// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        v7.35.1
// source: envoy/config/filter/http/jwt_authn/v2alpha/config.proto

package v2alpha

import (
	_ "github.com/cncf/xds/go/udpa/annotations"
	core "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
	route "github.com/envoyproxy/go-control-plane/envoy/api/v2/route"
	_ "github.com/envoyproxy/protoc-gen-validate/validate"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	durationpb "google.golang.org/protobuf/types/known/durationpb"
	emptypb "google.golang.org/protobuf/types/known/emptypb"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

// Please see following for JWT authentication flow:
//
// * `JSON Web Token (JWT) <https://tools.ietf.org/html/rfc7519>`_
// * `The OAuth 2.0 Authorization Framework <https://tools.ietf.org/html/rfc6749>`_
// * `OpenID Connect <http://openid.net/connect>`_
//
// A JwtProvider message specifies how a JSON Web Token (JWT) can be verified. It specifies:
//
// * issuer: the principal that issues the JWT. It has to match the one from the token.
// * allowed audiences: the ones in the token have to be listed here.
// * how to fetch public key JWKS to verify the token signature.
// * how to extract the JWT in the request.
// * how to pass successfully verified token payload.
//
// Example:
//
// .. code-block:: yaml
//
//	issuer: https://example.com
//	audiences:
//	- bookstore_android.apps.googleusercontent.com
//	- bookstore_web.apps.googleusercontent.com
//	remote_jwks:
//	  http_uri:
//	    uri: https://example.com/.well-known/jwks.json
//	    cluster: example_jwks_cluster
//	  cache_duration:
//	    seconds: 300
//
// [#next-free-field: 10]
type JwtProvider struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Specify the `principal <https://tools.ietf.org/html/rfc7519#section-4.1.1>`_ that issued
	// the JWT, usually a URL or an email address.
	//
	// Example: https://securetoken.google.com
	// Example: 1234567-compute@developer.gserviceaccount.com
	Issuer string `protobuf:"bytes,1,opt,name=issuer,proto3" json:"issuer,omitempty"`
	// The list of JWT `audiences <https://tools.ietf.org/html/rfc7519#section-4.1.3>`_ are
	// allowed to access. A JWT containing any of these audiences will be accepted. If not specified,
	// will not check audiences in the token.
	//
	// Example:
	//
	// .. code-block:: yaml
	//
	//	audiences:
	//	- bookstore_android.apps.googleusercontent.com
	//	- bookstore_web.apps.googleusercontent.com
	Audiences []string `protobuf:"bytes,2,rep,name=audiences,proto3" json:"audiences,omitempty"`
	// `JSON Web Key Set (JWKS) <https://tools.ietf.org/html/rfc7517#appendix-A>`_ is needed to
	// validate signature of a JWT. This field specifies where to fetch JWKS.
	//
	// Types that are valid to be assigned to JwksSourceSpecifier:
	//
	//	*JwtProvider_RemoteJwks
	//	*JwtProvider_LocalJwks
	JwksSourceSpecifier isJwtProvider_JwksSourceSpecifier `protobuf_oneof:"jwks_source_specifier"`
	// If false, the JWT is removed in the request after a success verification. If true, the JWT is
	// not removed in the request. Default value is false.
	Forward bool `protobuf:"varint,5,opt,name=forward,proto3" json:"forward,omitempty"`
	// Two fields below define where to extract the JWT from an HTTP request.
	//
	// If no explicit location is specified, the following default locations are tried in order:
	//
	// 1. The Authorization header using the `Bearer schema
	// <https://tools.ietf.org/html/rfc6750#section-2.1>`_. Example::
	//
	//	Authorization: Bearer <token>.
	//
	// 2. `access_token <https://tools.ietf.org/html/rfc6750#section-2.3>`_ query parameter.
	//
	// Multiple JWTs can be verified for a request. Each JWT has to be extracted from the locations
	// its provider specified or from the default locations.
	//
	// Specify the HTTP headers to extract the JWT. For examples, following config:
	//
	// .. code-block:: yaml
	//
	//	from_headers:
	//	- name: x-goog-iap-jwt-assertion
	//
	// can be used to extract token from header::
	//
	//	``x-goog-iap-jwt-assertion: <JWT>``.
	FromHeaders []*JwtHeader `protobuf:"bytes,6,rep,name=from_headers,json=fromHeaders,proto3" json:"from_headers,omitempty"`
	// JWT is sent in a query parameter. `jwt_params` represents the query parameter names.
	//
	// For example, if config is:
	//
	// .. code-block:: yaml
	//
	//	from_params:
	//	- jwt_token
	//
	// The JWT format in query parameter is::
	//
	//	/path?jwt_token=<JWT>
	FromParams []string `protobuf:"bytes,7,rep,name=from_params,json=fromParams,proto3" json:"from_params,omitempty"`
	// This field specifies the header name to forward a successfully verified JWT payload to the
	// backend. The forwarded data is::
	//
	//	base64url_encoded(jwt_payload_in_JSON)
	//
	// If it is not specified, the payload will not be forwarded.
	ForwardPayloadHeader string `protobuf:"bytes,8,opt,name=forward_payload_header,json=forwardPayloadHeader,proto3" json:"forward_payload_header,omitempty"`
	// If non empty, successfully verified JWT payloads will be written to StreamInfo DynamicMetadata
	// in the format as: *namespace* is the jwt_authn filter name as **envoy.filters.http.jwt_authn**
	// The value is the *protobuf::Struct*. The value of this field will be the key for its *fields*
	// and the value is the *protobuf::Struct* converted from JWT JSON payload.
	//
	// For example, if payload_in_metadata is *my_payload*:
	//
	// .. code-block:: yaml
	//
	//	envoy.filters.http.jwt_authn:
	//	  my_payload:
	//	    iss: https://example.com
	//	    sub: test@example.com
	//	    aud: https://example.com
	//	    exp: 1501281058
	PayloadInMetadata string `protobuf:"bytes,9,opt,name=payload_in_metadata,json=payloadInMetadata,proto3" json:"payload_in_metadata,omitempty"`
	unknownFields     protoimpl.UnknownFields
	sizeCache         protoimpl.SizeCache
}

