if err != nil {
				t.Error(err)
				return
			}

			req := &drapbv1alpha3.NodePrepareResourcesRequest{
				Claims: []*drapbv1alpha3.Claim{
					{
						Namespace:      "dummy-namespace",
						Uid:            "dummy-uid",
						Name:           "dummy-claim",
						ResourceHandle: "dummy-resource",
					},
				},
			}
			client.NodePrepareResources(context.TODO(), req)

		},
		{
			name: "@request.auth.claims.key1",
			want: RoutingClaim{Match: true, Separator: Dot, Claims: []string{"key1"}},
		},
		{
			name: "@request.auth.claims.key1.KEY2",
			want: RoutingClaim{Match: true, Separator: Dot, Claims: []string{"key1", "KEY2"}},
		},
		{
			name: "@request.auth.claims.key1-key2",
			want: RoutingClaim{Match: true, Separator: Dot, Claims: []string{"key1-key2"}},
		},
		{

			if err != nil {
				return nil, err
			}
			return []string{ret}, nil
		}
		claims = append(claims, s[begin+1:end])
		begin = end + 1
	}
	return claims, nil
}

func MetadataStringMatcherForJWTClaim(claim string, m *matcherpb.StringMatcher) *matcherpb.MetadataMatcher {
	return MetadataValueMatcherForJWTClaim(claim, &matcherpb.ValueMatcher{
		MatchPattern: &matcherpb.ValueMatcher_StringMatch{
			StringMatch: m,
		},

  -sub SUB, --sub SUB   sub claim. If not provided, it is set to the same as
                        iss claim.
  -claims CLAIMS, --claims CLAIMS
                        Other claims in format name1:value1,name2:value2 etc.
                        Only string values are supported.
```

## Example

Here is an example of using sa-jwt.py to generate a JWT token.

```bash

				&ClaimMappingExpression{
					Expression: "claims.foo",
				},
			},
			wantErr: `compilation failed: ERROR: <input>:1:1: undeclared reference to 'claims' (in container '')`,
		},
		{
			name: "ExtraMappingCondition with wrong env",
			expressionAccessors: []ExpressionAccessor{
				&ExtraMappingExpression{
					Expression: "claims.foo",
				},
			},

    when:
    - key: request.auth.claims[nested][key1]
      values: ["valueB"]
  - to:
    - operation:
        paths: ["/nested-non-exist"]
        methods: ["GET"]
    when:
    - key: request.auth.claims[nested][non-exist]
      values: ["valueC"]
  - to:
    - operation:
        paths: ["/nested-key2"]
        methods: ["GET"]
    when:
    - key: request.auth.claims[nested][key2]
      values: ["valueC"]

type ResourceRequirementsApplyConfiguration struct {
	Limits   *v1.ResourceList                  `json:"limits,omitempty"`
	Requests *v1.ResourceList                  `json:"requests,omitempty"`
	Claims   []ResourceClaimApplyConfiguration `json:"claims,omitempty"`
}

// ResourceRequirementsApplyConfiguration constructs an declarative configuration of the ResourceRequirements type for use with
// apply.

	Claims             map[string]interface{} `json:"claims"`
}

var tokens map[string]Resp = map[string]Resp{
	"aaa": {
		User:               "Alice",
		MaxValiditySeconds: 3600,
		Claims: map[string]interface{}{
			"groups": []string{"data-science"},
		},
	},
	"bbb": {
		User:               "Bart",
		MaxValiditySeconds: 3600,
		Claims: map[string]interface{}{

      to:
        - operation:
            methods: ["GET"]
            paths: ["/info*"]
        - operation:
            methods: ["POST"]
            paths: ["/data"]
      when:
        - key: request.auth.claims[iss]
          values: ["https://accounts.google.com"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: meshwide-httpbin
  namespace: istio-system # valid: it applies to whole mesh

import (
	"strings"
)

// HeaderJWTClaim is the special header name used in virtual service for routing based on JWT claims.
const HeaderJWTClaim = "@request.auth.claims"

type Separator int

const (
	Dot Separator = iota
	Square
)

type RoutingClaim struct {
	Match     bool
	Separator Separator
	Claims    []string
}

func ToRoutingClaim(headerName string) RoutingClaim {
	rc := RoutingClaim{}