// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        v7.35.1
// source: envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto

package ext_authzv3

import (
	_ "github.com/cncf/xds/go/udpa/annotations"
	_ "github.com/envoyproxy/go-control-plane/envoy/annotations"
	v33 "github.com/envoyproxy/go-control-plane/envoy/config/common/mutation_rules/v3"
	v3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	v32 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
	v31 "github.com/envoyproxy/go-control-plane/envoy/type/v3"
	_ "github.com/envoyproxy/protoc-gen-validate/validate"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	structpb "google.golang.org/protobuf/types/known/structpb"
	wrapperspb "google.golang.org/protobuf/types/known/wrapperspb"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

// The decision the auth server returned.
type ShadowDecision_CheckResult int32

const (
	ShadowDecision_UNSPECIFIED ShadowDecision_CheckResult = 0
	ShadowDecision_OK          ShadowDecision_CheckResult = 1
	ShadowDecision_DENIED      ShadowDecision_CheckResult = 2
	ShadowDecision_ERROR       ShadowDecision_CheckResult = 3
)

// Enum value maps for ShadowDecision_CheckResult.
var (
	ShadowDecision_CheckResult_name = map[int32]string{
		0: "UNSPECIFIED",
		1: "OK",
		2: "DENIED",
		3: "ERROR",
	}
	ShadowDecision_CheckResult_value = map[string]int32{
		"UNSPECIFIED": 0,
		"OK":          1,
		"DENIED":      2,
		"ERROR":       3,
	}
)

func (x ShadowDecision_CheckResult) Enum() *ShadowDecision_CheckResult {
	p := new(ShadowDecision_CheckResult)
	*p = x
	return p
}

func (x ShadowDecision_CheckResult) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ShadowDecision_CheckResult) Descriptor() protoreflect.EnumDescriptor {
	return file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_enumTypes[0].Descriptor()
}

func (ShadowDecision_CheckResult) Type() protoreflect.EnumType {
	return &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_enumTypes[0]
}

func (x ShadowDecision_CheckResult) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ShadowDecision_CheckResult.Descriptor instead.
func (ShadowDecision_CheckResult) EnumDescriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescGZIP(), []int{1, 0}
}