func (x *JwtProvider) Reset() {
	*x = JwtProvider{}
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *JwtProvider) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*JwtProvider) ProtoMessage() {}

func (x *JwtProvider) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use JwtProvider.ProtoReflect.Descriptor instead.
func (*JwtProvider) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescGZIP(), []int{0}
}

func (x *JwtProvider) GetIssuer() string {
	if x != nil {
		return x.Issuer
	}
	return ""
}

func (x *JwtProvider) GetAudiences() []string {
	if x != nil {
		return x.Audiences
	}
	return nil
}

func (x *JwtProvider) GetJwksSourceSpecifier() isJwtProvider_JwksSourceSpecifier {
	if x != nil {
		return x.JwksSourceSpecifier
	}
	return nil
}

func (x *JwtProvider) GetRemoteJwks() *RemoteJwks {
	if x != nil {
		if x, ok := x.JwksSourceSpecifier.(*JwtProvider_RemoteJwks); ok {
			return x.RemoteJwks
		}
	}
	return nil
}

func (x *JwtProvider) GetLocalJwks() *core.DataSource {
	if x != nil {
		if x, ok := x.JwksSourceSpecifier.(*JwtProvider_LocalJwks); ok {
			return x.LocalJwks
		}
	}
	return nil
}

func (x *JwtProvider) GetForward() bool {
	if x != nil {
		return x.Forward
	}
	return false
}

func (x *JwtProvider) GetFromHeaders() []*JwtHeader {
	if x != nil {
		return x.FromHeaders
	}
	return nil
}

func (x *JwtProvider) GetFromParams() []string {
	if x != nil {
		return x.FromParams
	}
	return nil
}

func (x *JwtProvider) GetForwardPayloadHeader() string {
	if x != nil {
		return x.ForwardPayloadHeader
	}
	return ""
}

func (x *JwtProvider) GetPayloadInMetadata() string {
	if x != nil {
		return x.PayloadInMetadata
	}
	return ""
}

type isJwtProvider_JwksSourceSpecifier interface {
	isJwtProvider_JwksSourceSpecifier()
}

type JwtProvider_RemoteJwks struct {
	// JWKS can be fetched from remote server via HTTP/HTTPS. This field specifies the remote HTTP
	// URI and how the fetched JWKS should be cached.
	//
	// Example:
	//
	// .. code-block:: yaml
	//
	//	remote_jwks:
	//	  http_uri:
	//	    uri: https://www.googleapis.com/oauth2/v1/certs
	//	    cluster: jwt.www.googleapis.com|443
	//	  cache_duration:
	//	    seconds: 300
	RemoteJwks *RemoteJwks `protobuf:"bytes,3,opt,name=remote_jwks,json=remoteJwks,proto3,oneof"`
}

type JwtProvider_LocalJwks struct {
	// JWKS is in local data source. It could be either in a local file or embedded in the
	// inline_string.
	//
	// Example: local file
	//
	// .. code-block:: yaml
	//
	//	local_jwks:
	//	  filename: /etc/envoy/jwks/jwks1.txt
	//
	// Example: inline_string
	//
	// .. code-block:: yaml
	//
	//	local_jwks:
	//	  inline_string: ACADADADADA
	LocalJwks *core.DataSource `protobuf:"bytes,4,opt,name=local_jwks,json=localJwks,proto3,oneof"`
}

func (*JwtProvider_RemoteJwks) isJwtProvider_JwksSourceSpecifier() {}

func (*JwtProvider_LocalJwks) isJwtProvider_JwksSourceSpecifier() {}

// This message specifies how to fetch JWKS from remote and how to cache it.
type RemoteJwks struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The HTTP URI to fetch the JWKS. For example:
	//
	// .. code-block:: yaml
	//
	//	http_uri:
	//	  uri: https://www.googleapis.com/oauth2/v1/certs
	//	  cluster: jwt.www.googleapis.com|443
	HttpUri *core.HttpUri `protobuf:"bytes,1,opt,name=http_uri,json=httpUri,proto3" json:"http_uri,omitempty"`
	// Duration after which the cached JWKS should be expired. If not specified, default cache
	// duration is 5 minutes.
	CacheDuration *durationpb.Duration `protobuf:"bytes,2,opt,name=cache_duration,json=cacheDuration,proto3" json:"cache_duration,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RemoteJwks) Reset() {
	*x = RemoteJwks{}
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RemoteJwks) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RemoteJwks) ProtoMessage() {}

func (x *RemoteJwks) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RemoteJwks.ProtoReflect.Descriptor instead.
func (*RemoteJwks) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescGZIP(), []int{1}
}

func (x *RemoteJwks) GetHttpUri() *core.HttpUri {
	if x != nil {
		return x.HttpUri
	}
	return nil
}

func (x *RemoteJwks) GetCacheDuration() *durationpb.Duration {
	if x != nil {
		return x.CacheDuration
	}
	return nil
}

