{s: "x[bad]", err: true},
		{s: "[bad", err: true},
		{s: "bad]", err: true},
		{s: "bad", err: true},
	}

	for _, c := range cases {
		t.Run(c.s, func(t *testing.T) {
			s, err := extractNameInNestedBrackets(c.s)
			if !reflect.DeepEqual(s, c.want) {
				t.Errorf("want %s but found %s", c.want, s)
			}
			if c.err != (err != nil) {
				t.Errorf("unexpected error: %v", err)
			}
		})
	}

	if !strings.HasPrefix(s, "[") || !strings.HasSuffix(s, "]") {
		return "", fmt.Errorf("expecting format [<NAME>], but found %s", s)
	}
	return strings.TrimPrefix(strings.TrimSuffix(s, "]"), "["), nil
}

func extractNameInNestedBrackets(s string) ([]string, error) {
	var claims []string
	findEndBracket := func(begin int) int {
		if begin >= len(s) || s[begin] != '[' {
			return -1
		}
		for i := begin + 1; i < len(s); i++ {

}

func (rcg requestClaimGenerator) principal(key, value string, forTCP bool, _ bool) (*rbacpb.Principal, error) {
	if forTCP {
		return nil, fmt.Errorf("%q is HTTP only", key)
	}

	claims, err := extractNameInNestedBrackets(strings.TrimPrefix(key, attrRequestClaims))
	if err != nil {
		return nil, err
	}
	// Generate a metadata list matcher for the given path keys and value.
	// On proxy side, the value should be of list type.