Module user_extension 

User-extensible capability gate (ADR-0028, #220).

The single reader for the user’s config.toml. Parses [[network.additional_hosts]], the two [network] trust flags, and [store] root (#441) — one opener, so no two commands can disagree about which file they are describing.

Parses the [[network.additional_hosts]] array-of-tables from the user’s config.toml, validates each entry against the restricted ADR-0028 D2-1 pattern grammar, and merges the user-added hosts into the orchestrator’s oa-publisher crate::http::SourceAllowlist.

This module is intentionally minimal — it does NOT layer config.toml with env vars or implement the full docs/CONFIG.md resolution ladder. The full reader is a separate slice (S3b); this slice ships only the surface needed for ADR-0028 D2 (user-extensible allowlist) to actually work end-to-end.

Wire contract (ADR-0028 D2-1)

[[network.additional_hosts]]
host = "ruj.uj.edu.pl"
note = "Jagiellonian University Repository — Green OA"

[[network.additional_hosts]]
host = "*.uj.edu.pl"          # single-suffix wildcard, allowed

Every rejection class enforced by validate_pattern:

• empty string
• leading or trailing whitespace
• bare wildcard (*)
• multi-segment glob (*.edu.*, *.*, *.foo.*)
• mid-string wildcard (foo.*.org, f*o.bar, *foo.bar)
• no . (single-label hostnames)
• non-host characters (@, /, :, port suffixes, scheme prefix)
• empty leading / inner / trailing label
• label starting or ending with -

Each rejection maps to a PatternError variant for downstream consumers (S3b doiget config doctor) to branch on programmatically.

Provenance & doctor (deferred to S3b)

ADR-0028 D2-2 / D2-3 / D2-4 (the verified_by = "user" provenance field, doiget config doctor surface, doiget capabilities user_extension_count) ship in the S3b follow-up. The MCP-server-side merge in doiget-mcp is also deferred — this slice wires user extensions only through the CLI production path (commands::fetch::build_http_client). A user who configures [[network.additional_hosts]] and invokes via doiget serve (MCP) currently sees no effect; that is the load-bearing item S3b closes.

Structs

HostPattern

A validated host pattern from [[network.additional_hosts]].

InvalidPatternIssue

One per-entry rejection inside UserExtensionError::InvalidPatterns.

UserExtensionConfig

Parsed result from a config.toml user-extension section (issue #323).

UserExtensionHost

One user-added host entry from [[network.additional_hosts]].

Enums

ConfigDirError

Why the config directory could not be resolved.

PatternError

Closed-enum classification of a single pattern’s rejection reason. Used by validate_pattern and carried as the kind field on InvalidPatternIssue. S3b’s doiget config doctor surface branches on this for actionable per-error rendering.

UserExtensionError

Errors from loading config.toml’s user-extension section.

Functions

academic_repo_hosts

Returns the built-in curated set of academic institution host patterns.

config_dir

Config-directory resolution: XDG_CONFIG_HOME, then APPDATA (Windows), then $HOME/.config.

config_path

<config_dir>/doiget/config.toml — the one file every reader means.

expand_store_root

Turn a raw [store] root value into a path, expanding a leading ~.

load

Load user-extension hosts from a config.toml path.

load_or_default

The config.toml settings, or defaults when it is missing or unreadable.

merge_into_allowlists

Merge a slice of UserExtensionHost into the oa-publisher entry of an existing allowlist vector.

oa_registry_hosts

Returns the built-in curated set of open-access registry host patterns.

validate_pattern

Validate a host pattern per ADR-0028 D2-1.