// [#next-free-field: 33]
type ExtAuthz struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// External authorization service configuration.
	//
	// Types that are valid to be assigned to Services:
	//
	//	*ExtAuthz_GrpcService
	//	*ExtAuthz_HttpService
	Services isExtAuthz_Services `protobuf_oneof:"services"`
	// API version for ext_authz transport protocol. This describes the ext_authz gRPC endpoint and
	// version of messages used on the wire.
	TransportApiVersion v3.ApiVersion `protobuf:"varint,12,opt,name=transport_api_version,json=transportApiVersion,proto3,enum=envoy.config.core.v3.ApiVersion" json:"transport_api_version,omitempty"`
	// Changes the filter's behavior on errors:
	//
	//   - When set to “true“, the filter will “accept“ the client request even if communication with
	//     the authorization service has failed, or if the authorization service has returned an HTTP 5xx
	//     error.
	//
	//   - When set to “false“, the filter will “reject“ client requests and return “Forbidden“
	//     if communication with the authorization service has failed, or if the authorization service
	//     has returned an HTTP 5xx error.
	//
	// Errors can always be tracked in the :ref:`stats <config_http_filters_ext_authz_stats>`.
	//
	// Defaults to “false“.
	FailureModeAllow bool `protobuf:"varint,2,opt,name=failure_mode_allow,json=failureModeAllow,proto3" json:"failure_mode_allow,omitempty"`
	// When “failure_mode_allow“ and “failure_mode_allow_header_add“ are both set to “true“,
	// “x-envoy-auth-failure-mode-allowed: true“ will be added to request headers if the communication
	// with the authorization service has failed, or if the authorization service has returned a
	// HTTP 5xx error.
	FailureModeAllowHeaderAdd bool `protobuf:"varint,19,opt,name=failure_mode_allow_header_add,json=failureModeAllowHeaderAdd,proto3" json:"failure_mode_allow_header_add,omitempty"`
	// Enables the filter to buffer the client request body and send it within the authorization request.
	// The “x-envoy-auth-partial-body: false|true“ metadata header will be added to the authorization
	// request indicating whether the body data is partial.
	WithRequestBody *BufferSettings `protobuf:"bytes,5,opt,name=with_request_body,json=withRequestBody,proto3" json:"with_request_body,omitempty"`
	// Clears the route cache in order to allow the external authorization service to correctly affect
	// routing decisions. The filter clears all cached routes when all of the following holds:
	//
	//   - This field is set to “true“.
	//   - The status returned from the authorization service is an HTTP 200 or gRPC 0.
	//   - At least one “authorization response header“ is added to the client request, or is used to
	//     alter another client request header.
	//
	// Defaults to “false“.
	//
	// .. attention::
	//
	//	Enabling this option can cause Envoy to recompute route matching after earlier HTTP filters
	//	have already processed the request. This can be security-sensitive when route-dependent
	//	authorization filters, such as the RBAC filter, run before ext_authz.
	//
	//	Operators should avoid enabling this option for authorization services that are not fully
	//	trusted to influence routing. When possible, filters that mutate route-matching inputs and
	//	clear the route cache should run before route-dependent authorization filters. Operators can
	//	also use decoder_header_mutation_rules to restrict sensitive request header mutations.
	ClearRouteCache bool `protobuf:"varint,6,opt,name=clear_route_cache,json=clearRouteCache,proto3" json:"clear_route_cache,omitempty"`
	// Sets the HTTP status that is returned to the client when the authorization server returns an error
	// or cannot be reached.
	//
	// The default status is “HTTP 403 Forbidden“.
	StatusOnError *v31.HttpStatus `protobuf:"bytes,7,opt,name=status_on_error,json=statusOnError,proto3" json:"status_on_error,omitempty"`
	// When set to “true“, the filter will check the :ref:`ext_authz response
	// <envoy_v3_api_msg_service.auth.v3.CheckResponse>` for invalid header and
	// query parameter mutations. If the response is invalid, the filter will send a local reply
	// to the downstream request with status “HTTP 500 Internal Server Error“.
	//
	// .. note::
	//
	//	Both ``headers_to_remove`` and ``query_parameters_to_remove`` are validated, but invalid elements in
	//	those fields should not affect any headers and thus will not cause the filter to send a local reply.
	//
	// When set to “false“, any invalid mutations will be visible to the rest of Envoy and may cause
	// unexpected behavior.
	//
	// If you are using ext_authz with an untrusted ext_authz server, you should set this to “true“.
	//
	// Defaults to “false“.
	ValidateMutations bool `protobuf:"varint,24,opt,name=validate_mutations,json=validateMutations,proto3" json:"validate_mutations,omitempty"`
	// Specifies a list of metadata namespaces whose values, if present, will be passed to the
	// ext_authz service. The :ref:`filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.filter_metadata>`
	// is passed as an opaque “protobuf::Struct“.
	//
	// .. note::
	//
	//	This field applies exclusively to the gRPC ext_authz service and has no effect on the HTTP service.
	//
	// For example, if the “jwt_authn“ filter is used and :ref:`payload_in_metadata
	// <envoy_v3_api_field_extensions.filters.http.jwt_authn.v3.JwtProvider.payload_in_metadata>` is set,
	// then the following will pass the jwt payload to the authorization server.
	//
	// .. code-block:: yaml
	//
	//	metadata_context_namespaces:
	//	- envoy.filters.http.jwt_authn
