Struct TrustedHosts 

pub struct TrustedHosts(/* private fields */);

Parsed Host allowlist used by host_validate.

Closes api S-30 (lack of Host validation). The previous implementation cached the parsed env value in a process-wide OnceLock, which made tests that wanted to vary the allowlist unable to do so (the first test to touch the cell froze it for every later test in the same process).

Now the allowlist travels through axum::Extension<TrustedHosts>: crate::server::build_router_with_audit inserts a from_env() value at build time; tests can override by inserting a different value into the router extensions. Tests that bypass the server builder still get the env-var fallback (cached per-process in a private OnceLock so the per-request cost stays zero), but an explicit extension always wins.

Precedence: explicit axum::Extension<TrustedHosts> > env-var fallback (TENSOR_WASM_API_TRUSTED_HOSTS).

Implementations

impl TrustedHosts

pub fn from_env() -> Self

Parse the allowlist from ENV_TRUSTED_HOSTS. Splits on ,, trims surrounding whitespace, drops empty entries, and lowercases each remaining entry for case-insensitive matching. Unset / empty env var yields an empty list (= Self::allow_all).

pub fn from_raw(raw: &str) -> Self

Helper: parse a comma-separated string as if it were the env variable. Public for the explicit-construction path used by tests.

pub fn allow_all() -> Self

Explicit “no allowlist” constructor — every Host value is admitted (the legacy default when the env var is unset).

pub fn from_hosts<I, S>(iter: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Construct from an iterator of allowlist entries. Entries are lowercased on insertion so case-insensitive matching in Self::contains is just a byte comparison.

pub fn is_empty(&self) -> bool

true when no entries are configured — every host is admitted.

pub fn contains(&self, host: &str) -> bool

true when the supplied host (raw value from Host: or :authority) matches one of the allowlist entries.

Matching rules:

• Case-insensitive exact match on the supplied host.
• If the supplied host carries a default-port suffix (:80 or :443) and no allowlist entry contains a :, the port is stripped before comparison. This lets operators list bare hostnames (api.example.com) and still admit clients that include the default port in the Host header. If any allowlist entry contains a port, we do an exact match on the full host:port string — the operator chose to be specific.

Trait Implementations

impl Clone for TrustedHosts

fn clone(&self) -> TrustedHosts

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TrustedHosts

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TrustedHosts

fn default() -> TrustedHosts

Returns the “default value” for a type.