Skip to main content

evaluate_domain

supercode_harness::permissions::rules

Function evaluate_domain 

Source 
pub fn evaluate_domain(
    rules: &RuleSet,
    host: Option<&str>,
    default: Decision,
) -> Decision
Expand description

BP-10 (catalog row “Allow/ask/deny rule language”, semantics “Pattern rules per tool/path/domain/command”): the FOURTH rule subject — evaluate a network HOST against rules as the domain pseudo-tool, exactly the way evaluate_path evaluates a path as the read/write pseudo-tools. A rule is written "domain(evil.example)" / "domain(*.evil.example)", or bare "domain" to name every host at once; the glob syntax, the tier priority, and the first-match order are the engine’s, not a second matcher’s.

host: None (a URL with no parseable host) is Decision::Deny, fail-closed — an unresolvable host cannot be proven to satisfy an allowlist. host is lowercased before matching (hostnames are case-insensitive; patterns are expected lowercase).