// This message specifies a header location to extract JWT.
type JwtHeader struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The HTTP header name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The value prefix. The value format is "value_prefix<token>"
	// For example, for "Authorization: Bearer <token>", value_prefix="Bearer " with a space at the
	// end.
	ValuePrefix   string `protobuf:"bytes,2,opt,name=value_prefix,json=valuePrefix,proto3" json:"value_prefix,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *JwtHeader) Reset() {
	*x = JwtHeader{}
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[2]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *JwtHeader) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*JwtHeader) ProtoMessage() {}

func (x *JwtHeader) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[2]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use JwtHeader.ProtoReflect.Descriptor instead.
func (*JwtHeader) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescGZIP(), []int{2}
}

func (x *JwtHeader) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *JwtHeader) GetValuePrefix() string {
	if x != nil {
		return x.ValuePrefix
	}
	return ""
}

// Specify a required provider with audiences.
type ProviderWithAudiences struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Specify a required provider name.
	ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"`
	// This field overrides the one specified in the JwtProvider.
	Audiences     []string `protobuf:"bytes,2,rep,name=audiences,proto3" json:"audiences,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderWithAudiences) Reset() {
	*x = ProviderWithAudiences{}
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[3]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderWithAudiences) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderWithAudiences) ProtoMessage() {}

func (x *ProviderWithAudiences) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[3]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderWithAudiences.ProtoReflect.Descriptor instead.
func (*ProviderWithAudiences) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescGZIP(), []int{3}
}

func (x *ProviderWithAudiences) GetProviderName() string {
	if x != nil {
		return x.ProviderName
	}
	return ""
}

func (x *ProviderWithAudiences) GetAudiences() []string {
	if x != nil {
		return x.Audiences
	}
	return nil
}

// This message specifies a Jwt requirement. An empty message means JWT verification is not
// required. Here are some config examples:
//
// .. code-block:: yaml
//
//	# Example 1: not required with an empty message
//
//	# Example 2: require A
//	provider_name: provider-A
//
//	# Example 3: require A or B
//	requires_any:
//	  requirements:
//	    - provider_name: provider-A
//	    - provider_name: provider-B
//
//	# Example 4: require A and B
//	requires_all:
//	  requirements:
//	    - provider_name: provider-A
//	    - provider_name: provider-B
//
//	# Example 5: require A and (B or C)
//	requires_all:
//	  requirements:
//	    - provider_name: provider-A
//	    - requires_any:
//	      requirements:
//	        - provider_name: provider-B
//	        - provider_name: provider-C
//
//	# Example 6: require A or (B and C)
//	requires_any:
//	  requirements:
//	    - provider_name: provider-A
//	    - requires_all:
//	      requirements:
//	        - provider_name: provider-B
//	        - provider_name: provider-C
//
//	# Example 7: A is optional (if token from A is provided, it must be valid, but also allows
//	missing token.)
//	requires_any:
//	  requirements:
//	  - provider_name: provider-A
//	  - allow_missing: {}
//
//	# Example 8: A is optional and B is required.
//	requires_all:
//	  requirements:
//	  - requires_any:
//	      requirements:
//	      - provider_name: provider-A
//	      - allow_missing: {}
//	  - provider_name: provider-B
//
// [#next-free-field: 7]
type JwtRequirement struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to RequiresType:
	//
	//	*JwtRequirement_ProviderName
	//	*JwtRequirement_ProviderAndAudiences
	//	*JwtRequirement_RequiresAny
	//	*JwtRequirement_RequiresAll
	//	*JwtRequirement_AllowMissingOrFailed
	//	*JwtRequirement_AllowMissing
	RequiresType  isJwtRequirement_RequiresType `protobuf_oneof:"requires_type"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *JwtRequirement) Reset() {
	*x = JwtRequirement{}
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[4]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *JwtRequirement) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*JwtRequirement) ProtoMessage() {}

func (x *JwtRequirement) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[4]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use JwtRequirement.ProtoReflect.Descriptor instead.
func (*JwtRequirement) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescGZIP(), []int{4}
}

func (x *JwtRequirement) GetRequiresType() isJwtRequirement_RequiresType {
	if x != nil {
		return x.RequiresType
	}
	return nil
}

func (x *JwtRequirement) GetProviderName() string {
	if x != nil {
		if x, ok := x.RequiresType.(*JwtRequirement_ProviderName); ok {
			return x.ProviderName
		}
	}
	return ""
}

