if !hasHTTPFilterMatch(lp) {
				httpconn.HttpFilters = append([]*hcm.HttpFilter{proto.Clone(lp.Value).(*hcm.HttpFilter)}, httpconn.HttpFilters...)
				continue
			}
			httpconn.HttpFilters, applied = insertBeforeFunc(
				httpconn.HttpFilters,
				func(e *hcm.HttpFilter) (bool, *hcm.HttpFilter) {
					if httpFilterMatch(e, lp) {
						return true, proto.Clone(lp.Value).(*hcm.HttpFilter)
					}
					return false, nil
				},

)

func TestBuildRouterFilter(t *testing.T) {
	tests := []struct {
		name     string
		ctx      RouterFilterContext
		expected *hcm.HttpFilter
	}{
		{
			name: "test for build router filter",
			ctx:  RouterFilterContext{StartChildSpan: true},
			expected: &hcm.HttpFilter{
				Name: wellknown.Router,
				ConfigType: &hcm.HttpFilter_TypedConfig{
					TypedConfig: protoconv.MessageToAny(&router.Router{

		},
	}
	Cors = &hcm.HttpFilter{
		Name: wellknown.CORS,
		ConfigType: &hcm.HttpFilter_TypedConfig{
			TypedConfig: protoconv.MessageToAny(&cors.Cors{}),
		},
	}
	Fault = &hcm.HttpFilter{
		Name: wellknown.Fault,
		ConfigType: &hcm.HttpFilter_TypedConfig{
			TypedConfig: protoconv.MessageToAny(&fault.HTTPFault{}),
		},
	}
	GrpcWeb = &hcm.HttpFilter{
		Name: wellknown.GRPCWeb,

func (b *Builder) BuildHTTP(class networking.ListenerClass) []*hcm.HttpFilter {
	if b == nil || b.builder == nil {
		return nil
	}
	if class == networking.ListenerClassSidecarOutbound {
		// Only applies to inbound and gateways
		return nil
	}
	if b.httpBuilt {
		return b.httpFilters
	}
	b.httpBuilt = true
	b.httpFilters = b.builder.BuildHTTP()

	return b.httpFilters

		WasmPlugin: &extensions.WasmPlugin{
			Priority: &wrapperspb.Int32Value{Value: 1000},
			Type:     extensions.PluginType_NETWORK,
		},
	}
)

func TestInsertedExtensionConfigurations(t *testing.T) {
	httpFilter := protoconv.MessageToAny(&httpwasm.Wasm{
		Config: &wasmextension.PluginConfig{
			Name:          "istio-system.someAuthNFilter",
			Configuration: &anypb.Any{},
			Vm: &wasmextension.PluginConfig_VmConfig{

func (b *Builder) BuildHTTP(class networking.ListenerClass) []*hcm.HttpFilter {
	if b == nil {
		return nil
	}
	if class == networking.ListenerClassSidecarOutbound {
		// Only applies to inbound and gateways
		return nil
	}
	if b.proxy.SupportsEnvoyExtendedJwt() {
		filter := b.applier.JwtFilter(true, b.proxy.Type != model.SidecarProxy)
		if filter != nil {
			return []*hcm.HttpFilter{filter}
		}
		return nil
	}

	}

	jwksURI := ms.URL + "/oauth2/v3/certs"

	cases := []struct {
		name          string
		in            []*config.Config
		jwksFetchMode jwt.JwksFetchMode
		expected      *hcm.HttpFilter
	}{
		{
			name:     "No policy",
			in:       []*config.Config{},
			expected: nil,
		},
		{
			name: "Empty policy",
			in: []*config.Config{
				{
					Spec: &v1beta1.RequestAuthentication{},

// plugins of a provided phase from the WASM plugin set and append them to the list of filters
func PopAppendHTTP(list []*hcm.HttpFilter,
	filterMap map[extensions.PluginPhase][]*model.WasmPluginWrapper,
	phase extensions.PluginPhase,
) []*hcm.HttpFilter {
	for _, ext := range filterMap[phase] {
		list = append(list, toEnvoyHTTPFilter(ext))
	}
	delete(filterMap, phase)
	return list
}

}

func (b Builder) buildHTTP(rules *rbacpb.RBAC, shadowRules *rbacpb.RBAC, providers []string) []*hcm.HttpFilter {
	if !b.option.IsCustomBuilder {
		rbac := &rbachttp.RBAC{
			Rules:                 rules,
			ShadowRules:           shadowRules,
			ShadowRulesStatPrefix: shadowRuleStatPrefix(shadowRules),
		}
		return []*hcm.HttpFilter{
			{
				Name:       wellknown.HTTPRoleBasedAccessControl,

					if cm := getHTTPConnectionManager(filter); cm != nil {
						for _, httpFilter := range cm.GetHttpFilters() {
							switch httpFilter.GetName() {
							case wellknown.HTTPRoleBasedAccessControl:
								rbacHTTP := &rbachttp.RBAC{}
								if err := getHTTPFilterConfig(httpFilter, rbacHTTP); err != nil {
									log.Errorf("found RBAC HTTP filter but failed to parse: %s", err)
								} else {