rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /another
        principals:
        - andIds:
            ids:
            - any: true
  shadowRules:
    policies:
      ns[foo]-policy[httpbin-1]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:

    policies:
      ns[foo]-policy[httpbin-deny]-rule[0]:
        permissions:
        - andRules:
            rules:
            - any: true
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://deny

                    println "gradleApi() ids: " + idsA.get()
                    println "gradleTestKit() files: " + filesB.collect { it.name }
                    println "gradleTestKit() ids: " + idsB.get()
                    println "localGroovy() files: " + filesC.collect { it.name }
                    println "localGroovy() ids: " + idsC.get()
                }
            }
"""

        when:

				lris, ok := l.lockMap[resource]
				if !ok {
					continue
				}
				// Collect uids, so we don't mutate while we delete
				uids := make([]string, 0, len(lris))
				for _, lri := range lris {
					uids = append(uids, lri.UID)
				}

				// Delete collected uids:
				for _, uid := range uids {
					lris, ok := l.lockMap[resource]
					if !ok {
						// Just to be safe, delete uuids.

        - andIds:
            ids:
            - any: true
      istio-ext-authz-ns[foo]-policy[httpbin-2]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /httpbin2
        principals:
        - andIds:
            ids:
            - any: true

			break;
		}
	}

	free(prev);

	return NULL;
}

static void runThreads(int n) {
	pthread_t ids[64];
	int i;

	if (n > 64) {
		n = 64;
	}
	for (i = 0; i < n; i++) {
		pthread_create(&ids[i], NULL, spin, NULL);
	}
	for (i = 0; i < n; i++) {
		pthread_join(ids[i], NULL);
	}
}
*/
import "C"

import (
	"io"
	"runtime"
	"runtime/pprof"
	"unsafe"
)

	if len(chains) == 0 || len(chains[0]) == 0 {
		return nil, fmt.Errorf("no verified chain is found")
	}

	ids, err := util.ExtractIDs(chains[0][0].Extensions)
	if err != nil {
		return nil, err
	}

	return &security.Caller{
		AuthSource: security.AuthSourceClientCertificate,
		Identities: ids,
	}, nil
}

// authenticateHTTP performs mTLS authentication for http requests. Requires having the endpoints on a listener

        setupContainerDefaults()
        UserCodeApplicationId id1 = null
        UserCodeApplicationId id2 = null
        List<UserCodeApplicationId> ids = []
        userCodeApplicationContext.apply(Stub(UserCodeSource)) {
            id1 = it
            container.register("a") {
                ids << userCodeApplicationContext.current()
            }
        }
        userCodeApplicationContext.apply(Stub(UserCodeSource)) {

    policies:
      ns[foo]-policy[httpbin-allow]-rule[0]:
        permissions:
        - andRules:
            rules:
            - any: true
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://allow

        traverses root, b
        traverses a, c
        doesNotResolve b, c

        when:
        def result = resolve()
        result.rethrowFailure()

        then:
        result.components == ids(root, a, b, c)
    }

    def "honors component replacements"() {
        given:
        def a = revision('a') // a->c
        def b = revision('b') // b->d, replaces a