From a7fe73f07155a408e840cbfe752745c8a682a4f7 Mon Sep 17 00:00:00 2001 From: "@permadeath.com" Date: Wed, 23 Sep 2026 11:44:49 -0400 Subject: [PATCH] docs(policy): say which regex engine comparisons fold case A pattern stays case-sensitive. A selector's domain names do not, and the crate root now says so, with the spec text behind it. Co-Authored-By: Claude Opus 5.5 (1M context) Change-Id: I06a249242fdbb7db4765314abfa315a4555d1f64 --- crates/didbot-policy-regex/src/lib.rs | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/crates/didbot-policy-regex/src/lib.rs b/crates/didbot-policy-regex/src/lib.rs index 5f9f3979..5f741aad 100644 --- a/crates/didbot-policy-regex/src/lib.rs +++ b/crates/didbot-policy-regex/src/lib.rs @@ -145,7 +145,7 @@ //! //! # Case //! -//! Everything here is case-sensitive, deliberately. A +//! A pattern is case-sensitive, deliberately. A //! [`ValuePattern::Regex`] asks for folding with `(?i)`, per pattern, which //! is where that decision belongs. [`ValuePattern::Contains`] cannot: it is //! a byte-wise substring test with no flag, so a handle or DID appearing in @@ -154,6 +154,14 @@ //! does not fire, which gives a `Contains` blocklist the same advisory //! standing as one over free text above. //! +//! A `denyLookup` selector is not a pattern. It compares what a person wrote +//! in their own record with a name of this deployment or of the account +//! writing, and a person may spell a name in any case. So a name that is a +//! domain, a handle among them, compares in either ASCII case, as the atproto +//! handle spec says handles "are not case-sensitive". Everything else a +//! selector compares matches exactly, a DID among them, as the DID spec says +//! DIDs "are case-sensitive". +//! //! # What bounds a policy, and who can move it //! //! One pattern is bounded: `regex` compiles to a finite automaton under @@ -727,10 +735,8 @@ impl Token { !matches!(self, Self::SubjectHandle | Self::DeploymentOperator) } - /// Whether a selector compares it in either ASCII case. A handle and a - /// hostname are domain names, and the atproto handle spec says handles - /// "are not case-sensitive". Every other fact compares exactly, a DID - /// among them: the DID spec says DIDs "are case-sensitive". + /// Whether a selector compares it in either ASCII case, as it does a + /// domain name. See the crate root's "Case". fn folds_case(self) -> bool { matches!(self, Self::SubjectHandle | Self::DeploymentHostname) } -- 2.51.2