Module net_policy 

Reachability policy for registry index URLs declared by a workspace file.

A .cargo/config.toml/Cargo.toml value is attacker-controlled the moment a hostile repository is cloned and opened — this LSP fetches on parse, before any build ever runs (spec .local/specs/023-cargo-custom-registries/spec.md NFR-003). classify_host answers “is this URL’s host the kind no legitimate registry index or redirect ever targets” from the URL alone (no DNS resolution — see classify_host’s docs for why), and RegistryAccessPolicy is the live-updatable, process-wide switch a caller checks before ever fetching a workspace-declared URL.

Placed in deps-core, not an ecosystem crate: RegistryAccessPolicy must be held by ServerState without a #[cfg(feature = "cargo")] gate, and host classification belongs beside crate::cache’s existing ensure_https/loopback checks, which already perform the same class of validation (DRY). crate::cache’s redirect-hop hardening also needs this exact classifier — see HostClass::never_a_registry.

Structs

RegistryAccessPolicy

Live-updatable, Arc-shareable handle to the current WorkspaceRegistryAccess setting.

Enums

HostClass

Classification of a URL’s host, for RegistryAccessPolicy to evaluate against WorkspaceRegistryAccess.

IndexUrlError

Why a candidate registry/index URL failed validate_index_url.

PolicyGate

Whether validate_index_url must check a candidate’s host against a live RegistryAccessPolicy.

WorkspaceRegistryAccess

The user-facing policy governing whether a workspace-declared registry index is ever fetched at all.

Functions

classify_addr

Classifies a DNS-resolved socket address into a HostClass.

classify_host

Classifies url‘s host into a HostClass, from the URL alone — no DNS resolution is performed (see the module docs’ residual-risk note).

redact_userinfo

Replaces any embedded user:pass@/user@ userinfo component in raw with a fixed ***@ marker, for a caller to log or retain instead of the raw credential-bearing value.

validate_index_url

Validates a candidate registry/index URL: https scheme, no userinfo, and — when gate is PolicyGate::Enforce — a host the live RegistryAccessPolicy allows.