	MetadataContextNamespaces []string `protobuf:"bytes,8,rep,name=metadata_context_namespaces,json=metadataContextNamespaces,proto3" json:"metadata_context_namespaces,omitempty"`
	// Specifies a list of metadata namespaces whose values, if present, will be passed to the
	// ext_authz service. :ref:`typed_filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.typed_filter_metadata>`
	// is passed as a “protobuf::Any“.
	//
	// .. note::
	//
	//	This field applies exclusively to the gRPC ext_authz service and has no effect on the HTTP service.
	//
	// This works similarly to “metadata_context_namespaces“ but allows Envoy and the ext_authz server to share
	// the protobuf message definition in order to perform safe parsing.
	TypedMetadataContextNamespaces []string `protobuf:"bytes,16,rep,name=typed_metadata_context_namespaces,json=typedMetadataContextNamespaces,proto3" json:"typed_metadata_context_namespaces,omitempty"`
	// Specifies a list of route metadata namespaces whose values, if present, will be passed to the
	// ext_authz service at :ref:`route_metadata_context <envoy_v3_api_field_service.auth.v3.AttributeContext.route_metadata_context>` in
	// :ref:`CheckRequest <envoy_v3_api_field_service.auth.v3.CheckRequest.attributes>`.
	// :ref:`filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.filter_metadata>` is passed as an opaque “protobuf::Struct“.
	RouteMetadataContextNamespaces []string `protobuf:"bytes,21,rep,name=route_metadata_context_namespaces,json=routeMetadataContextNamespaces,proto3" json:"route_metadata_context_namespaces,omitempty"`
	// Specifies a list of route metadata namespaces whose values, if present, will be passed to the
	// ext_authz service at :ref:`route_metadata_context <envoy_v3_api_field_service.auth.v3.AttributeContext.route_metadata_context>` in
	// :ref:`CheckRequest <envoy_v3_api_field_service.auth.v3.CheckRequest.attributes>`.
	// :ref:`typed_filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.typed_filter_metadata>` is passed as a “protobuf::Any“.
	RouteTypedMetadataContextNamespaces []string `protobuf:"bytes,22,rep,name=route_typed_metadata_context_namespaces,json=routeTypedMetadataContextNamespaces,proto3" json:"route_typed_metadata_context_namespaces,omitempty"`
	// Specifies if the filter is enabled.
	//
	// If :ref:`runtime_key <envoy_v3_api_field_config.core.v3.RuntimeFractionalPercent.runtime_key>` is specified,
	// Envoy will lookup the runtime key to get the percentage of requests to filter.
	//
	// If this field is not specified, the filter will be enabled for all requests.
	FilterEnabled *v3.RuntimeFractionalPercent `protobuf:"bytes,9,opt,name=filter_enabled,json=filterEnabled,proto3" json:"filter_enabled,omitempty"`
	// Specifies if the filter is enabled with metadata matcher.
	// If this field is not specified, the filter will be enabled for all requests.
	//
	// .. note::
	//
	//	This field is only evaluated if the filter is instantiated. If the filter is marked with
	//	``disabled: true`` in the :ref:`HttpFilter
	//	<envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.HttpFilter>`
	//	configuration or in per-route configuration via :ref:`ExtAuthzPerRoute
	//	<envoy_v3_api_msg_extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute>`,
	//	the filter will not be instantiated and this field will have no effect.
	//
	// .. tip::
	//
	//	For dynamic filter activation based on metadata (such as metadata set by a preceding
	//	filter), consider using :ref:`ExtensionWithMatcher
	//	<envoy_v3_api_msg_extensions.common.matching.v3.ExtensionWithMatcher>` instead. This
	//	provides a more flexible matching framework that can evaluate conditions before filter
	//	instantiation. See the :ref:`ext_authz filter documentation
	//	<config_http_filters_ext_authz>` for examples.
	FilterEnabledMetadata *v32.MetadataMatcher `protobuf:"bytes,14,opt,name=filter_enabled_metadata,json=filterEnabledMetadata,proto3" json:"filter_enabled_metadata,omitempty"`
	// Specifies whether to deny the requests when the filter is disabled.
	// If :ref:`runtime_key <envoy_v3_api_field_config.core.v3.RuntimeFeatureFlag.runtime_key>` is specified,
	// Envoy will lookup the runtime key to determine whether to deny requests for filter-protected paths
	// when the filter is disabled. If the filter is disabled in “typed_per_filter_config“ for the path,
	// requests will not be denied.
	//
	// If this field is not specified, all requests will be allowed when disabled.
	//
	// If a request is denied due to this setting, the response code in :ref:`status_on_error
	// <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.status_on_error>` will
	// be returned.
	DenyAtDisable *v3.RuntimeFeatureFlag `protobuf:"bytes,11,opt,name=deny_at_disable,json=denyAtDisable,proto3" json:"deny_at_disable,omitempty"`
	// Specifies if the peer certificate is sent to the external service.
	//
	// When this field is “true“, Envoy will include the peer X.509 certificate, if available, in the
	// :ref:`certificate<envoy_v3_api_field_service.auth.v3.AttributeContext.Peer.certificate>`.
	IncludePeerCertificate bool `protobuf:"varint,10,opt,name=include_peer_certificate,json=includePeerCertificate,proto3" json:"include_peer_certificate,omitempty"`
	// Optional additional prefix to use when emitting statistics. This allows distinguishing
	// emitted statistics between configured “ext_authz“ filters in an HTTP filter chain. For example:
	//
	// .. code-block:: yaml
	//
	//	http_filters:
	//	  - name: envoy.filters.http.ext_authz
	//	    typed_config:
	//	      "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
	//	      stat_prefix: waf # This emits ext_authz.waf.ok, ext_authz.waf.denied, etc.