func (x *JwtRequirement) GetProviderAndAudiences() *ProviderWithAudiences {
	if x != nil {
		if x, ok := x.RequiresType.(*JwtRequirement_ProviderAndAudiences); ok {
			return x.ProviderAndAudiences
		}
	}
	return nil
}

func (x *JwtRequirement) GetRequiresAny() *JwtRequirementOrList {
	if x != nil {
		if x, ok := x.RequiresType.(*JwtRequirement_RequiresAny); ok {
			return x.RequiresAny
		}
	}
	return nil
}

func (x *JwtRequirement) GetRequiresAll() *JwtRequirementAndList {
	if x != nil {
		if x, ok := x.RequiresType.(*JwtRequirement_RequiresAll); ok {
			return x.RequiresAll
		}
	}
	return nil
}

func (x *JwtRequirement) GetAllowMissingOrFailed() *emptypb.Empty {
	if x != nil {
		if x, ok := x.RequiresType.(*JwtRequirement_AllowMissingOrFailed); ok {
			return x.AllowMissingOrFailed
		}
	}
	return nil
}

func (x *JwtRequirement) GetAllowMissing() *emptypb.Empty {
	if x != nil {
		if x, ok := x.RequiresType.(*JwtRequirement_AllowMissing); ok {
			return x.AllowMissing
		}
	}
	return nil
}

type isJwtRequirement_RequiresType interface {
	isJwtRequirement_RequiresType()
}

type JwtRequirement_ProviderName struct {
	// Specify a required provider name.
	ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3,oneof"`
}

type JwtRequirement_ProviderAndAudiences struct {
	// Specify a required provider with audiences.
	ProviderAndAudiences *ProviderWithAudiences `protobuf:"bytes,2,opt,name=provider_and_audiences,json=providerAndAudiences,proto3,oneof"`
}

type JwtRequirement_RequiresAny struct {
	// Specify list of JwtRequirement. Their results are OR-ed.
	// If any one of them passes, the result is passed.
	RequiresAny *JwtRequirementOrList `protobuf:"bytes,3,opt,name=requires_any,json=requiresAny,proto3,oneof"`
}

type JwtRequirement_RequiresAll struct {
	// Specify list of JwtRequirement. Their results are AND-ed.
	// All of them must pass, if one of them fails or missing, it fails.
	RequiresAll *JwtRequirementAndList `protobuf:"bytes,4,opt,name=requires_all,json=requiresAll,proto3,oneof"`
}

type JwtRequirement_AllowMissingOrFailed struct {
	// The requirement is always satisfied even if JWT is missing or the JWT
	// verification fails. A typical usage is: this filter is used to only verify
	// JWTs and pass the verified JWT payloads to another filter, the other filter
	// will make decision. In this mode, all JWTs will be verified.
	AllowMissingOrFailed *emptypb.Empty `protobuf:"bytes,5,opt,name=allow_missing_or_failed,json=allowMissingOrFailed,proto3,oneof"`
}

type JwtRequirement_AllowMissing struct {
	// The requirement is satisfied if JWT is missing, but failed if JWT is
	// presented but invalid. Similar to allow_missing_or_failed, this is used
	// to only verify JWTs and pass the verified payload to another filter. The
	// different is this mode will reject requests with invalid tokens.
	AllowMissing *emptypb.Empty `protobuf:"bytes,6,opt,name=allow_missing,json=allowMissing,proto3,oneof"`
}

func (*JwtRequirement_ProviderName) isJwtRequirement_RequiresType() {}

func (*JwtRequirement_ProviderAndAudiences) isJwtRequirement_RequiresType() {}

func (*JwtRequirement_RequiresAny) isJwtRequirement_RequiresType() {}

func (*JwtRequirement_RequiresAll) isJwtRequirement_RequiresType() {}

func (*JwtRequirement_AllowMissingOrFailed) isJwtRequirement_RequiresType() {}

func (*JwtRequirement_AllowMissing) isJwtRequirement_RequiresType() {}

// This message specifies a list of RequiredProvider.
// Their results are OR-ed; if any one of them passes, the result is passed
type JwtRequirementOrList struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Specify a list of JwtRequirement.
	Requirements  []*JwtRequirement `protobuf:"bytes,1,rep,name=requirements,proto3" json:"requirements,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *JwtRequirementOrList) Reset() {
	*x = JwtRequirementOrList{}
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[5]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *JwtRequirementOrList) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*JwtRequirementOrList) ProtoMessage() {}

func (x *JwtRequirementOrList) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[5]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use JwtRequirementOrList.ProtoReflect.Descriptor instead.
func (*JwtRequirementOrList) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescGZIP(), []int{5}
}

func (x *JwtRequirementOrList) GetRequirements() []*JwtRequirement {
	if x != nil {
		return x.Requirements
	}
	return nil
}

// This message specifies a list of RequiredProvider.
// Their results are AND-ed; all of them must pass, if one of them fails or missing, it fails.
type JwtRequirementAndList struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Specify a list of JwtRequirement.
	Requirements  []*JwtRequirement `protobuf:"bytes,1,rep,name=requirements,proto3" json:"requirements,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *JwtRequirementAndList) Reset() {
	*x = JwtRequirementAndList{}
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[6]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *JwtRequirementAndList) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*JwtRequirementAndList) ProtoMessage() {}

func (x *JwtRequirementAndList) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[6]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use JwtRequirementAndList.ProtoReflect.Descriptor instead.
func (*JwtRequirementAndList) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescGZIP(), []int{6}
}

func (x *JwtRequirementAndList) GetRequirements() []*JwtRequirement {
	if x != nil {
		return x.Requirements
	}
	return nil
}

