Module resource 

Forge-qualified trust-tuple resources.

A resource names the forge first, then the path on it:

resource   = forge-host "/" segment *( "/" segment )
forge-host = lowercased DNS host of the forge: github.com, a GHES host,
             codeberg.org, a self-hosted git.example.org, or localhost
segment    = lowercased [a-z0-9._-]+, never "." or ".."

github.com/acme and github.com/acme/widgets are resources; acme/widgets is not. The forge is explicit because github.com/acme and codeberg.org/acme may belong to different people, and a grant that silently assumed one of them would be a grant to whoever holds the other.

Normalisation is deliberately narrow: ASCII case is folded (GitHub and Forgejo owners and repo names are case-insensitive, so Acme/Widgets and acme/widgets are one repository and must be one resource), and nothing else is repaired. A scheme, a trailing slash, a .git suffix or an empty segment is refused with a message that says what to write instead, rather than quietly rewritten — resource is what scopes a signer, and an input that needed guessing at is one to show back to the operator.

How many path segments a forge allows is the forge’s rule, not the grammar’s: GitHub and Forgejo have exactly an owner and optionally a repo, while a forge with nested groups keeps its full path. Callers that know their forge pass that bound to normalize_resource_with_depth.

Structs

ResourceError

Why a string is not a valid forge-qualified resource.

Enums

ResourceErrorKind

The specific rule a resource broke.

Constants

MAX_PATH_SEGMENTS

Most path segments (after the host) normalize_resource accepts when the caller states no forge-specific bound. GitLab allows 20 levels of subgroup under a top-level group, so this is that plus the project.

MAX_RESOURCE_LEN

Longest resource accepted, in bytes. Far above any real forge path (GitHub: 39-byte owners, 100-byte repo names) while keeping a hostile input from turning into an unbounded registry key.

Functions

normalize_resource

Normalise a forge-qualified resource, allowing up to MAX_PATH_SEGMENTS path segments after the host.

normalize_resource_with_depth

Normalise a forge-qualified resource with at most max_path_segments segments after the host — 2 for GitHub and Forgejo (owner/repo).

resource_contains

Segment-prefix containment of two normalised resources: scope contains resource when it is equal to it or a whole-segment prefix of it.