Function is_user_allowed_by 

pub fn is_user_allowed_by(
    allowed: &[String],
    user: &str,
    match_fn: impl Fn(&str, &str) -> bool,
) -> bool

Return true when user is allowed under allowed, using a caller-provided (entry, user) -> bool comparison for the per-entry check.

Same single-source-of-truth shape as is_user_allowed — wildcard "*" admits everyone and the comparison runs against the caller’s freshly-resolved allowed slice, so no allowlist state is cached. This covers the channels whose identity matching cannot be expressed by the two Match modes: E.164 phone normalization (WhatsApp), domain-class email matching (@host admitting a whole domain), etc. The match_fn owns only the per-entry comparison; the wildcard short-circuit stays here so every channel keeps identical wildcard semantics.