// This message specifies a Jwt requirement for a specific Route condition.
// Example 1:
//
// .. code-block:: yaml
//
//   - match:
//     prefix: /healthz
//
// In above example, "requires" field is empty for /healthz prefix match,
// it means that requests matching the path prefix don't require JWT authentication.
//
// Example 2:
//
// .. code-block:: yaml
//
//   - match:
//     prefix: /
//     requires: { provider_name: provider-A }
//
// In above example, all requests matched the path prefix require jwt authentication
// from "provider-A".
type RequirementRule struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The route matching parameter. Only when the match is satisfied, the "requires" field will
	// apply.
	//
	// For example: following match will match all requests.
	//
	// .. code-block:: yaml
	//
	//	match:
	//	  prefix: /
	Match *route.RouteMatch `protobuf:"bytes,1,opt,name=match,proto3" json:"match,omitempty"`
	// Specify a Jwt Requirement. Please detail comment in message JwtRequirement.
	Requires      *JwtRequirement `protobuf:"bytes,2,opt,name=requires,proto3" json:"requires,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RequirementRule) Reset() {
	*x = RequirementRule{}
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[7]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RequirementRule) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RequirementRule) ProtoMessage() {}

func (x *RequirementRule) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[7]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RequirementRule.ProtoReflect.Descriptor instead.
func (*RequirementRule) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescGZIP(), []int{7}
}

func (x *RequirementRule) GetMatch() *route.RouteMatch {
	if x != nil {
		return x.Match
	}
	return nil
}

func (x *RequirementRule) GetRequires() *JwtRequirement {
	if x != nil {
		return x.Requires
	}
	return nil
}

// This message specifies Jwt requirements based on stream_info.filterState.
// This FilterState should use `Router::StringAccessor` object to set a string value.
// Other HTTP filters can use it to specify Jwt requirements dynamically.
//
// Example:
//
// .. code-block:: yaml
//
//	name: jwt_selector
//	requires:
//	  issuer_1:
//	    provider_name: issuer1
//	  issuer_2:
//	    provider_name: issuer2
//
// If a filter set "jwt_selector" with "issuer_1" to FilterState for a request,
// jwt_authn filter will use JwtRequirement{"provider_name": "issuer1"} to verify.
type FilterStateRule struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The filter state name to retrieve the `Router::StringAccessor` object.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// A map of string keys to requirements. The string key is the string value
	// in the FilterState with the name specified in the *name* field above.
	Requires      map[string]*JwtRequirement `protobuf:"bytes,3,rep,name=requires,proto3" json:"requires,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *FilterStateRule) Reset() {
	*x = FilterStateRule{}
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[8]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *FilterStateRule) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*FilterStateRule) ProtoMessage() {}

func (x *FilterStateRule) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[8]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use FilterStateRule.ProtoReflect.Descriptor instead.
func (*FilterStateRule) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescGZIP(), []int{8}
}

func (x *FilterStateRule) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *FilterStateRule) GetRequires() map[string]*JwtRequirement {
	if x != nil {
		return x.Requires
	}
	return nil
}

// This is the Envoy HTTP filter config for JWT authentication.
//
// For example:
//
// .. code-block:: yaml
//
//	providers:
//	   provider1:
//	     issuer: issuer1
//	     audiences:
//	     - audience1
//	     - audience2
//	     remote_jwks:
//	       http_uri:
//	         uri: https://example.com/.well-known/jwks.json
//	         cluster: example_jwks_cluster
//	   provider2:
//	     issuer: issuer2
//	     local_jwks:
//	       inline_string: jwks_string
//
//	rules:
//	   # Not jwt verification is required for /health path
//	   - match:
//	       prefix: /health
//
//	   # Jwt verification for provider1 is required for path prefixed with "prefix"
//	   - match:
//	       prefix: /prefix
//	     requires:
//	       provider_name: provider1
//
//	   # Jwt verification for either provider1 or provider2 is required for all other requests.
//	   - match:
//	       prefix: /
//	     requires:
//	       requires_any:
//	         requirements:
//	           - provider_name: provider1
//	           - provider_name: provider2
type JwtAuthentication struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Map of provider names to JwtProviders.
	//
	// .. code-block:: yaml
	//
	//	providers:
	//	  provider1:
	//	     issuer: issuer1
	//	     audiences:
	//	     - audience1
	//	     - audience2
	//	     remote_jwks:
	//	       http_uri:
	//	         uri: https://example.com/.well-known/jwks.json
	//	         cluster: example_jwks_cluster
	//	   provider2:
	//	     issuer: provider2
	//	     local_jwks:
	//	       inline_string: jwks_string
	Providers map[string]*JwtProvider `protobuf:"bytes,1,rep,name=providers,proto3" json:"providers,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Specifies requirements based on the route matches. The first matched requirement will be
	// applied. If there are overlapped match conditions, please put the most specific match first.
	//
	// # Examples
	//
	// .. code-block:: yaml
	//
	//	rules:
	//	  - match:
	//	      prefix: /healthz
	//	  - match:
	//	      prefix: /baz
	//	    requires:
	//	      provider_name: provider1
	//	  - match:
	//	      prefix: /foo
	//	    requires:
	//	      requires_any:
	//	        requirements:
	//	          - provider_name: provider1
	//	          - provider_name: provider2
	//	  - match:
	//	      prefix: /bar
	//	    requires:
	//	      requires_all:
	//	        requirements:
	//	          - provider_name: provider1
	//	          - provider_name: provider2
	Rules []*RequirementRule `protobuf:"bytes,2,rep,name=rules,proto3" json:"rules,omitempty"`
	// This message specifies Jwt requirements based on stream_info.filterState.
	// Other HTTP filters can use it to specify Jwt requirements dynamically.
	// The *rules* field above is checked first, if it could not find any matches,
	// check this one.
	FilterStateRules *FilterStateRule `protobuf:"bytes,3,opt,name=filter_state_rules,json=filterStateRules,proto3" json:"filter_state_rules,omitempty"`
	// When set to true, bypass the `CORS preflight request
	// <http://www.w3.org/TR/cors/#cross-origin-request-with-preflight>`_ regardless of JWT
	// requirements specified in the rules.
	BypassCorsPreflight bool `protobuf:"varint,4,opt,name=bypass_cors_preflight,json=bypassCorsPreflight,proto3" json:"bypass_cors_preflight,omitempty"`
	unknownFields       protoimpl.UnknownFields
	sizeCache           protoimpl.SizeCache
}

