}
		})
	}
}

func yamlPermission(t *testing.T, yaml string) *rbacpb.Permission {
	t.Helper()
	p := &rbacpb.Permission{}
	if err := protomarshal.ApplyYAML(yaml, p); err != nil {
		t.Fatalf("failed to parse yaml: %s", err)
	}
	return p
}

func yamlPrincipal(t *testing.T, yaml string) *rbacpb.Principal {
	t.Helper()
	p := &rbacpb.Principal{}
	if err := protomarshal.ApplyYAML(yaml, p); err != nil {

//
// nolint: unparam
func buildRBAC(node *model.Proxy, push *model.PushContext, suffix string, context *tls.DownstreamTlsContext,
	a rbacpb.RBAC_Action, policies []model.AuthorizationPolicy,
) *rbacpb.RBAC {
	rules := &rbacpb.RBAC{
		Action:   a,
		Policies: map[string]*rbacpb.Policy{},
	}
	for _, policy := range policies {
		for i, rule := range policy.Spec.Rules {

,WACM2H,EAAK3N,SACP2N,EAAKqC,SAKP9Q,KAAKuC,OAAOxB,SACdf,KAAKuC,OAALyJ,EAAA,GACKhM,KAAKuC,OADV,CAEER,QAAS,SACThB,SAAU,KAGZf,KAAKgiB,eAITA,UAAA,WACE,IAAMC,SAAmBjiB,KAAKc,QAAQE,aAAa,wBAE/ChB,KAAKc,QAAQE,aAAa,UAA0B,WAAdihB,KACxCjiB,KAAKc,QAAQkH,aACX,sBACAhI,KAAKc,QAAQE,aAAa,UAAY,IAGxChB,KAAKc,QAAQkH,aAAa,QAAS,QAIvCgY,OAAA,SAAO/b,EAAOkR,GACZ,IAAMyK,EAAU5f,KAAKsU,YAAYzP,UACjCsQ,EAAUA,GAAWjV,EAAE+D,EAAMiO,eAAexL,KAAKkZ,MAG/CzK,EAAU,IAAInV,KAAKsU,YACjBrQ,EAAMiO,cACNlS,KAAK6f,sBAEP3f,EAAE+D,EAAMiO,eAAexL...

AAUc,GAChC,gBACAlH,KAAKihB,mBAGHjhB,KAAKuC,OAAOxB,SACdf,KAAKuC,OAALqK,EAAA,GACK5M,KAAKuC,OADV,CAEER,QAAS,SACThB,SAAU,KAGZf,KAAK+iB,eAITA,UAAA,WACE,IAAMC,SAAmBhjB,KAAKc,QAAQE,aAAa,wBAE/ChB,KAAKc,QAAQE,aAAa,UAA0B,UAAdgiB,IACxChjB,KAAKc,QAAQwH,aACX,sBACAtI,KAAKc,QAAQE,aAAa,UAAY,IAGxChB,KAAKc,QAAQwH,aAAa,QAAS,QAIvCwY,OAAA,SAAOzc,EAAOoR,GACZ,IAAMiL,EAAU1gB,KAAK6U,YAAY5P,UACjCwQ,EAAUA,GAAWvV,EAAEmE,EAAMkO,eAAezL,KAAK4Z,MAG/CjL,EAAU,IAAIzV,KAAK6U,YACjBxQ,EAAMkO,cACNvS,KAAK2gB,sBAEPzgB,EAAEmE,EAAMkO,eAA...