@Model
                void p1(Thing t) {
                }

                @Rules
                void rules(CalculateName rules, Thing t) {
                }
            }

            class CalculateName extends RuleSource {
                @Rules
                void rules(SpecializeName rules, Thing t) {
                }
            }

            class SpecializeName extends RuleSource {

	for i, h := range webhooks {
		mutating[i] = registrationv1.MutatingWebhook{
			Name:                    h.Name,
			ClientConfig:            h.ClientConfig,
			Rules:                   h.Rules,
			FailurePolicy:           h.FailurePolicy,
			MatchPolicy:             h.MatchPolicy,
			NamespaceSelector:       h.NamespaceSelector,
			ObjectSelector:          h.ObjectSelector,

action: DENY
groups:
- rules:
  - matches:
    - destinationPorts:
      - 80
  - matches:
    - namespaces:
      - exact: from-mix-ns
      principals:
      - exact: from-mix-principal
- rules:
  - matches:
    - destinationPorts:
      - 80
  - matches:
    - namespaces:
      - exact: to-mix-ns
      principals:
      - exact: to-mix-principal
- rules:
  - matches:
    - destinationPorts:
      - 80

            }
        }
        apply plugin: Rules
        """

        expect:
        succeeds "validate"
    }


    def "can create a ModelMap of List<String>"() {
        buildFile << """
            class Rules extends RuleSource {
                @Model void things(ModelMap<List<String>> things) { }
            }
            apply plugin: Rules

            model {

    private static final String MESSAGE = "The following model rules could not be applied due to unbound inputs and/or subjects:";
    private final List<? extends UnboundRule> rules;

    public UnboundModelRulesException(List<? extends UnboundRule> rules) {
        super(toMessage(rules));
        this.rules = rules;
    }

    private static String toMessage(Iterable<? extends UnboundRule> rules) {
        StringWriter string = new StringWriter();

groups:
- rules:
  - matches:
    - notPrincipals:
      - exact: not-principal
      - prefix: not-principal-prefix-
      - suffix: -suffix-not-principal
      - presence: {}
      principals:
      - exact: principal
      - prefix: principal-prefix-
      - suffix: -suffix-principal
      - presence: {}
- rules:
  - matches:
    - namespaces:
      - exact: ns
      - prefix: ns-prefix-
      - suffix: -ns-suffix

    }

    def "informative error message when two plugins declare model at the same path and model is already created"() {
        when:
        buildScript '''
            class MyPlugin {
                static class Rules extends RuleSource {
                    @Model

typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    action: DENY
    policies:
      istio-ext-authz-ns[foo]-policy[httpbin-1]-rule[0]-deny-due-to-bad-CUSTOM-action:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /httpbin1

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-1]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :method
                    stringMatch:
                      exact: GET
                - header:

  rules:
    action: LOG
    policies:
      ns[foo]-policy[httpbin-audit]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - destinationPort: 80
            - notRule:
                orRules:
                  rules:
                  - destinationPort: 8000
            - orRules: