)

func TestBuildRouterFilter(t *testing.T) {
	tests := []struct {
		name     string
		ctx      RouterFilterContext
		expected *hcm.HttpFilter
	}{
		{
			name: "test for build router filter",
			ctx:  RouterFilterContext{StartChildSpan: true},
			expected: &hcm.HttpFilter{
				Name: wellknown.Router,
				ConfigType: &hcm.HttpFilter_TypedConfig{
					TypedConfig: protoconv.MessageToAny(&router.Router{

func (b *Builder) BuildHTTP(class networking.ListenerClass) []*hcm.HttpFilter {
	if b == nil || b.builder == nil {
		return nil
	}
	if class == networking.ListenerClassSidecarOutbound {
		// Only applies to inbound and gateways
		return nil
	}
	if b.httpBuilt {
		return b.httpFilters
	}
	b.httpBuilt = true
	b.httpFilters = b.builder.BuildHTTP()

	return b.httpFilters

		WasmPlugin: &extensions.WasmPlugin{
			Priority: &wrapperspb.Int32Value{Value: 1000},
			Type:     extensions.PluginType_NETWORK,
		},
	}
)

func TestInsertedExtensionConfigurations(t *testing.T) {
	httpFilter := protoconv.MessageToAny(&httpwasm.Wasm{
		Config: &wasmextension.PluginConfig{
			Name:          "istio-system.someAuthNFilter",
			Configuration: &anypb.Any{},
			Vm: &wasmextension.PluginConfig_VmConfig{

func (b *Builder) BuildHTTP(class networking.ListenerClass) []*hcm.HttpFilter {
	if b == nil {
		return nil
	}
	if class == networking.ListenerClassSidecarOutbound {
		// Only applies to inbound and gateways
		return nil
	}
	if b.proxy.SupportsEnvoyExtendedJwt() {
		filter := b.applier.JwtFilter(true, b.proxy.Type != model.SidecarProxy)
		if filter != nil {
			return []*hcm.HttpFilter{filter}
		}
		return nil
	}

// plugins of a provided phase from the WASM plugin set and append them to the list of filters
func PopAppendHTTP(list []*hcm.HttpFilter,
	filterMap map[extensions.PluginPhase][]*model.WasmPluginWrapper,
	phase extensions.PluginPhase,
) []*hcm.HttpFilter {
	for _, ext := range filterMap[phase] {
		list = append(list, toEnvoyHTTPFilter(ext))
	}
	delete(filterMap, phase)
	return list
}

					if cm := getHTTPConnectionManager(filter); cm != nil {
						for _, httpFilter := range cm.GetHttpFilters() {
							switch httpFilter.GetName() {
							case wellknown.HTTPRoleBasedAccessControl:
								rbacHTTP := &rbachttp.RBAC{}
								if err := getHTTPFilterConfig(httpFilter, rbacHTTP); err != nil {
									log.Errorf("found RBAC HTTP filter but failed to parse: %s", err)
								} else {

	Listener       PatchType = "listener"
	ListenerFilter PatchType = "listenerfilter"
	FilterChain    PatchType = "filterchain"
	NetworkFilter  PatchType = "networkfilter"
	// nolint
	HttpFilter  PatchType = "httpfilter"
	Route       PatchType = "route"
	VirtualHost PatchType = "vhost"
)

var (
	patchType  = monitoring.CreateLabel("patch")
	resultType = monitoring.CreateLabel("result")

	// It may return nil, if no JWT validation is needed.
	JwtFilter(useExtendedJwt, clearRouteCache bool) *hcm.HttpFilter

	// AuthNFilter returns the (authn) HTTP filter to enforce the underlying authentication policy.
	// It may return nil, if no authentication is needed.
	AuthNFilter(forSidecar bool) *hcm.HttpFilter

	// PortLevelSetting returns port level mTLS settings.
	PortLevelSetting() map[uint32]model.MutualTLSMode

	case networking.EnvoyFilter_ROUTE_CONFIGURATION:
		obj = &route.RouteConfiguration{}
	case networking.EnvoyFilter_FILTER_CHAIN:
		obj = &listener.FilterChain{}
	case networking.EnvoyFilter_HTTP_FILTER:
		obj = &hcm.HttpFilter{}
	case networking.EnvoyFilter_NETWORK_FILTER:
		obj = &listener.Filter{}
	case networking.EnvoyFilter_VIRTUAL_HOST:
		obj = &route.VirtualHost{}
	case networking.EnvoyFilter_HTTP_ROUTE:
		obj = &route.Route{}

	}
}

func createHTTPConnectionManager(listenerName, httpVersion string) *envoy_hcm.HttpConnectionManager {
	hcm := &envoy_hcm.HttpConnectionManager{
		AccessLog: createAccessLog(listenerName),
		HttpFilters: []*envoy_hcm.HttpFilter{
			{
				Name: "envoy.filters.http.dynamic_forward_proxy",
				ConfigType: &envoy_hcm.HttpFilter_TypedConfig{
					TypedConfig: protoconv.MessageToAny(&envoy_filters_dynamic_forward_proxy.FilterConfig{