"k8s.io/apiserver/pkg/authorization/authorizer"
)

func TestNewAuthorizer(t *testing.T) {
	tests := []struct {
		name                       string
		excludedPaths              []string
		allowed, denied, noOpinion []string
		wantErr                    bool
	}{
		{"inner star", []string{"/foo*bar"}, nil, nil, nil, true},
		{"double star", []string{"/foo**"}, nil, nil, nil, true},
		{"empty", nil, nil, nil, []string{"/"}, false},

// decision that is either an Allow decision or a Deny decision. If a
// subauthorizer returns a NoOpinion, then the union authorizer moves onto the
// next authorizer or, if the subauthorizer was the last authorizer, returns
// NoOpinion as the aggregate decision. I.e. union authorizer creates an
// aggregate decision and supports short-circuit allows and denies from
// subauthorizers.

							UnauthorizedTTL:                          metav1.Duration{Duration: 30 * time.Second},
							FailurePolicy:                            "NoOpinion",
							SubjectAccessReviewVersion:               "v1",
							MatchConditionSubjectAccessReviewVersion: "v1",
							ConnectionInfo: api.WebhookConnectionInfo{
								Type: "InClusterConfig",
							},

}

const (
	TypeWebhook                                          AuthorizerType = "Webhook"
	FailurePolicyNoOpinion                               string         = "NoOpinion"
	FailurePolicyDeny                                    string         = "Deny"
	AuthorizationWebhookConnectionInfoTypeKubeConfigFile string         = "KubeConfigFile"

            apiserver_authorization_webhook_duration_seconds_count{name="wh1.example.com",result="timeout"} 1
            # HELP apiserver_authorization_webhook_evaluations_fail_open_total [ALPHA] NoOpinion results due to webhook timeout or error.
            # TYPE apiserver_authorization_webhook_evaluations_fail_open_total counter

	webhookFailOpen = compbasemetrics.NewCounterVec(
		&compbasemetrics.CounterOpts{
			Namespace:      namespace,
			Subsystem:      subsystem,
			Name:           "webhook_evaluations_fail_open_total",
			Help:           "NoOpinion results due to webhook timeout or error.",
			StabilityLevel: compbasemetrics.ALPHA,
		},
		[]string{"name", "result"},
	)
)

type webhookMetrics struct{}

func NewWebhookMetrics() WebhookMetrics {

}

const (
	TypeWebhook                                          AuthorizerType = "Webhook"
	FailurePolicyNoOpinion                               string         = "NoOpinion"
	FailurePolicyDeny                                    string         = "Deny"
	AuthorizationWebhookConnectionInfoTypeKubeConfigFile string         = "KubeConfigFile"

		matches, err := w.match(ctx, r)
		// If at least one matchCondition evaluates to an error (but none are FALSE):
		// If failurePolicy=Deny, then the webhook rejects the request
		// If failurePolicy=NoOpinion, then the error is ignored and the webhook is skipped
		if err != nil {
			return w.decisionOnError, "", err
		}
		// If at least one matchCondition successfully evaluates to FALSE,
		// then the webhook is skipped.

}

const (
	TypeWebhook                                          AuthorizerType = "Webhook"
	FailurePolicyNoOpinion                               string         = "NoOpinion"
	FailurePolicyDeny                                    string         = "Deny"
	AuthorizationWebhookConnectionInfoTypeKubeConfigFile string         = "KubeConfigFile"

	case api.FailurePolicyNoOpinion, api.FailurePolicyDeny:
	default:
		allErrs = append(allErrs, field.NotSupported(fldPath.Child("failurePolicy"), c.FailurePolicy, []string{"NoOpinion", "Deny"}))
	}

	switch c.ConnectionInfo.Type {
	case "":
		allErrs = append(allErrs, field.Required(fldPath.Child("connectionInfo", "type"), ""))
	case api.AuthorizationWebhookConnectionInfoTypeInCluster: