// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        v7.35.1
// source: envoy/config/filter/http/ext_authz/v2/ext_authz.proto

package ext_authzv2

import (
	_ "github.com/cncf/xds/go/udpa/annotations"
	_ "github.com/envoyproxy/go-control-plane/envoy/annotations"
	core "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
	_type "github.com/envoyproxy/go-control-plane/envoy/type"
	matcher "github.com/envoyproxy/go-control-plane/envoy/type/matcher"
	_ "github.com/envoyproxy/protoc-gen-validate/validate"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

// [#next-free-field: 12]
type ExtAuthz struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// External authorization service configuration.
	//
	// Types that are valid to be assigned to Services:
	//
	//	*ExtAuthz_GrpcService
	//	*ExtAuthz_HttpService
	Services isExtAuthz_Services `protobuf_oneof:"services"`
	//	Changes filter's behaviour on errors:
	//
	//	1. When set to true, the filter will *accept* client request even if the communication with
	//	the authorization service has failed, or if the authorization service has returned a HTTP 5xx
	//	error.
	//
	//	2. When set to false, ext-authz will *reject* client requests and return a *Forbidden*
	//	response if the communication with the authorization service has failed, or if the
	//	authorization service has returned a HTTP 5xx error.
	//
	// Note that errors can be *always* tracked in the :ref:`stats
	// <config_http_filters_ext_authz_stats>`.
	FailureModeAllow bool `protobuf:"varint,2,opt,name=failure_mode_allow,json=failureModeAllow,proto3" json:"failure_mode_allow,omitempty"`
	// [#not-implemented-hide: Support for this field has been removed.]
	//
	// Deprecated: Marked as deprecated in envoy/config/filter/http/ext_authz/v2/ext_authz.proto.
	UseAlpha bool `protobuf:"varint,4,opt,name=use_alpha,json=useAlpha,proto3" json:"use_alpha,omitempty"`
	// Enables filter to buffer the client request body and send it within the authorization request.
	// A “x-envoy-auth-partial-body: false|true“ metadata header will be added to the authorization
	// request message indicating if the body data is partial.
	WithRequestBody *BufferSettings `protobuf:"bytes,5,opt,name=with_request_body,json=withRequestBody,proto3" json:"with_request_body,omitempty"`
	// Clears route cache in order to allow the external authorization service to correctly affect
	// routing decisions. Filter clears all cached routes when:
	//
	// 1. The field is set to *true*.
	//
	// 2. The status returned from the authorization service is a HTTP 200 or gRPC 0.
	//
	// 3. At least one *authorization response header* is added to the client request, or is used for
	// altering another client request header.
	ClearRouteCache bool `protobuf:"varint,6,opt,name=clear_route_cache,json=clearRouteCache,proto3" json:"clear_route_cache,omitempty"`
	// Sets the HTTP status that is returned to the client when there is a network error between the
	// filter and the authorization server. The default status is HTTP 403 Forbidden.
	StatusOnError *_type.HttpStatus `protobuf:"bytes,7,opt,name=status_on_error,json=statusOnError,proto3" json:"status_on_error,omitempty"`
	// Specifies a list of metadata namespaces whose values, if present, will be passed to the
	// ext_authz service as an opaque *protobuf::Struct*.
	//
	// For example, if the *jwt_authn* filter is used and :ref:`payload_in_metadata
	// <envoy_api_field_config.filter.http.jwt_authn.v2alpha.JwtProvider.payload_in_metadata>` is set,
	// then the following will pass the jwt payload to the authorization server.
	//
	// .. code-block:: yaml
	//
	//	metadata_context_namespaces:
	//	- envoy.filters.http.jwt_authn
	MetadataContextNamespaces []string `protobuf:"bytes,8,rep,name=metadata_context_namespaces,json=metadataContextNamespaces,proto3" json:"metadata_context_namespaces,omitempty"`
	// Specifies if the filter is enabled.
	//
	// If :ref:`runtime_key <envoy_api_field_core.RuntimeFractionalPercent.runtime_key>` is specified,
	// Envoy will lookup the runtime key to get the percentage of requests to filter.
	//
	// If this field is not specified, the filter will be enabled for all requests.
	FilterEnabled *core.RuntimeFractionalPercent `protobuf:"bytes,9,opt,name=filter_enabled,json=filterEnabled,proto3" json:"filter_enabled,omitempty"`
	// Specifies whether to deny the requests, when the filter is disabled.
	// If :ref:`runtime_key <envoy_api_field_core.RuntimeFeatureFlag.runtime_key>` is specified,
	// Envoy will lookup the runtime key to determine whether to deny request for
	// filter protected path at filter disabling. If filter is disabled in
	// typed_per_filter_config for the path, requests will not be denied.
	//
	// If this field is not specified, all requests will be allowed when disabled.
	DenyAtDisable *core.RuntimeFeatureFlag `protobuf:"bytes,11,opt,name=deny_at_disable,json=denyAtDisable,proto3" json:"deny_at_disable,omitempty"`
	// Specifies if the peer certificate is sent to the external service.
	//
	// When this field is true, Envoy will include the peer X.509 certificate, if available, in the
	// :ref:`certificate<envoy_api_field_service.auth.v2.AttributeContext.Peer.certificate>`.
	IncludePeerCertificate bool `protobuf:"varint,10,opt,name=include_peer_certificate,json=includePeerCertificate,proto3" json:"include_peer_certificate,omitempty"`
	unknownFields          protoimpl.UnknownFields
	sizeCache              protoimpl.SizeCache
}

func (x *ExtAuthz) Reset() {
	*x = ExtAuthz{}
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExtAuthz) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExtAuthz) ProtoMessage() {}

func (x *ExtAuthz) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExtAuthz.ProtoReflect.Descriptor instead.
func (*ExtAuthz) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescGZIP(), []int{0}
}

func (x *ExtAuthz) GetServices() isExtAuthz_Services {
	if x != nil {
		return x.Services
	}
	return nil
}

func (x *ExtAuthz) GetGrpcService() *core.GrpcService {
	if x != nil {
		if x, ok := x.Services.(*ExtAuthz_GrpcService); ok {
			return x.GrpcService
		}
	}
	return nil
}

func (x *ExtAuthz) GetHttpService() *HttpService {
	if x != nil {
		if x, ok := x.Services.(*ExtAuthz_HttpService); ok {
			return x.HttpService
		}
	}
	return nil
}

func (x *ExtAuthz) GetFailureModeAllow() bool {
	if x != nil {
		return x.FailureModeAllow
	}
	return false
}

// Deprecated: Marked as deprecated in envoy/config/filter/http/ext_authz/v2/ext_authz.proto.
func (x *ExtAuthz) GetUseAlpha() bool {
	if x != nil {
		return x.UseAlpha
	}
	return false
}

func (x *ExtAuthz) GetWithRequestBody() *BufferSettings {
	if x != nil {
		return x.WithRequestBody
	}
	return nil
}

func (x *ExtAuthz) GetClearRouteCache() bool {
	if x != nil {
		return x.ClearRouteCache
	}
	return false
}

func (x *ExtAuthz) GetStatusOnError() *_type.HttpStatus {
	if x != nil {
		return x.StatusOnError
	}
	return nil
}

func (x *ExtAuthz) GetMetadataContextNamespaces() []string {
	if x != nil {
		return x.MetadataContextNamespaces
	}
	return nil
}

func (x *ExtAuthz) GetFilterEnabled() *core.RuntimeFractionalPercent {
	if x != nil {
		return x.FilterEnabled
	}
	return nil
}

func (x *ExtAuthz) GetDenyAtDisable() *core.RuntimeFeatureFlag {
	if x != nil {
		return x.DenyAtDisable
	}
	return nil
}

func (x *ExtAuthz) GetIncludePeerCertificate() bool {
	if x != nil {
		return x.IncludePeerCertificate
	}
	return false
}

type isExtAuthz_Services interface {
	isExtAuthz_Services()
}

type ExtAuthz_GrpcService struct {
	// gRPC service configuration (default timeout: 200ms).
	GrpcService *core.GrpcService `protobuf:"bytes,1,opt,name=grpc_service,json=grpcService,proto3,oneof"`
}

