Struct ReadDenyMatcher 

pub struct ReadDenyMatcher { /* private fields */ }

Runtime matcher for read-deny entries in a filesystem sandbox policy.

Implementations

impl ReadDenyMatcher

pub fn try_new( file_system_sandbox_policy: &FileSystemSandboxPolicy, cwd: &Path, ) -> Result<Option<Self>, String>

Fallible constructor for callers that need to reject malformed deny glob patterns before using the matcher.

pub fn new( file_system_sandbox_policy: &FileSystemSandboxPolicy, cwd: &Path, ) -> Option<Self>

Builds a matcher from exact deny-read roots and deny-read glob entries.

Returns None when the policy has no deny-read restrictions, so callers can skip read-deny checks without allocating matcher state. The cwd resolves cwd-relative policy paths and special paths before matching.

pub fn is_read_denied(&self, path: &Path) -> bool

Returns whether path is denied by the policy used to build this matcher.