"istio.io/istio/pkg/config/schema/gvk"
	"istio.io/istio/pkg/maps"
)

var _ analysis.Analyzer = &SelectorAnalyzer{}

type SelectorAnalyzer struct{}

var policyGVKs = []config.GroupVersionKind{
	gvk.AuthorizationPolicy,
	gvk.RequestAuthentication,
	gvk.Telemetry,
	gvk.WasmPlugin,
}

type policy interface {
	GetSelector() *typev1beta1.WorkloadSelector
	GetTargetRef() *typev1beta1.PolicyTargetReference
}

	}
	switch orig.GroupVersionKind {
	case gvk.AuthorizationPolicy:
		oldRes := &apiistioioapisecurityv1beta1.AuthorizationPolicy{
			ObjectMeta: origMeta,
			Spec:       *(orig.Spec.(*istioioapisecurityv1beta1.AuthorizationPolicy)),
		}
		modRes := &apiistioioapisecurityv1beta1.AuthorizationPolicy{
			ObjectMeta: modMeta,
			Spec:       *(mod.Spec.(*istioioapisecurityv1beta1.AuthorizationPolicy)),
		}

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: groups-deny
spec:
  action: DENY
  rules:
  # Has mix of L4 and L7 in from
  - from:
    - source:
        principals: ["from-mix-principal"]
        requestPrincipals: ["from-mix-requestPrincipals"]
        namespaces: ["from-mix-ns"]
    to:
    - operation:
        ports: ["80"]
  # Has mix of L4 and L7 in to
  - from:
    - source:

	"istio.io/istio/pkg/kube/krt"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/spiffe"
	"istio.io/istio/pkg/workloadapi/security"
)

func PolicyCollections(
	AuthzPolicies krt.Collection[*securityclient.AuthorizationPolicy],
	PeerAuths krt.Collection[*securityclient.PeerAuthentication],
	MeshConfig krt.Singleton[MeshConfig],
	Waypoints krt.Collection[Waypoint],
	Pods krt.Collection[*v1.Pod],

			ServicePortName: "grpc-main",
		},
	})

	store.Create(config.Config{
		Meta: config.Meta{
			GroupVersionKind: gvk.AuthorizationPolicy,
			Name:             svcname,
			Namespace:        ns,
		},
		Spec: &security.AuthorizationPolicy{
			Rules: []*security.Rule{
				{
					When: []*security.Condition{
						{
							Key: "request.headers[echo]",
							Values: []string{

  jwtRules:
  - issuer: "******@****.***"
    jwksUri: "https://raw.githubusercontent.com/istio/istio/master/tests/common/jwt/jwks.json"
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: authz-gateway-{{ .To.ServiceName }}
spec:
  targetRef:
    name: {{ .To.ServiceName }}-gateway
    kind: Gateway
    group: gateway.networking.k8s.io
  rules:
  - to:

# release notes.
releaseNotes:
- |

	s.addPolicy(t, "global", systemNS, nil, gvk.AuthorizationPolicy, nil)
	s.addPolicy(t, "namespace", testNS, nil, gvk.AuthorizationPolicy, nil)
	s.assertEvent(t, xdsGlobal, xdsNamespace)
	assert.Equal(t,
		s.lookup(s.addrXdsName("127.0.0.1"))[0].Address.GetWorkload().AuthorizationPolicies,
		nil)

	s.addPolicy(t, selectorPolicyName, testNS, map[string]string{"app": "a"}, gvk.AuthorizationPolicy, nil)

  jwtRules:
  - issuer: "******@****.***"
    jwksUri: "https://raw.githubusercontent.com/istio/istio/master/tests/common/jwt/jwks.json"
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: authz-gateway-{{ .To.ServiceName }}
spec:
  targetRef:
    name: {{ .To.ServiceName }}-gateway
    kind: Gateway
    group: gateway.networking.k8s.io
  rules:
  - to:

		},
		{
			name:           "no_relevant_config_update",
			proxyNamespace: "default",
			request: &model.PushRequest{
				Full:           true,
				ConfigsUpdated: sets.New(model.ConfigKey{Kind: kind.AuthorizationPolicy}),
			},
			watchedResources: []string{"extenstions.istio.io/wasmplugin/default.default-plugin-with-sec", "extenstions.istio.io/wasmplugin/istio-system.root-plugin"},
			wantExtensions:   sets.String{},