type ExtAuthz_HttpService struct {
	// HTTP service configuration (default timeout: 200ms).
	HttpService *HttpService `protobuf:"bytes,3,opt,name=http_service,json=httpService,proto3,oneof"`
}

func (*ExtAuthz_GrpcService) isExtAuthz_Services() {}

func (*ExtAuthz_HttpService) isExtAuthz_Services() {}

// Configuration for buffering the request data.
type BufferSettings struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sets the maximum size of a message body that the filter will hold in memory. Envoy will return
	// *HTTP 413* and will *not* initiate the authorization process when buffer reaches the number
	// set in this field. Note that this setting will have precedence over :ref:`failure_mode_allow
	// <envoy_api_field_config.filter.http.ext_authz.v2.ExtAuthz.failure_mode_allow>`.
	MaxRequestBytes uint32 `protobuf:"varint,1,opt,name=max_request_bytes,json=maxRequestBytes,proto3" json:"max_request_bytes,omitempty"`
	// When this field is true, Envoy will buffer the message until *max_request_bytes* is reached.
	// The authorization request will be dispatched and no 413 HTTP error will be returned by the
	// filter.
	AllowPartialMessage bool `protobuf:"varint,2,opt,name=allow_partial_message,json=allowPartialMessage,proto3" json:"allow_partial_message,omitempty"`
	unknownFields       protoimpl.UnknownFields
	sizeCache           protoimpl.SizeCache
}

func (x *BufferSettings) Reset() {
	*x = BufferSettings{}
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *BufferSettings) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*BufferSettings) ProtoMessage() {}

func (x *BufferSettings) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use BufferSettings.ProtoReflect.Descriptor instead.
func (*BufferSettings) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescGZIP(), []int{1}
}

func (x *BufferSettings) GetMaxRequestBytes() uint32 {
	if x != nil {
		return x.MaxRequestBytes
	}
	return 0
}

func (x *BufferSettings) GetAllowPartialMessage() bool {
	if x != nil {
		return x.AllowPartialMessage
	}
	return false
}

// HttpService is used for raw HTTP communication between the filter and the authorization service.
// When configured, the filter will parse the client request and use these attributes to call the
// authorization server. Depending on the response, the filter may reject or accept the client
// request. Note that in any of these events, metadata can be added, removed or overridden by the
// filter:
//
// *On authorization request*, a list of allowed request headers may be supplied. See
// :ref:`allowed_headers
// <envoy_api_field_config.filter.http.ext_authz.v2.AuthorizationRequest.allowed_headers>`
// for details. Additional headers metadata may be added to the authorization request. See
// :ref:`headers_to_add
// <envoy_api_field_config.filter.http.ext_authz.v2.AuthorizationRequest.headers_to_add>` for
// details.
//
// On authorization response status HTTP 200 OK, the filter will allow traffic to the upstream and
// additional headers metadata may be added to the original client request. See
// :ref:`allowed_upstream_headers
// <envoy_api_field_config.filter.http.ext_authz.v2.AuthorizationResponse.allowed_upstream_headers>`
// for details.
//
// On other authorization response statuses, the filter will not allow traffic. Additional headers
// metadata as well as body may be added to the client's response. See :ref:`allowed_client_headers
// <envoy_api_field_config.filter.http.ext_authz.v2.AuthorizationResponse.allowed_client_headers>`
// for details.
// [#next-free-field: 9]
type HttpService struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sets the HTTP server URI which the authorization requests must be sent to.
	ServerUri *core.HttpUri `protobuf:"bytes,1,opt,name=server_uri,json=serverUri,proto3" json:"server_uri,omitempty"`
	// Sets a prefix to the value of authorization request header *Path*.
	PathPrefix string `protobuf:"bytes,2,opt,name=path_prefix,json=pathPrefix,proto3" json:"path_prefix,omitempty"`
	// Settings used for controlling authorization request metadata.
	AuthorizationRequest *AuthorizationRequest `protobuf:"bytes,7,opt,name=authorization_request,json=authorizationRequest,proto3" json:"authorization_request,omitempty"`
	// Settings used for controlling authorization response metadata.
	AuthorizationResponse *AuthorizationResponse `protobuf:"bytes,8,opt,name=authorization_response,json=authorizationResponse,proto3" json:"authorization_response,omitempty"`
	unknownFields         protoimpl.UnknownFields
	sizeCache             protoimpl.SizeCache
}

