Enum EnvVarMode 

#[non_exhaustive]
pub enum EnvVarMode {
    Passthrough,
    Strict {
        allowed: BTreeSet<Arc<str>>,
    },
    Mock,
}

How get_env calls treat the process environment.

Default is EnvVarMode::Strict with an empty allowlist — get_env is off until the operator opts in. See 70-security.md § 3.3.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Passthrough

Pass the full process environment to the evaluator. The CLI prints a startup warning before this mode goes live.

Strict

Only the names in allowed are visible. Any other get_env(...) returns the supplied default or "".

Fields

allowed: BTreeSet<Arc<str>>

Allowed env var names. The set is a BTreeSet for deterministic ordering (and dedup) per 13-evaluator.md § 2.

Mock

get_env always returns the supplied default (or ""). Useful for hermetic tests.

Implementations

impl EnvVarMode

pub fn allows(&self, name: &str) -> bool

Whether the given env-var name may be read.

pub const fn is_mock(&self) -> bool

Whether to consult the process environment or always return the caller’s default. Mock short-circuits even when the name is empty.

Trait Implementations

impl Clone for EnvVarMode

fn clone(&self) -> EnvVarMode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EnvVarMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for EnvVarMode

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for EnvVarMode

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Hash for EnvVarMode

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for EnvVarMode

fn eq(&self, other: &EnvVarMode) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for EnvVarMode

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for EnvVarMode

impl StructuralPartialEq for EnvVarMode