	//	  - name: envoy.filters.http.ext_authz
	//	    typed_config:
	//	      "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
	//	      stat_prefix: blocker # This emits ext_authz.blocker.ok, ext_authz.blocker.denied, etc.
	StatPrefix string `protobuf:"bytes,13,opt,name=stat_prefix,json=statPrefix,proto3" json:"stat_prefix,omitempty"`
	// Optional labels that will be passed to :ref:`labels<envoy_v3_api_field_service.auth.v3.AttributeContext.Peer.labels>` in
	// :ref:`destination<envoy_v3_api_field_service.auth.v3.AttributeContext.destination>`.
	// The labels will be read from :ref:`metadata<envoy_v3_api_msg_config.core.v3.Node>` with the specified key.
	BootstrapMetadataLabelsKey string `protobuf:"bytes,15,opt,name=bootstrap_metadata_labels_key,json=bootstrapMetadataLabelsKey,proto3" json:"bootstrap_metadata_labels_key,omitempty"`
	// Check request to authorization server will include the client request headers that have a correspondent match
	// in the list. If this option isn't specified, then
	// all client request headers are included in the check request to a gRPC authorization server, whereas no client request headers
	// (besides the ones allowed by default - see note below) are included in the check request to an HTTP authorization server.
	// This inconsistency between gRPC and HTTP servers is to maintain backwards compatibility with legacy behavior.
	//
	// .. note::
	//
	//	For requests to an HTTP authorization server: in addition to the user's supplied matchers, ``Host``, ``Method``, ``Path``,
	//	``Content-Length``, and ``Authorization`` are **additionally included** in the list.
	//
	// .. note::
	//
	//	For requests to an HTTP authorization server: the value of ``Content-Length`` will be set to ``0`` and the request to the
	//	authorization server will not have a message body. However, the check request can include the buffered
	//	client request body (controlled by :ref:`with_request_body
	//	<envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.with_request_body>` setting);
	//	consequently, the value of ``Content-Length`` in the authorization request reflects the size of its payload.
	//
	// .. note::
	//
	//	This can be overridden by the field ``disallowed_headers`` below. That is, if a header
	//	matches for both ``allowed_headers`` and ``disallowed_headers``, the header will NOT be sent.
	AllowedHeaders *v32.ListStringMatcher `protobuf:"bytes,17,opt,name=allowed_headers,json=allowedHeaders,proto3" json:"allowed_headers,omitempty"`
	// If set, specifically disallow any header in this list to be forwarded to the external
	// authentication server. This overrides the above “allowed_headers“ if a header matches both.
	DisallowedHeaders *v32.ListStringMatcher `protobuf:"bytes,25,opt,name=disallowed_headers,json=disallowedHeaders,proto3" json:"disallowed_headers,omitempty"`
	// Specifies if the TLS session level details like SNI are sent to the external service.
	//
	// When this field is “true“, Envoy will include the SNI name used for TLSClientHello, if available, in the
	// :ref:`tls_session<envoy_v3_api_field_service.auth.v3.AttributeContext.tls_session>`.
	IncludeTlsSession bool `protobuf:"varint,18,opt,name=include_tls_session,json=includeTlsSession,proto3" json:"include_tls_session,omitempty"`
	// Whether to increment cluster statistics (e.g. cluster.<cluster_name>.upstream_rq_*) on authorization failure.
	// Defaults to “true“.
	ChargeClusterResponseStats *wrapperspb.BoolValue `protobuf:"bytes,20,opt,name=charge_cluster_response_stats,json=chargeClusterResponseStats,proto3" json:"charge_cluster_response_stats,omitempty"`
	// Whether to encode the raw headers (i.e., unsanitized values and unconcatenated multi-line headers)
	// in the authorization request. Works with both HTTP and gRPC clients.
	//
	// When this is set to “true“, header values are not sanitized. Headers with the same key will also
	// not be combined into a single, comma-separated header.
	// Requests to gRPC services will populate the field
	// :ref:`header_map<envoy_v3_api_field_service.auth.v3.AttributeContext.HttpRequest.header_map>`.
	// Requests to HTTP services will be constructed with the unsanitized header values and preserved
	// multi-line headers with the same key.
	//
	// If this field is set to “false“, header values will be sanitized, with any non-UTF-8-compliant
	// bytes replaced with “'!'“. Headers with the same key will have their values concatenated into a
	// single comma-separated header value.
	// Requests to gRPC services will populate the field
	// :ref:`headers<envoy_v3_api_field_service.auth.v3.AttributeContext.HttpRequest.headers>`.
	// Requests to HTTP services will have their header values sanitized and will not preserve
	// multi-line headers with the same key.
	//
	// It is recommended to set this to “true“ unless you rely on the previous behavior.
	//
	// It is set to “false“ by default for backwards compatibility.
	EncodeRawHeaders bool `protobuf:"varint,23,opt,name=encode_raw_headers,json=encodeRawHeaders,proto3" json:"encode_raw_headers,omitempty"`
	// Rules for what modifications an ext_authz server may make to the request headers before
	// continuing decoding or forwarding upstream.
	//
	// If set, enables header mutation checking against the configured rules. Note that
	// :ref:`HeaderMutationRules <envoy_v3_api_msg_config.common.mutation_rules.v3.HeaderMutationRules>`
	// has defaults that change ext_authz behavior. Also note that if this field is set,
	// ext_authz can no longer append to “:“-prefixed headers.
	//
	// If unset, header mutation rule checking is completely disabled.
