import org.gradle.internal.jacoco.rules.JacocoViolationRulesContainerImpl;
import org.gradle.internal.reflect.Instantiator;
import org.gradle.testing.jacoco.tasks.rules.JacocoViolationRulesContainer;

import java.io.File;
import java.io.IOException;

/**
 * Task for verifying code coverage metrics. Fails the task if violations are detected based on specified rules.
 * <p>
 * Requires JaCoCo version &gt;= 0.6.3.
 *

                c.items.add 'bar'
            }
        }

        apply plugin: Rules
        """

        then:
        fails 'tasks'

        and:
        failure.assertHasCause "Attempt to modify a read only view of model element 'container.items' of type '$type<String>' given to rule Rules#tryToMutate(ModelMap<Task>, Container)"

        where:
        type << MANAGED_SCALAR_COLLECTION_TYPES

        - andRules:
            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /httpbin1
        principals:
        - andIds:
            ids:
            - any: true
      istio-ext-authz-ns[foo]-policy[httpbin-2]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:

type SuccessPolicyApplyConfiguration struct {
	Rules []SuccessPolicyRuleApplyConfiguration `json:"rules,omitempty"`
}

// SuccessPolicyApplyConfiguration constructs an declarative configuration of the SuccessPolicy type for use with
// apply.
func SuccessPolicy() *SuccessPolicyApplyConfiguration {
	return &SuccessPolicyApplyConfiguration{}
}

// WithRules adds the given value to the Rules field in the declarative configuration

      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:bootstrap-signer
    namespace: kube-public
  rules:
  - apiGroups:
    - ""
    resources:
    - configmaps
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    resourceNames:
    - cluster-info
    resources:

			field.Required(field.NewPath("spec").Child("rules").Index(0).Child("subjects").Index(0).Child("serviceAccount"), "serviceAccount is required when subject kind is 'ServiceAccount'"),
			field.Forbidden(field.NewPath("spec").Child("rules").Index(0).Child("subjects").Index(0).Child("user"), "user is forbidden when subject kind is not 'User'"),

        buildType.componentSources.@creator[0] == 'Rules#buildType(BuildType)'
        buildType.componentSources.componentA.@type[0] == 'CustomSourceSet'
        buildType.componentSources.componentA.@creator[0] == 'Rules#addSources(BuildType) > create(componentA)'

        buildType.testSources.@type[0] == "org.gradle.model.ModelSet<CustomSourceSet>"
        buildType.testSources.@creator[0] == 'Rules#buildType(BuildType)'

	// RulesFor returns the list of rules that apply to a given user in a given namespace and error.  If an error is returned, the slice of
	// PolicyRules may not be complete, but it contains all retrievable rules.  This is done because policy rules are purely additive and policy determinations
	// can be made on the basis of those rules that are found.
	RulesFor(user user.Info, namespace string) ([]rbacv1.PolicyRule, error)

        buildFile << '''
class Rules extends RuleSource {
}

model {
    rules(Rules) { }
}
'''

        expect:
        fails()
        failure.assertHasCause("Declaration of model rule rules(Rules) { ... } @ build.gradle line 6, column 5 is invalid.")
        failure.assertHasCause("A model element of type: 'Rules' can not be constructed.")
    }

  // The action to take if the request is matched with the rules.
  // Default is ALLOW if not specified.
  Action action = 4;
  // Set of RBAC policy groups each containing its rules.
  // If at least one of the groups is matched the policy action will
  // take place.
  // Groups are OR-ed.
  repeated Group groups = 5;
}

message Group {
  // Rules are OR-ed (e.g. ANY rule can match)