}

type ruleAccumulator struct {
	rules  []rbacv1.PolicyRule
	errors []error
}

func (r *ruleAccumulator) visit(source fmt.Stringer, rule *rbacv1.PolicyRule, err error) bool {
	if rule != nil {
		r.rules = append(r.rules, *rule)
	}
	if err != nil {
		r.errors = append(r.errors, err)
	}
	return true
}

func describeSubject(s *rbacv1.Subject, bindingNamespace string) string {

Russ Cox <******@****.***> 1715215293 -0400

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-1]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :authority
                    stringMatch:
                      exact: exact.com

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-1]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :authority
                    stringMatch:
                      exact: exact.com

        when:
        def node = node("a")
        def rule = rule("a", ModelNode.State.Mutated)
        bindings.add(rule)

        then:
        !rule.subjectBinding.bound

        when:
        addUntypedNode(node)

        then:
        bindings.getRulesWithSubject(nodeAtState("a", ModelNode.State.Mutated)) as List == [rule]
        rule.subjectBinding.boundTo == node

API rule violation: names_match,k8s.io/api/core/v1,RBDVolumeSource,CephMonitors
API rule violation: names_match,k8s.io/api/core/v1,RBDVolumeSource,RBDImage
API rule violation: names_match,k8s.io/api/core/v1,RBDVolumeSource,RBDPool
API rule violation: names_match,k8s.io/api/core/v1,RBDVolumeSource,RadosUser
API rule violation: names_match,k8s.io/api/core/v1,VolumeSource,CephFS
API rule violation: names_match,k8s.io/api/core/v1,VolumeSource,StorageOS

            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: rule[0]-to[0]-path[1]
                - urlPath:
                    path:
                      exact: rule[0]-to[0]-path[2]
            - orRules:
                rules:
                - destinationPort: 9001
                - destinationPort: 9002
            - orRules:

        succeeds 'resolve'
        outputContains('Rule executed')
        outputContains('See dependency')


        then:
        succeeds 'resolve'
        outputDoesNotContain('Rule executed')
        outputDoesNotContain('See dependency')
    }

    @RequiredFeature(feature = GradleMetadataResolveRunner.REPOSITORY_TYPE, value = "maven")
    def 'cached rule can access PomModuleDescriptor for Maven component'() {

			// we can skip this rule if it doesn't match the tested
			// prefix.
			if !strings.HasPrefix(prefix, rule.GetPrefix()) && !strings.HasPrefix(rule.GetPrefix(), prefix) {
				continue
			}
		}

		if rule.NoncurrentVersionExpiration.NoncurrentDays > 0 {
			return true
		}
		if rule.NoncurrentVersionExpiration.NewerNoncurrentVersions > 0 {
			return true
		}

}

func TestGroup(t *testing.T) {
	table := tests{
		"wildcard": {
			rule: adreg.RuleWithOperations{
				Rule: adreg.Rule{
					APIGroups: []string{"*"},
				},
			},
			match: attrList(
				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
			),
		},
		"exact": {
			rule: adreg.RuleWithOperations{
				Rule: adreg.Rule{
					APIGroups: []string{"g1", "g2"},
				},
			},
			match: attrList(