	//
	// Regardless of what is configured here, ext_authz cannot remove “:“-prefixed headers.
	//
	// This field and “validate_mutations“ have different use cases. “validate_mutations“ enables
	// correctness checks for all header and query parameter mutations (for example, invalid characters).
	// This field allows the filter to reject mutations to specific headers.
	DecoderHeaderMutationRules *v33.HeaderMutationRules `protobuf:"bytes,26,opt,name=decoder_header_mutation_rules,json=decoderHeaderMutationRules,proto3" json:"decoder_header_mutation_rules,omitempty"`
	// Enable or disable ingestion of dynamic metadata from the ext_authz service.
	//
	// If “false“, the filter will ignore dynamic metadata injected by the ext_authz service. If the
	// ext_authz service tries injecting dynamic metadata, the filter will log, increment the
	// “ignored_dynamic_metadata“ stat, then continue handling the response.
	//
	// If “true“, the filter will ingest dynamic metadata entries as normal.
	//
	// If unset, defaults to “true“.
	EnableDynamicMetadataIngestion *wrapperspb.BoolValue `protobuf:"bytes,27,opt,name=enable_dynamic_metadata_ingestion,json=enableDynamicMetadataIngestion,proto3" json:"enable_dynamic_metadata_ingestion,omitempty"`
	// Additional metadata to be added to the filter state for logging purposes. The metadata will be
	// added to StreamInfo's filter state under the namespace corresponding to the ext_authz filter
	// name.
	FilterMetadata *structpb.Struct `protobuf:"bytes,28,opt,name=filter_metadata,json=filterMetadata,proto3" json:"filter_metadata,omitempty"`
	// When set to “true“, the filter will emit per-stream stats for access logging. The filter state
	// key will be the same as the filter name.
	//
	// If using Envoy gRPC, emits latency, bytes sent / received, upstream info, and upstream cluster
	// info. If not using Envoy gRPC, emits only latency.
	//
	// .. note::
	//
	//	Stats are ONLY added to filter state if a check request is actually made to an ext_authz service.
	//
	// If this is “false“ the filter will not emit stats, but filter_metadata will still be respected if
	// it has a value.
	//
	// Field “latency_us“ is exposed for CEL and logging when using gRPC or HTTP service.
	// Fields “bytesSent“ and “bytesReceived“ are exposed for CEL and logging only when using gRPC service.
	EmitFilterStateStats bool `protobuf:"varint,29,opt,name=emit_filter_state_stats,json=emitFilterStateStats,proto3" json:"emit_filter_state_stats,omitempty"`
	// Sets the maximum size (in bytes) of the response body that the filter will send downstream
	// when a request is denied by the external authorization service.
	//
	// If the authorization server returns a response body larger than this configured limit,
	// the body will be truncated to “max_denied_response_body_bytes“ before being sent to the
	// downstream client.
	//
	// If this field is not set or is set to 0, no truncation will occur, and the entire
	// denied response body will be forwarded.
	MaxDeniedResponseBodyBytes uint32 `protobuf:"varint,30,opt,name=max_denied_response_body_bytes,json=maxDeniedResponseBodyBytes,proto3" json:"max_denied_response_body_bytes,omitempty"`
	// When set to “true“, the filter will enforce the response header map's count and size limits
	// by sending a local reply when those limits are violated.
	//
	// When set to “false“, the filter will ignore the response header map's limits and add / set
	// all response headers as specified by the external authorization service.
	//
	// Recommendation: enable if the external authorization service is not trusted. Otherwise, leave
	// it “false“.
	//
	// Defaults to “false“.
	EnforceResponseHeaderLimits bool `protobuf:"varint,31,opt,name=enforce_response_header_limits,json=enforceResponseHeaderLimits,proto3" json:"enforce_response_header_limits,omitempty"`
	// When set to “true“, the filter operates in shadow mode. In shadow mode the
	// filter still calls the external authorization service and processes the response,
	// but never terminates the request. Instead of sending a local reply on a denied or
	// error response, the filter writes the authorization decision (engine result, status
	// code, response headers) into the request's
	// :ref:`FilterState <arch_overview_data_sharing_between_filters>` as a
	// :ref:`ShadowDecision
	// <envoy_v3_api_msg_extensions.filters.http.ext_authz.v3.ShadowDecision>` object so
	// that subsequent filters can read and optionally enforce it.
	//
	// The FilterState key is the filter's configured “name“ in the filter chain with a
	// “.shadow“ suffix (“envoy.filters.http.ext_authz.shadow“ by default). Multiple ext_authz
	// filters in the same chain must already have distinct names and therefore write to distinct
	// keys automatically.
	//
	// The auth server's denied-response body is intentionally **not** carried on the
	// ShadowDecision: bodies can be arbitrarily large and no downstream consumer in the
	// shadow-comparison flow needs them. A consumer that wants to reproduce the auth
	// server's full denied response must read it from its own source of truth rather
	// than replaying it from FilterState.
	//
	// Header and query-parameter mutations from an OK response are still applied to the
	// request as usual.
	//
	// Defaults to “false“.
	ShadowMode    bool `protobuf:"varint,32,opt,name=shadow_mode,json=shadowMode,proto3" json:"shadow_mode,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExtAuthz) Reset() {
	*x = ExtAuthz{}
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExtAuthz) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExtAuthz) ProtoMessage() {}