func (x *JwtAuthentication) Reset() {
	*x = JwtAuthentication{}
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[9]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *JwtAuthentication) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*JwtAuthentication) ProtoMessage() {}

func (x *JwtAuthentication) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[9]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use JwtAuthentication.ProtoReflect.Descriptor instead.
func (*JwtAuthentication) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescGZIP(), []int{9}
}

func (x *JwtAuthentication) GetProviders() map[string]*JwtProvider {
	if x != nil {
		return x.Providers
	}
	return nil
}

func (x *JwtAuthentication) GetRules() []*RequirementRule {
	if x != nil {
		return x.Rules
	}
	return nil
}

func (x *JwtAuthentication) GetFilterStateRules() *FilterStateRule {
	if x != nil {
		return x.FilterStateRules
	}
	return nil
}

func (x *JwtAuthentication) GetBypassCorsPreflight() bool {
	if x != nil {
		return x.BypassCorsPreflight
	}
	return false
}

var File_envoy_config_filter_http_jwt_authn_v2alpha_config_proto protoreflect.FileDescriptor

const file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDesc = "" +
	"\n" +
	"7envoy/config/filter/http/jwt_authn/v2alpha/config.proto\x12*envoy.config.filter.http.jwt_authn.v2alpha\x1a\x1cenvoy/api/v2/core/base.proto\x1a envoy/api/v2/core/http_uri.proto\x1a)envoy/api/v2/route/route_components.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1eudpa/annotations/migrate.proto\x1a\x1dudpa/annotations/status.proto\x1a\x17validate/validate.proto\"\x80\x04\n" +
	"\vJwtProvider\x12\x1f\n" +
	"\x06issuer\x18\x01 \x01(\tB\a\xfaB\x04r\x02 \x01R\x06issuer\x12\x1c\n" +
	"\taudiences\x18\x02 \x03(\tR\taudiences\x12Y\n" +
	"\vremote_jwks\x18\x03 \x01(\v26.envoy.config.filter.http.jwt_authn.v2alpha.RemoteJwksH\x00R\n" +
	"remoteJwks\x12>\n" +
	"\n" +
	"local_jwks\x18\x04 \x01(\v2\x1d.envoy.api.v2.core.DataSourceH\x00R\tlocalJwks\x12\x18\n" +
	"\aforward\x18\x05 \x01(\bR\aforward\x12X\n" +
	"\ffrom_headers\x18\x06 \x03(\v25.envoy.config.filter.http.jwt_authn.v2alpha.JwtHeaderR\vfromHeaders\x12\x1f\n" +
	"\vfrom_params\x18\a \x03(\tR\n" +
	"fromParams\x124\n" +
	"\x16forward_payload_header\x18\b \x01(\tR\x14forwardPayloadHeader\x12.\n" +
	"\x13payload_in_metadata\x18\t \x01(\tR\x11payloadInMetadataB\x1c\n" +
	"\x15jwks_source_specifier\x12\x03\xf8B\x01\"\x85\x01\n" +
	"\n" +
	"RemoteJwks\x125\n" +
	"\bhttp_uri\x18\x01 \x01(\v2\x1a.envoy.api.v2.core.HttpUriR\ahttpUri\x12@\n" +
	"\x0ecache_duration\x18\x02 \x01(\v2\x19.google.protobuf.DurationR\rcacheDuration\"K\n" +
	"\tJwtHeader\x12\x1b\n" +
	"\x04name\x18\x01 \x01(\tB\a\xfaB\x04r\x02 \x01R\x04name\x12!\n" +
	"\fvalue_prefix\x18\x02 \x01(\tR\vvaluePrefix\"Z\n" +
	"\x15ProviderWithAudiences\x12#\n" +
	"\rprovider_name\x18\x01 \x01(\tR\fproviderName\x12\x1c\n" +
	"\taudiences\x18\x02 \x03(\tR\taudiences\"\xa2\x04\n" +
	"\x0eJwtRequirement\x12%\n" +
	"\rprovider_name\x18\x01 \x01(\tH\x00R\fproviderName\x12y\n" +
	"\x16provider_and_audiences\x18\x02 \x01(\v2A.envoy.config.filter.http.jwt_authn.v2alpha.ProviderWithAudiencesH\x00R\x14providerAndAudiences\x12e\n" +
