func StringMatcherRegex(regex string) *matcher.StringMatcher {
	return &matcher.StringMatcher{
		MatchPattern: &matcher.StringMatcher_SafeRegex{
			SafeRegex: &matcher.RegexMatcher{
				Regex: regex,
			},
		},
	}
}

// StringMatcherPrefix create a string matcher for prefix matching.
func StringMatcherPrefix(prefix string, ignoreCase bool) *matcher.StringMatcher {
	return &matcher.StringMatcher{
		IgnoreCase: ignoreCase,

			want: authz.MetadataMatcherForJWTClaims([]string{"key1"}, authzmatcher.StringMatcher("exact"), false),
		},
		{
			name: "@request.auth.claims.key1.KEY2",
			in:   &networking.StringMatch{MatchType: &networking.StringMatch_Exact{Exact: "exact"}},
			want: authz.MetadataMatcherForJWTClaims([]string{"key1", "KEY2"}, authzmatcher.StringMatcher("exact"), false),
		},
		{
			name: "@request.auth.claims.key1-key2",

)

// MetadataStringMatcher creates a metadata string matcher for the given filter, key and the
// string matcher.
func MetadataStringMatcher(filter, key string, m *matcher.StringMatcher) *matcher.MetadataMatcher {
	return MetadataValueMatcher(filter, key, &matcher.ValueMatcher{
		MatchPattern: &matcher.ValueMatcher_StringMatch{
			StringMatch: m,
		},
	})
}

	if strings.HasPrefix(value, "[") && strings.HasSuffix(value, "]") {
		m := matcher.MetadataListMatcher(parts[0], parts[1:], matcher.StringMatcher(strings.Trim(value, "[]")), false)
		return permissionMetadata(m), nil
	}
	m := matcher.MetadataStringMatcher(parts[0], parts[1], matcher.StringMatcher(value))
	return permissionMetadata(m), nil
}

			}
			return []string{ret}, nil
		}
		claims = append(claims, s[begin+1:end])
		begin = end + 1
	}
	return claims, nil
}

func MetadataStringMatcherForJWTClaim(claim string, m *matcherpb.StringMatcher) *matcherpb.MetadataMatcher {
	return MetadataValueMatcherForJWTClaim(claim, &matcherpb.ValueMatcher{
		MatchPattern: &matcherpb.ValueMatcher_StringMatch{
			StringMatch: m,
		},
	})
}

}

func StringToExactMatch(in []string) []*matcher.StringMatcher {
	return pm.StringToExactMatch(in)
}

func StringToPrefixMatch(in []string) []*matcher.StringMatcher {
	if len(in) == 0 {
		return nil
	}
	res := make([]*matcher.StringMatcher, 0, len(in))
	for _, s := range in {
		res = append(res, &matcher.StringMatcher{
			MatchPattern: &matcher.StringMatcher_Prefix{Prefix: s},
		})
	}

}

func generateHeaders(headers []string) *envoy_type_matcher_v3.ListStringMatcher {
	if len(headers) == 0 {
		return nil
	}
	var patterns []*envoy_type_matcher_v3.StringMatcher
	for _, header := range headers {
		pattern := &envoy_type_matcher_v3.StringMatcher{
			IgnoreCase: true,
		}
		if strings.HasPrefix(header, "*") {
			pattern.MatchPattern = &envoy_type_matcher_v3.StringMatcher_Suffix{

	m := &matcher.StringMatcher{}

	m.MatchPattern = &matcher.StringMatcher_Prefix{
		Prefix: spiffe.URIPrefix + push.Mesh.GetTrustDomain() + "/ns/" + proxy.Metadata.Namespace + "/sa/",
	}
	return cb.buildConnectOriginate(proxy, push, m)
}

func (cb *ClusterBuilder) buildConnectOriginate(proxy *model.Proxy, push *model.PushContext, uriSanMatchers ...*matcher.StringMatcher) *cluster.Cluster {

	return &rbacpb.Permission{
		Rule: &rbacpb.Permission_DestinationPort{
			DestinationPort: port,
		},
	}
}

func permissionRequestedServerName(name *matcher.StringMatcher) *rbacpb.Permission {
	return &rbacpb.Permission{
		Rule: &rbacpb.Permission_RequestedServerName{
			RequestedServerName: name,
		},
	}
}

var ALPNInMeshH2 = []string{"istio", "h2"}

func StringToExactMatch(in []string) []*matcher.StringMatcher {
	if len(in) == 0 {
		return nil
	}
	res := make([]*matcher.StringMatcher, 0, len(in))
	for _, s := range in {
		res = append(res, &matcher.StringMatcher{
			MatchPattern: &matcher.StringMatcher_Exact{Exact: s},
		})
	}
	return res
}

const (