func (x *ExtAuthz) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExtAuthz.ProtoReflect.Descriptor instead.
func (*ExtAuthz) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescGZIP(), []int{0}
}

func (x *ExtAuthz) GetServices() isExtAuthz_Services {
	if x != nil {
		return x.Services
	}
	return nil
}

func (x *ExtAuthz) GetGrpcService() *v3.GrpcService {
	if x != nil {
		if x, ok := x.Services.(*ExtAuthz_GrpcService); ok {
			return x.GrpcService
		}
	}
	return nil
}

func (x *ExtAuthz) GetHttpService() *HttpService {
	if x != nil {
		if x, ok := x.Services.(*ExtAuthz_HttpService); ok {
			return x.HttpService
		}
	}
	return nil
}

func (x *ExtAuthz) GetTransportApiVersion() v3.ApiVersion {
	if x != nil {
		return x.TransportApiVersion
	}
	return v3.ApiVersion(0)
}

func (x *ExtAuthz) GetFailureModeAllow() bool {
	if x != nil {
		return x.FailureModeAllow
	}
	return false
}

func (x *ExtAuthz) GetFailureModeAllowHeaderAdd() bool {
	if x != nil {
		return x.FailureModeAllowHeaderAdd
	}
	return false
}

func (x *ExtAuthz) GetWithRequestBody() *BufferSettings {
	if x != nil {
		return x.WithRequestBody
	}
	return nil
}

func (x *ExtAuthz) GetClearRouteCache() bool {
	if x != nil {
		return x.ClearRouteCache
	}
	return false
}

func (x *ExtAuthz) GetStatusOnError() *v31.HttpStatus {
	if x != nil {
		return x.StatusOnError
	}
	return nil
}