func (x *HttpService) Reset() {
	*x = HttpService{}
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[2]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *HttpService) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*HttpService) ProtoMessage() {}

func (x *HttpService) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[2]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use HttpService.ProtoReflect.Descriptor instead.
func (*HttpService) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescGZIP(), []int{2}
}

func (x *HttpService) GetServerUri() *core.HttpUri {
	if x != nil {
		return x.ServerUri
	}
	return nil
}

func (x *HttpService) GetPathPrefix() string {
	if x != nil {
		return x.PathPrefix
	}
	return ""
}

func (x *HttpService) GetAuthorizationRequest() *AuthorizationRequest {
	if x != nil {
		return x.AuthorizationRequest
	}
	return nil
}

func (x *HttpService) GetAuthorizationResponse() *AuthorizationResponse {
	if x != nil {
		return x.AuthorizationResponse
	}
	return nil
}

type AuthorizationRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Authorization request will include the client request headers that have a correspondent match
	// in the :ref:`list <envoy_api_msg_type.matcher.ListStringMatcher>`. Note that in addition to the
	// user's supplied matchers:
	//
	// 1. *Host*, *Method*, *Path* and *Content-Length* are automatically included to the list.
	//
	// 2. *Content-Length* will be set to 0 and the request to the authorization service will not have
	// a message body. However, the authorization request can include the buffered client request body
	// (controlled by :ref:`with_request_body
	// <envoy_api_field_config.filter.http.ext_authz.v2.ExtAuthz.with_request_body>` setting),
	// consequently the value of *Content-Length* of the authorization request reflects the size of
	// its payload size.
	AllowedHeaders *matcher.ListStringMatcher `protobuf:"bytes,1,opt,name=allowed_headers,json=allowedHeaders,proto3" json:"allowed_headers,omitempty"`
	// Sets a list of headers that will be included to the request to authorization service. Note that
	// client request of the same key will be overridden.
	HeadersToAdd  []*core.HeaderValue `protobuf:"bytes,2,rep,name=headers_to_add,json=headersToAdd,proto3" json:"headers_to_add,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AuthorizationRequest) Reset() {
	*x = AuthorizationRequest{}
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[3]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AuthorizationRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AuthorizationRequest) ProtoMessage() {}

func (x *AuthorizationRequest) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[3]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AuthorizationRequest.ProtoReflect.Descriptor instead.
func (*AuthorizationRequest) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescGZIP(), []int{3}
}

func (x *AuthorizationRequest) GetAllowedHeaders() *matcher.ListStringMatcher {
	if x != nil {
		return x.AllowedHeaders
	}
	return nil
}

func (x *AuthorizationRequest) GetHeadersToAdd() []*core.HeaderValue {
	if x != nil {
		return x.HeadersToAdd
	}
	return nil
}

type AuthorizationResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// When this :ref:`list <envoy_api_msg_type.matcher.ListStringMatcher>` is set, authorization
	// response headers that have a correspondent match will be added to the original client request.
	// Note that coexistent headers will be overridden.
	AllowedUpstreamHeaders *matcher.ListStringMatcher `protobuf:"bytes,1,opt,name=allowed_upstream_headers,json=allowedUpstreamHeaders,proto3" json:"allowed_upstream_headers,omitempty"`
	// When this :ref:`list <envoy_api_msg_type.matcher.ListStringMatcher>` is set, authorization
	// response headers that have a correspondent match will be added to the client's response. Note
	// that when this list is *not* set, all the authorization response headers, except *Authority
	// (Host)* will be in the response to the client. When a header is included in this list, *Path*,
	// *Status*, *Content-Length*, *WWWAuthenticate* and *Location* are automatically added.
	AllowedClientHeaders *matcher.ListStringMatcher `protobuf:"bytes,2,opt,name=allowed_client_headers,json=allowedClientHeaders,proto3" json:"allowed_client_headers,omitempty"`
	unknownFields        protoimpl.UnknownFields
	sizeCache            protoimpl.SizeCache
}

