feat(policy): inbound whitelist + subject-regex filter

internal/policy/inbound.go

@@ -0,0 +1,29 @@
+package policy
+
+import "regexp"
+
+// InboundRule captures one account's read-side filtering.
+type InboundRule struct {
+	WhitelistInEnabled bool
+	WhitelistIn        []string
+	SubjectRegex       *regexp.Regexp // nil = no subject filter
+}
+
+// CompileSubject compiles a subject filter; empty pattern => (nil, nil).
+func CompileSubject(pattern string) (*regexp.Regexp, error) {
+	if pattern == "" {
+		return nil, nil
+	}
+	return regexp.Compile(pattern)
+}
+
+// Allows reports whether a message with the given sender and subject is visible.
+func (r InboundRule) Allows(from, subject string) bool {
+	if r.WhitelistInEnabled && !MatchAddress(r.WhitelistIn, from) {
+		return false
+	}
+	if r.SubjectRegex != nil && !r.SubjectRegex.MatchString(subject) {
+		return false
+	}
+	return true
+}