// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package wasm

import (
	"time"

	"istio.io/istio/pkg/util/sets"
)

const (
	DefaultPurgeInterval         = 1 * time.Hour
	DefaultModuleExpiry          = 24 * time.Hour

// Copyright 2015 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

//go:build !wasm

package atomic

import "unsafe"

//go:noescape
func Cas(ptr *uint32, old, new uint32) bool

// NO go:noescape annotation; see atomic_pointer.go.
func Casp1(ptr *unsafe.Pointer, old, new unsafe.Pointer) bool

//go:noescape

  * Istiod xDS server;
  * Istiod injection and validation webhook servers.

  The restrictions are not applied on the following data paths:
  * Istiod to Kubernetes API server;
  * JWK fetch from Istiod;
  * Wasm image and URL fetch from Istio Proxy containers;
  * ztunnel.

  Note that Istio injector will propagate the value of COMPLIANCE_POLICY to the

	"istio.io/istio/pilot/pkg/features"
	"istio.io/istio/pkg/channels"
	"istio.io/istio/pkg/istio-agent/metrics"
	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/model"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/wasm"
)

// sendDeltaRequest is a small wrapper around sending to con.requestsChan. This ensures that we do not
// block forever on
func (con *ProxyConnection) sendDeltaRequest(req *discovery.DeltaDiscoveryRequest) {

							"extenstions.istio.io/wasmplugin/istio-system.wasm-authn",
							"extenstions.istio.io/wasmplugin/istio-system.wasm-authz",
							wellknown.RoleBasedAccessControl,
							"extenstions.istio.io/wasmplugin/istio-system.wasm-stats",
							xds.StatsFilterName,
							wellknown.TCPProxy,
						},
					},
				},
			},
		},
		{
			name: "HTTP RBAC, WASM, and Stats",
			configs: []config.Config{
				{

	t.Parallel()
	testChanSendBarrier(false)
}

func testChanSendBarrier(useSelect bool) {
	var wg sync.WaitGroup
	outer := 100
	inner := 100000
	if testing.Short() || runtime.GOARCH == "wasm" {
		outer = 10
		inner = 1000
	}
	for i := 0; i < outer; i++ {
		wg.Add(1)
		go func() {
			defer wg.Done()
			var garbage []byte
			for j := 0; j < inner; j++ {
				_, err := doRequest(useSelect)

		httpFilterChainOpts.networkFilters = extension.PopAppendNetwork(httpFilterChainOpts.networkFilters, wasm, extensions.PluginPhase_AUTHN)
		httpFilterChainOpts.networkFilters = extension.PopAppendNetwork(httpFilterChainOpts.networkFilters, wasm, extensions.PluginPhase_AUTHZ)
		httpFilterChainOpts.networkFilters = extension.PopAppendNetwork(httpFilterChainOpts.networkFilters, wasm, extensions.PluginPhase_STATS)

- [`KT-67785`](https://youtrack.jetbrains.com/issue/KT-67785) Kotlin/Wasm: Node.JS 22 does not need experimental-wasm-gc flag anymore
- [`KT-66228`](https://youtrack.jetbrains.com/issue/KT-66228) K/Wasm 2.0.0-Beta4 distribution doesn't contain all files
- [`KT-66159`](https://youtrack.jetbrains.com/issue/KT-66159) K/Wasm: applyBinaryen somehow affects skiko.mjs

	// Authn
	filters = extension.PopAppendNetwork(filters, wasm, extensions.PluginPhase_AUTHN)

	// Authz. Since this is HTTP, we only add WASM network filters -- not TCP RBAC, stats, etc.
	filters = extension.PopAppendNetwork(filters, wasm, extensions.PluginPhase_AUTHZ)
	filters = extension.PopAppendNetwork(filters, wasm, extensions.PluginPhase_STATS)
	filters = extension.PopAppendNetwork(filters, wasm, extensions.PluginPhase_UNSPECIFIED_PHASE)

	// But end users can certainly configure it on their own via the meshConfig using the %FILTER_STATE% macro.
	envoyWasmStateToLog = []string{"wasm.upstream_peer", "wasm.upstream_peer_id", "wasm.downstream_peer", "wasm.downstream_peer_id"}

	// reqWithoutQueryFormatter configures additional formatters needed for some of the format strings like "REQ_WITHOUT_QUERY"