func (x *AuthorizationResponse) Reset() {
	*x = AuthorizationResponse{}
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[4]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AuthorizationResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AuthorizationResponse) ProtoMessage() {}

func (x *AuthorizationResponse) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[4]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AuthorizationResponse.ProtoReflect.Descriptor instead.
func (*AuthorizationResponse) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescGZIP(), []int{4}
}

func (x *AuthorizationResponse) GetAllowedUpstreamHeaders() *matcher.ListStringMatcher {
	if x != nil {
		return x.AllowedUpstreamHeaders
	}
	return nil
}

func (x *AuthorizationResponse) GetAllowedClientHeaders() *matcher.ListStringMatcher {
	if x != nil {
		return x.AllowedClientHeaders
	}
	return nil
}

// Extra settings on a per virtualhost/route/weighted-cluster level.
type ExtAuthzPerRoute struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Override:
	//
	//	*ExtAuthzPerRoute_Disabled
	//	*ExtAuthzPerRoute_CheckSettings
	Override      isExtAuthzPerRoute_Override `protobuf_oneof:"override"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExtAuthzPerRoute) Reset() {
	*x = ExtAuthzPerRoute{}
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[5]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExtAuthzPerRoute) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExtAuthzPerRoute) ProtoMessage() {}

func (x *ExtAuthzPerRoute) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[5]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExtAuthzPerRoute.ProtoReflect.Descriptor instead.
func (*ExtAuthzPerRoute) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescGZIP(), []int{5}
}

func (x *ExtAuthzPerRoute) GetOverride() isExtAuthzPerRoute_Override {
	if x != nil {
		return x.Override
	}
	return nil
}

func (x *ExtAuthzPerRoute) GetDisabled() bool {
	if x != nil {
		if x, ok := x.Override.(*ExtAuthzPerRoute_Disabled); ok {
			return x.Disabled
		}
	}
	return false
}

func (x *ExtAuthzPerRoute) GetCheckSettings() *CheckSettings {
	if x != nil {
		if x, ok := x.Override.(*ExtAuthzPerRoute_CheckSettings); ok {
			return x.CheckSettings
		}
	}
	return nil
}

type isExtAuthzPerRoute_Override interface {
	isExtAuthzPerRoute_Override()
}

type ExtAuthzPerRoute_Disabled struct {
	// Disable the ext auth filter for this particular vhost or route.
	// If disabled is specified in multiple per-filter-configs, the most specific one will be used.
	Disabled bool `protobuf:"varint,1,opt,name=disabled,proto3,oneof"`
}

type ExtAuthzPerRoute_CheckSettings struct {
	// Check request settings for this route.
	CheckSettings *CheckSettings `protobuf:"bytes,2,opt,name=check_settings,json=checkSettings,proto3,oneof"`
}

func (*ExtAuthzPerRoute_Disabled) isExtAuthzPerRoute_Override() {}

func (*ExtAuthzPerRoute_CheckSettings) isExtAuthzPerRoute_Override() {}

// Extra settings for the check request. You can use this to provide extra context for the
// external authorization server on specific virtual hosts \ routes. For example, adding a context
// extension on the virtual host level can give the ext-authz server information on what virtual
// host is used without needing to parse the host header. If CheckSettings is specified in multiple
// per-filter-configs, they will be merged in order, and the result will be used.
type CheckSettings struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Context extensions to set on the CheckRequest's
	// :ref:`AttributeContext.context_extensions<envoy_api_field_service.auth.v2.AttributeContext.context_extensions>`
	//
	// Merge semantics for this field are such that keys from more specific configs override.
	//
	// .. note::
	//
	//	These settings are only applied to a filter configured with a
	//	:ref:`grpc_service<envoy_api_field_config.filter.http.ext_authz.v2.ExtAuthz.grpc_service>`.
	ContextExtensions map[string]string `protobuf:"bytes,1,rep,name=context_extensions,json=contextExtensions,proto3" json:"context_extensions,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields     protoimpl.UnknownFields
	sizeCache         protoimpl.SizeCache
}