	"\frequires_any\x18\x03 \x01(\v2@.envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementOrListH\x00R\vrequiresAny\x12f\n" +
	"\frequires_all\x18\x04 \x01(\v2A.envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementAndListH\x00R\vrequiresAll\x12O\n" +
	"\x17allow_missing_or_failed\x18\x05 \x01(\v2\x16.google.protobuf.EmptyH\x00R\x14allowMissingOrFailed\x12=\n" +
	"\rallow_missing\x18\x06 \x01(\v2\x16.google.protobuf.EmptyH\x00R\fallowMissingB\x0f\n" +
	"\rrequires_type\"\x80\x01\n" +
	"\x14JwtRequirementOrList\x12h\n" +
	"\frequirements\x18\x01 \x03(\v2:.envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementB\b\xfaB\x05\x92\x01\x02\b\x02R\frequirements\"\x81\x01\n" +
	"\x15JwtRequirementAndList\x12h\n" +
	"\frequirements\x18\x01 \x03(\v2:.envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementB\b\xfaB\x05\x92\x01\x02\b\x02R\frequirements\"\xa9\x01\n" +
	"\x0fRequirementRule\x12>\n" +
	"\x05match\x18\x01 \x01(\v2\x1e.envoy.api.v2.route.RouteMatchB\b\xfaB\x05\x8a\x01\x02\x10\x01R\x05match\x12V\n" +
	"\brequires\x18\x02 \x01(\v2:.envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementR\brequires\"\x8e\x02\n" +
	"\x0fFilterStateRule\x12\x1b\n" +
	"\x04name\x18\x01 \x01(\tB\a\xfaB\x04r\x02 \x01R\x04name\x12e\n" +
	"\brequires\x18\x03 \x03(\v2I.envoy.config.filter.http.jwt_authn.v2alpha.FilterStateRule.RequiresEntryR\brequires\x1aw\n" +
	"\rRequiresEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12P\n" +
	"\x05value\x18\x02 \x01(\v2:.envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementR\x05value:\x028\x01\"\xe8\x03\n" +
	"\x11JwtAuthentication\x12j\n" +
	"\tproviders\x18\x01 \x03(\v2L.envoy.config.filter.http.jwt_authn.v2alpha.JwtAuthentication.ProvidersEntryR\tproviders\x12Q\n" +
	"\x05rules\x18\x02 \x03(\v2;.envoy.config.filter.http.jwt_authn.v2alpha.RequirementRuleR\x05rules\x12i\n" +
	"\x12filter_state_rules\x18\x03 \x01(\v2;.envoy.config.filter.http.jwt_authn.v2alpha.FilterStateRuleR\x10filterStateRules\x122\n" +
	"\x15bypass_cors_preflight\x18\x04 \x01(\bR\x13bypassCorsPreflight\x1au\n" +
	"\x0eProvidersEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12M\n" +
	"\x05value\x18\x02 \x01(\v27.envoy.config.filter.http.jwt_authn.v2alpha.JwtProviderR\x05value:\x028\x01B\xd6\x01\xf2\x98\xfe\x8f\x05,\x12*envoy.extensions.filters.http.jwt_authn.v3\xba\x80\xc8\xd1\x06\x02\x10\x01\n" +
	"8io.envoyproxy.envoy.config.filter.http.jwt_authn.v2alphaB\vConfigProtoP\x01ZQgithub.com/envoyproxy/go-control-plane/envoy/config/filter/http/jwt_authn/v2alphab\x06proto3"

var (
	file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescOnce sync.Once
	file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescData []byte
)

func file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescGZIP() []byte {
	file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescOnce.Do(func() {
		file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDesc), len(file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDesc)))
	})
	return file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDescData
}

