type indexedWatchers struct {
	allWatchers   map[namespacedName]watchersMap
	valueWatchers map[string]watchersMap
}

func (i *indexedWatchers) addWatcher(w *cacheWatcher, number int, scope namespacedName, value string, supported bool) {
	if supported {
		if _, ok := i.valueWatchers[value]; !ok {
			i.valueWatchers[value] = watchersMap{}
		}
		i.valueWatchers[value].addWatcher(w, number)
	} else {

		c.Lock()
		defer c.Unlock()

		if c.watchCache.resourceVersion < rv {
			t.Fatalf("Can't compact into a future version: %v", resourceVersion)
		}

		if len(c.watchers.allWatchers) > 0 || len(c.watchers.valueWatchers) > 0 {
			// We could consider terminating those watchers, but given
			// watchcache doesn't really support compaction and we don't
			// exercise it in tests, we just throw an error here.

	if useExtendedJwt {
		out.Value = &matcher.ValueMatcher{
			MatchPattern: &matcher.ValueMatcher_OrMatch{
				OrMatch: &matcher.OrMatcher{
					ValueMatchers: []*matcher.ValueMatcher{
						{
							MatchPattern: &matcher.ValueMatcher_ListMatch{
								ListMatch: listMatcher,
							},
						},
						value,
					},
				},
			},
		}
	} else {
		out.Value = &matcher.ValueMatcher{

func OrMatcher(matchers []*matcher.ValueMatcher) *matcher.ValueMatcher {
	if len(matchers) == 1 {
		return matchers[0]
	}
	return &matcher.ValueMatcher{
		MatchPattern: &matcher.ValueMatcher_OrMatch{
			OrMatch: &matcher.OrMatcher{
				ValueMatchers: matchers,
			},
		},
	}
}

// StringMatcherRegex creates a regex string matcher for regex.

		cacher.Lock()
		defer cacher.Unlock()

		require.Equal(t, expectedWatchersCounter, len(cacher.watchers.allWatchers))
		require.Equal(t, expectedValueWatchersCounter, len(cacher.watchers.valueWatchers))
	}
	assertCacherInternalState(0, 0)

	var forgetWatcherFn func(bool)
	var forgetCounter int
	forgetWatcherWrapped := func(drainWatcher bool) {
		forgetCounter++
		forgetWatcherFn(drainWatcher)

                - key: payload
                - key: aud
                value:
                  orMatch:
                    valueMatchers:
                    - listMatch:
                        oneOf:
                          orMatch:
                            valueMatchers:
                            - stringMatch:
                                exact: audiences
                            - stringMatch:

				{
					Segment: &matcher.MetadataMatcher_PathSegment_Key{
						Key: "key2",
					},
				},
			},
			Value: &matcher.ValueMatcher{
				MatchPattern: &matcher.ValueMatcher_ListMatch{
					ListMatch: &matcher.ListMatcher{
						MatchPattern: &matcher.ListMatcher_OneOf{
							OneOf: &matcher.ValueMatcher{
								MatchPattern: &matcher.ValueMatcher_StringMatch{
									StringMatch: &matcher.StringMatcher{

	return MetadataValueMatcherForJWTClaim(claim, &matcherpb.ValueMatcher{
		MatchPattern: &matcherpb.ValueMatcher_StringMatch{
			StringMatch: m,
		},
	})
}

func MetadataValueMatcherForJWTClaim(claim string, m *matcherpb.ValueMatcher) *matcherpb.MetadataMatcher {
	return &matcherpb.MetadataMatcher{
		Filter: filters.EnvoyJwtFilterName,

	}

	matchers := []*matcherpb.ValueMatcher{}
	for _, value := range values {
		if strings.HasPrefix(value, "[") && strings.HasSuffix(value, "]") {
			matchers = append(matchers, &matcherpb.ValueMatcher{
				MatchPattern: &matcherpb.ValueMatcher_ListMatch{
					ListMatch: &matcherpb.ListMatcher{
						MatchPattern: &matcherpb.ListMatcher_OneOf{
							OneOf: &matcherpb.ValueMatcher{

				Segment: &envoy_type_matcher_v3.MetadataMatcher_PathSegment_Key{
					Key: authzmodel.RBACExtAuthzShadowRulesStatPrefix + authzmodel.RBACShadowEffectivePolicyID,
				},
			},
		},
		Value: &envoy_type_matcher_v3.ValueMatcher{
			MatchPattern: &envoy_type_matcher_v3.ValueMatcher_StringMatch{
				StringMatch: &envoy_type_matcher_v3.StringMatcher{
					MatchPattern: &envoy_type_matcher_v3.StringMatcher_Prefix{
						Prefix: extAuthzMatchPrefix,