func (x *CheckSettings) Reset() {
	*x = CheckSettings{}
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[6]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CheckSettings) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CheckSettings) ProtoMessage() {}

func (x *CheckSettings) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[6]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CheckSettings.ProtoReflect.Descriptor instead.
func (*CheckSettings) Descriptor() ([]byte, []int) {
	return file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescGZIP(), []int{6}
}

func (x *CheckSettings) GetContextExtensions() map[string]string {
	if x != nil {
		return x.ContextExtensions
	}
	return nil
}

var File_envoy_config_filter_http_ext_authz_v2_ext_authz_proto protoreflect.FileDescriptor

const file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDesc = "" +
	"\n" +
	"5envoy/config/filter/http/ext_authz/v2/ext_authz.proto\x12%envoy.config.filter.http.ext_authz.v2\x1a\x1cenvoy/api/v2/core/base.proto\x1a$envoy/api/v2/core/grpc_service.proto\x1a envoy/api/v2/core/http_uri.proto\x1a\x1cenvoy/type/http_status.proto\x1a\x1fenvoy/type/matcher/string.proto\x1a#envoy/annotations/deprecation.proto\x1a\x1eudpa/annotations/migrate.proto\x1a\x1dudpa/annotations/status.proto\x1a\x17validate/validate.proto\"\xf5\x05\n" +
	"\bExtAuthz\x12C\n" +
	"\fgrpc_service\x18\x01 \x01(\v2\x1e.envoy.api.v2.core.GrpcServiceH\x00R\vgrpcService\x12W\n" +
	"\fhttp_service\x18\x03 \x01(\v22.envoy.config.filter.http.ext_authz.v2.HttpServiceH\x00R\vhttpService\x12,\n" +
	"\x12failure_mode_allow\x18\x02 \x01(\bR\x10failureModeAllow\x12%\n" +
	"\tuse_alpha\x18\x04 \x01(\bB\b\xb8\xee\xf2\xd2\x05\x01\x18\x01R\buseAlpha\x12a\n" +
	"\x11with_request_body\x18\x05 \x01(\v25.envoy.config.filter.http.ext_authz.v2.BufferSettingsR\x0fwithRequestBody\x12*\n" +
	"\x11clear_route_cache\x18\x06 \x01(\bR\x0fclearRouteCache\x12>\n" +
	"\x0fstatus_on_error\x18\a \x01(\v2\x16.envoy.type.HttpStatusR\rstatusOnError\x12>\n" +
	"\x1bmetadata_context_namespaces\x18\b \x03(\tR\x19metadataContextNamespaces\x12R\n" +
	"\x0efilter_enabled\x18\t \x01(\v2+.envoy.api.v2.core.RuntimeFractionalPercentR\rfilterEnabled\x12M\n" +
	"\x0fdeny_at_disable\x18\v \x01(\v2%.envoy.api.v2.core.RuntimeFeatureFlagR\rdenyAtDisable\x128\n" +
