err:         test.authzErr,
				},
			}
			err := p.Validate(context.Background(), test.attributes, nil)
			if err == nil && !test.allowed {
				t.Errorf("Expected authorization policy to reject CSR but it was allowed")
			}
			if err != nil && test.allowed {
				t.Errorf("Expected authorization policy to accept CSR but it was rejected: %v", err)
			}
		})
	}
}

type fakeAuthorizer struct {

        'resolve()'                  | 'dependencyScope' | 'resolve()'                                                                                                                          || "Resolving dependency configuration 'custom' is not allowed as it is defined as 'canBeResolved=false'."

				"m/a",
				"m/b",
				"m/c",
				"m/a"
			],
			"Pos": "",
			"Err": "import cycle not allowed"
		}
	]
}
{
	"ImportPath": "m/b",
	"DepsErrors": [
		{
			"ImportStack": [
				"m/a",
				"m/b",
				"m/c",
				"m/a"
			],
			"Pos": "",
			"Err": "import cycle not allowed"
		}
	]
}
{
	"ImportPath": "m/a",
	"Error": {
		"ImportStack": [
			"m/a",
			"m/b",

go get ./baddep
! go build ./baddep
stderr golang.org[/\\]notx[/\\]useinternal
stderr 'use of internal package golang.org/x/.* not allowed'

# Internal packages in the standard library should not leak into modules.
go get ./fromstd
! go build ./fromstd
stderr 'use of internal package internal/testenv not allowed'

# Dependencies should be able to use their own internal modules...
go mod edit -module=golang.org/notx
go get ./throughdep

package allowed

import (
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/allowed/a2"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/forbidden/f2"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/neither/n2"
)

type SubjectAccessReviewStatus struct {
	// Allowed is required. True if the action would be allowed, false otherwise.
	Allowed bool
	// Denied is optional. True if the action would be denied, otherwise
	// false. If both allowed is false and denied is false, then the
	// authorizer has no opinion on whether to authorize the action. Denied
	// may not be true if Allowed is true.
	Denied bool

package allowed

import (
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/allowed/a2"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/forbidden/f2"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/neither/n2"
)

			decision: authorizer.DecisionAllow,
			reason:   "allowed",
			err:      nil,
			expectedAttrs: authorizer.AttributesRecord{
				User:            &user.DefaultInfo{Name: "bob"},
				Verb:            "get",
				Path:            "/mypath",
				ResourceRequest: false,
			},
			expectedStatus: authorizationapi.SubjectAccessReviewStatus{
				Allowed:         true,
				Reason:          "allowed",
				EvaluationError: "",
			},
		},

			p.InspectFeatureGates(feature.DefaultFeatureGate)

			err := p.Validate(context.Background(), tc.attributes, nil)
			if err == nil && !tc.allowed {
				t.Errorf("Expected authorization policy to reject ClusterTrustBundle but it was allowed")
			}
			if err != nil && tc.allowed {
				t.Errorf("Expected authorization policy to accept ClusterTrustBundle but it was rejected: %v", err)
			}
		})
	}
}

      from:
        - source:
            namespaces: [ "{{ .Allowed.NamespaceName }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]
            paths: [ "/proto.EchoTestService/Echo" ]
            methods: [ "POST" ]
      from:
        - source:
            namespaces: [ "{{ .Allowed.NamespaceName }}" ]
    - to:
        - operation: # TCP