var file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
var file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_goTypes = []any{
	(*JwtProvider)(nil),           // 0: envoy.config.filter.http.jwt_authn.v2alpha.JwtProvider
	(*RemoteJwks)(nil),            // 1: envoy.config.filter.http.jwt_authn.v2alpha.RemoteJwks
	(*JwtHeader)(nil),             // 2: envoy.config.filter.http.jwt_authn.v2alpha.JwtHeader
	(*ProviderWithAudiences)(nil), // 3: envoy.config.filter.http.jwt_authn.v2alpha.ProviderWithAudiences
	(*JwtRequirement)(nil),        // 4: envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirement
	(*JwtRequirementOrList)(nil),  // 5: envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementOrList
	(*JwtRequirementAndList)(nil), // 6: envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementAndList
	(*RequirementRule)(nil),       // 7: envoy.config.filter.http.jwt_authn.v2alpha.RequirementRule
	(*FilterStateRule)(nil),       // 8: envoy.config.filter.http.jwt_authn.v2alpha.FilterStateRule
	(*JwtAuthentication)(nil),     // 9: envoy.config.filter.http.jwt_authn.v2alpha.JwtAuthentication
	nil,                           // 10: envoy.config.filter.http.jwt_authn.v2alpha.FilterStateRule.RequiresEntry
	nil,                           // 11: envoy.config.filter.http.jwt_authn.v2alpha.JwtAuthentication.ProvidersEntry
	(*core.DataSource)(nil),       // 12: envoy.api.v2.core.DataSource
	(*core.HttpUri)(nil),          // 13: envoy.api.v2.core.HttpUri
	(*durationpb.Duration)(nil),   // 14: google.protobuf.Duration
	(*emptypb.Empty)(nil),         // 15: google.protobuf.Empty
	(*route.RouteMatch)(nil),      // 16: envoy.api.v2.route.RouteMatch
}
var file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_depIdxs = []int32{
	1,  // 0: envoy.config.filter.http.jwt_authn.v2alpha.JwtProvider.remote_jwks:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.RemoteJwks
	12, // 1: envoy.config.filter.http.jwt_authn.v2alpha.JwtProvider.local_jwks:type_name -> envoy.api.v2.core.DataSource
	2,  // 2: envoy.config.filter.http.jwt_authn.v2alpha.JwtProvider.from_headers:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.JwtHeader
	13, // 3: envoy.config.filter.http.jwt_authn.v2alpha.RemoteJwks.http_uri:type_name -> envoy.api.v2.core.HttpUri
	14, // 4: envoy.config.filter.http.jwt_authn.v2alpha.RemoteJwks.cache_duration:type_name -> google.protobuf.Duration
	3,  // 5: envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirement.provider_and_audiences:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.ProviderWithAudiences
	5,  // 6: envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirement.requires_any:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementOrList
	6,  // 7: envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirement.requires_all:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementAndList
	15, // 8: envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirement.allow_missing_or_failed:type_name -> google.protobuf.Empty
	15, // 9: envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirement.allow_missing:type_name -> google.protobuf.Empty
	4,  // 10: envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementOrList.requirements:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirement
	4,  // 11: envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementAndList.requirements:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirement
	16, // 12: envoy.config.filter.http.jwt_authn.v2alpha.RequirementRule.match:type_name -> envoy.api.v2.route.RouteMatch
	4,  // 13: envoy.config.filter.http.jwt_authn.v2alpha.RequirementRule.requires:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirement
	10, // 14: envoy.config.filter.http.jwt_authn.v2alpha.FilterStateRule.requires:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.FilterStateRule.RequiresEntry
	11, // 15: envoy.config.filter.http.jwt_authn.v2alpha.JwtAuthentication.providers:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.JwtAuthentication.ProvidersEntry
	7,  // 16: envoy.config.filter.http.jwt_authn.v2alpha.JwtAuthentication.rules:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.RequirementRule
	8,  // 17: envoy.config.filter.http.jwt_authn.v2alpha.JwtAuthentication.filter_state_rules:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.FilterStateRule
	4,  // 18: envoy.config.filter.http.jwt_authn.v2alpha.FilterStateRule.RequiresEntry.value:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirement
	0,  // 19: envoy.config.filter.http.jwt_authn.v2alpha.JwtAuthentication.ProvidersEntry.value:type_name -> envoy.config.filter.http.jwt_authn.v2alpha.JwtProvider
	20, // [20:20] is the sub-list for method output_type
	20, // [20:20] is the sub-list for method input_type
	20, // [20:20] is the sub-list for extension type_name
	20, // [20:20] is the sub-list for extension extendee
	0,  // [0:20] is the sub-list for field type_name
}

func init() { file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_init() }
func file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_init() {
	if File_envoy_config_filter_http_jwt_authn_v2alpha_config_proto != nil {
		return
	}
	file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[0].OneofWrappers = []any{
		(*JwtProvider_RemoteJwks)(nil),
		(*JwtProvider_LocalJwks)(nil),
	}
	file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes[4].OneofWrappers = []any{
		(*JwtRequirement_ProviderName)(nil),
		(*JwtRequirement_ProviderAndAudiences)(nil),
		(*JwtRequirement_RequiresAny)(nil),
		(*JwtRequirement_RequiresAll)(nil),
		(*JwtRequirement_AllowMissingOrFailed)(nil),
		(*JwtRequirement_AllowMissing)(nil),
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDesc), len(file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_rawDesc)),
			NumEnums:      0,
			NumMessages:   12,
			NumExtensions: 0,
			NumServices:   0,
		},
		GoTypes:           file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_goTypes,
		DependencyIndexes: file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_depIdxs,
		MessageInfos:      file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_msgTypes,
	}.Build()
	File_envoy_config_filter_http_jwt_authn_v2alpha_config_proto = out.File
	file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_goTypes = nil
	file_envoy_config_filter_http_jwt_authn_v2alpha_config_proto_depIdxs = nil
}