	"\x18include_peer_certificate\x18\n" +
	" \x01(\bR\x16includePeerCertificateB\n" +
	"\n" +
	"\bservices\"y\n" +
	"\x0eBufferSettings\x123\n" +
	"\x11max_request_bytes\x18\x01 \x01(\rB\a\xfaB\x04*\x02 \x00R\x0fmaxRequestBytes\x122\n" +
	"\x15allow_partial_message\x18\x02 \x01(\bR\x13allowPartialMessage\"\xe8\x02\n" +
	"\vHttpService\x129\n" +
	"\n" +
	"server_uri\x18\x01 \x01(\v2\x1a.envoy.api.v2.core.HttpUriR\tserverUri\x12\x1f\n" +
	"\vpath_prefix\x18\x02 \x01(\tR\n" +
	"pathPrefix\x12p\n" +
	"\x15authorization_request\x18\a \x01(\v2;.envoy.config.filter.http.ext_authz.v2.AuthorizationRequestR\x14authorizationRequest\x12s\n" +
	"\x16authorization_response\x18\b \x01(\v2<.envoy.config.filter.http.ext_authz.v2.AuthorizationResponseR\x15authorizationResponseJ\x04\b\x03\x10\x04J\x04\b\x04\x10\x05J\x04\b\x05\x10\x06J\x04\b\x06\x10\a\"\xac\x01\n" +
	"\x14AuthorizationRequest\x12N\n" +
	"\x0fallowed_headers\x18\x01 \x01(\v2%.envoy.type.matcher.ListStringMatcherR\x0eallowedHeaders\x12D\n" +
	"\x0eheaders_to_add\x18\x02 \x03(\v2\x1e.envoy.api.v2.core.HeaderValueR\fheadersToAdd\"\xd5\x01\n" +
	"\x15AuthorizationResponse\x12_\n" +
	"\x18allowed_upstream_headers\x18\x01 \x01(\v2%.envoy.type.matcher.ListStringMatcherR\x16allowedUpstreamHeaders\x12[\n" +
	"\x16allowed_client_headers\x18\x02 \x01(\v2%.envoy.type.matcher.ListStringMatcherR\x14allowedClientHeaders\"\xb3\x01\n" +
	"\x10ExtAuthzPerRoute\x12%\n" +
	"\bdisabled\x18\x01 \x01(\bB\a\xfaB\x04j\x02\b\x01H\x00R\bdisabled\x12g\n" +
	"\x0echeck_settings\x18\x02 \x01(\v24.envoy.config.filter.http.ext_authz.v2.CheckSettingsB\b\xfaB\x05\x8a\x01\x02\x10\x01H\x00R\rcheckSettingsB\x0f\n" +
	"\boverride\x12\x03\xf8B\x01\"\xd1\x01\n" +
	"\rCheckSettings\x12z\n" +
	"\x12context_extensions\x18\x01 \x03(\v2K.envoy.config.filter.http.ext_authz.v2.CheckSettings.ContextExtensionsEntryR\x11contextExtensions\x1aD\n" +
	"\x16ContextExtensionsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\xda\x01\xf2\x98\xfe\x8f\x05,\x12*envoy.extensions.filters.http.ext_authz.v3\xba\x80\xc8\xd1\x06\x02\x10\x01\n" +
	"3io.envoyproxy.envoy.config.filter.http.ext_authz.v2B\rExtAuthzProtoP\x01ZXgithub.com/envoyproxy/go-control-plane/envoy/config/filter/http/ext_authz/v2;ext_authzv2b\x06proto3"

