) -> AllowlistResult

Build a case-insensitive AllowlistMatcher from a list of pattern strings.

This is the default constructor. Patterns and query values are both lowercased before comparison, so "Localhost" matches a pattern of "localhost" and vice-versa.

Each string is treated as a glob if it contains *, otherwise as an exact match. Patterns that look like regexes (contain ^, $, +, (, or )) are accepted but a warning message is included in AllowlistResult::warnings so the caller can surface it to the user.

Always check AllowlistResult::warnings: a failed regex: pattern is skipped silently, meaning values that should be suppressed will instead be sanitized.

pub fn new_case_sensitive(patterns: Vec<String>) -> AllowlistResult

Build a case-sensitive AllowlistMatcher from a list of pattern strings.

Use this when exact-case matching is required (e.g. allowlisting a known token value that must not match differently-cased substrings).

Always check AllowlistResult::warnings: a failed regex: pattern is skipped silently.

pub fn is_allowed(&self, value: &str) -> bool

Returns true if value matches any allowlist entry.

Thread-safe; increments an internal counter when a match is found.

pub fn match_pattern<'a>(&'a self, value: &str) -> Option<&'a str>

Returns the pattern that matches value, or None.

Lookup order: exact hash → glob scan → regex scan. Increments the seen counter when a match is found.

Exact and glob patterns are case-insensitive by default (the matcher built by new lowercases both patterns and query values before comparison). Regex patterns (regex: prefix) are always matched against the original, un-lowercased value regardless of the case-sensitivity setting; use (?i) inside the pattern for case-insensitive regex matching.

pub fn seen_count(&self) -> u64

Total number of values that have been allowed through.

pub fn pattern_count(&self) -> usize

Number of patterns registered (exact + glob + regex).

pub fn is_empty(&self) -> bool

true if no patterns are registered (allowlist is effectively disabled).