var (
	file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescOnce sync.Once
	file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescData []byte
)

func file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescGZIP() []byte {
	file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescOnce.Do(func() {
		file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDesc), len(file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDesc)))
	})
	return file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDescData
}

var file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
var file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_goTypes = []any{
	(*ExtAuthz)(nil),                      // 0: envoy.config.filter.http.ext_authz.v2.ExtAuthz
	(*BufferSettings)(nil),                // 1: envoy.config.filter.http.ext_authz.v2.BufferSettings
	(*HttpService)(nil),                   // 2: envoy.config.filter.http.ext_authz.v2.HttpService
	(*AuthorizationRequest)(nil),          // 3: envoy.config.filter.http.ext_authz.v2.AuthorizationRequest
	(*AuthorizationResponse)(nil),         // 4: envoy.config.filter.http.ext_authz.v2.AuthorizationResponse
	(*ExtAuthzPerRoute)(nil),              // 5: envoy.config.filter.http.ext_authz.v2.ExtAuthzPerRoute
	(*CheckSettings)(nil),                 // 6: envoy.config.filter.http.ext_authz.v2.CheckSettings
	nil,                                   // 7: envoy.config.filter.http.ext_authz.v2.CheckSettings.ContextExtensionsEntry
	(*core.GrpcService)(nil),              // 8: envoy.api.v2.core.GrpcService
	(*_type.HttpStatus)(nil),              // 9: envoy.type.HttpStatus
	(*core.RuntimeFractionalPercent)(nil), // 10: envoy.api.v2.core.RuntimeFractionalPercent
	(*core.RuntimeFeatureFlag)(nil),       // 11: envoy.api.v2.core.RuntimeFeatureFlag
	(*core.HttpUri)(nil),                  // 12: envoy.api.v2.core.HttpUri
	(*matcher.ListStringMatcher)(nil),     // 13: envoy.type.matcher.ListStringMatcher
	(*core.HeaderValue)(nil),              // 14: envoy.api.v2.core.HeaderValue
}
var file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_depIdxs = []int32{
	8,  // 0: envoy.config.filter.http.ext_authz.v2.ExtAuthz.grpc_service:type_name -> envoy.api.v2.core.GrpcService
	2,  // 1: envoy.config.filter.http.ext_authz.v2.ExtAuthz.http_service:type_name -> envoy.config.filter.http.ext_authz.v2.HttpService
	1,  // 2: envoy.config.filter.http.ext_authz.v2.ExtAuthz.with_request_body:type_name -> envoy.config.filter.http.ext_authz.v2.BufferSettings
	9,  // 3: envoy.config.filter.http.ext_authz.v2.ExtAuthz.status_on_error:type_name -> envoy.type.HttpStatus
	10, // 4: envoy.config.filter.http.ext_authz.v2.ExtAuthz.filter_enabled:type_name -> envoy.api.v2.core.RuntimeFractionalPercent
	11, // 5: envoy.config.filter.http.ext_authz.v2.ExtAuthz.deny_at_disable:type_name -> envoy.api.v2.core.RuntimeFeatureFlag
	12, // 6: envoy.config.filter.http.ext_authz.v2.HttpService.server_uri:type_name -> envoy.api.v2.core.HttpUri
	3,  // 7: envoy.config.filter.http.ext_authz.v2.HttpService.authorization_request:type_name -> envoy.config.filter.http.ext_authz.v2.AuthorizationRequest
	4,  // 8: envoy.config.filter.http.ext_authz.v2.HttpService.authorization_response:type_name -> envoy.config.filter.http.ext_authz.v2.AuthorizationResponse
	13, // 9: envoy.config.filter.http.ext_authz.v2.AuthorizationRequest.allowed_headers:type_name -> envoy.type.matcher.ListStringMatcher
	14, // 10: envoy.config.filter.http.ext_authz.v2.AuthorizationRequest.headers_to_add:type_name -> envoy.api.v2.core.HeaderValue
	13, // 11: envoy.config.filter.http.ext_authz.v2.AuthorizationResponse.allowed_upstream_headers:type_name -> envoy.type.matcher.ListStringMatcher
	13, // 12: envoy.config.filter.http.ext_authz.v2.AuthorizationResponse.allowed_client_headers:type_name -> envoy.type.matcher.ListStringMatcher
	6,  // 13: envoy.config.filter.http.ext_authz.v2.ExtAuthzPerRoute.check_settings:type_name -> envoy.config.filter.http.ext_authz.v2.CheckSettings
	7,  // 14: envoy.config.filter.http.ext_authz.v2.CheckSettings.context_extensions:type_name -> envoy.config.filter.http.ext_authz.v2.CheckSettings.ContextExtensionsEntry
	15, // [15:15] is the sub-list for method output_type
	15, // [15:15] is the sub-list for method input_type
	15, // [15:15] is the sub-list for extension type_name
	15, // [15:15] is the sub-list for extension extendee
	0,  // [0:15] is the sub-list for field type_name
}

func init() { file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_init() }
func file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_init() {
	if File_envoy_config_filter_http_ext_authz_v2_ext_authz_proto != nil {
		return
	}
	file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[0].OneofWrappers = []any{
		(*ExtAuthz_GrpcService)(nil),
		(*ExtAuthz_HttpService)(nil),
	}
	file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes[5].OneofWrappers = []any{
		(*ExtAuthzPerRoute_Disabled)(nil),
		(*ExtAuthzPerRoute_CheckSettings)(nil),
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDesc), len(file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_rawDesc)),
			NumEnums:      0,
			NumMessages:   8,
			NumExtensions: 0,
			NumServices:   0,
		},
		GoTypes:           file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_goTypes,
		DependencyIndexes: file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_depIdxs,
		MessageInfos:      file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_msgTypes,
	}.Build()
	File_envoy_config_filter_http_ext_authz_v2_ext_authz_proto = out.File
	file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_goTypes = nil
	file_envoy_config_filter_http_ext_authz_v2_ext_authz_proto_depIdxs = nil
}