func (x *ExtAuthz) GetValidateMutations() bool {
	if x != nil {
		return x.ValidateMutations
	}
	return false
}

func (x *ExtAuthz) GetMetadataContextNamespaces() []string {
	if x != nil {
		return x.MetadataContextNamespaces
	}
	return nil
}

func (x *ExtAuthz) GetTypedMetadataContextNamespaces() []string {
	if x != nil {
		return x.TypedMetadataContextNamespaces
	}
	return nil
}

func (x *ExtAuthz) GetRouteMetadataContextNamespaces() []string {
	if x != nil {
		return x.RouteMetadataContextNamespaces
	}
	return nil
}

func (x *ExtAuthz) GetRouteTypedMetadataContextNamespaces() []string {
	if x != nil {
		return x.RouteTypedMetadataContextNamespaces
	}
	return nil
}

func (x *ExtAuthz) GetFilterEnabled() *v3.RuntimeFractionalPercent {
	if x != nil {
		return x.FilterEnabled
	}
	return nil
}

func (x *ExtAuthz) GetFilterEnabledMetadata() *v32.MetadataMatcher {
	if x != nil {
		return x.FilterEnabledMetadata
	}
	return nil
}

func (x *ExtAuthz) GetDenyAtDisable() *v3.RuntimeFeatureFlag {
	if x != nil {
		return x.DenyAtDisable
	}
	return nil
}

func (x *ExtAuthz) GetIncludePeerCertificate() bool {
	if x != nil {
		return x.IncludePeerCertificate
	}
	return false
}

func (x *ExtAuthz) GetStatPrefix() string {
	if x != nil {
		return x.StatPrefix
	}
	return ""
}

func (x *ExtAuthz) GetBootstrapMetadataLabelsKey() string {
	if x != nil {
		return x.BootstrapMetadataLabelsKey
	}
	return ""
}

func (x *ExtAuthz) GetAllowedHeaders() *v32.ListStringMatcher {
	if x != nil {
		return x.AllowedHeaders
	}
	return nil
}

func (x *ExtAuthz) GetDisallowedHeaders() *v32.ListStringMatcher {
	if x != nil {
		return x.DisallowedHeaders
	}
	return nil
}

func (x *ExtAuthz) GetIncludeTlsSession() bool {
	if x != nil {
		return x.IncludeTlsSession
	}
	return false
}

func (x *ExtAuthz) GetChargeClusterResponseStats() *wrapperspb.BoolValue {
	if x != nil {
		return x.ChargeClusterResponseStats
	}
	return nil
}

func (x *ExtAuthz) GetEncodeRawHeaders() bool {
	if x != nil {
		return x.EncodeRawHeaders
	}
	return false
}

func (x *ExtAuthz) GetDecoderHeaderMutationRules() *v33.HeaderMutationRules {
	if x != nil {
		return x.DecoderHeaderMutationRules
	}
	return nil
}

func (x *ExtAuthz) GetEnableDynamicMetadataIngestion() *wrapperspb.BoolValue {
	if x != nil {
		return x.EnableDynamicMetadataIngestion
	}
	return nil
}

func (x *ExtAuthz) GetFilterMetadata() *structpb.Struct {
	if x != nil {
		return x.FilterMetadata
	}
	return nil
}

func (x *ExtAuthz) GetEmitFilterStateStats() bool {
	if x != nil {
		return x.EmitFilterStateStats
	}
	return false
}

func (x *ExtAuthz) GetMaxDeniedResponseBodyBytes() uint32 {
	if x != nil {
		return x.MaxDeniedResponseBodyBytes
	}
	return 0
}

func (x *ExtAuthz) GetEnforceResponseHeaderLimits() bool {
	if x != nil {
		return x.EnforceResponseHeaderLimits
	}
	return false
}

func (x *ExtAuthz) GetShadowMode() bool {
	if x != nil {
		return x.ShadowMode
	}
	return false
}

type isExtAuthz_Services interface {
	isExtAuthz_Services()
}

type ExtAuthz_GrpcService struct {
	// gRPC service configuration (default timeout: 200ms).
	GrpcService *v3.GrpcService `protobuf:"bytes,1,opt,name=grpc_service,json=grpcService,proto3,oneof"`
}

type ExtAuthz_HttpService struct {
	// HTTP service configuration (default timeout: 200ms).
	HttpService *HttpService `protobuf:"bytes,3,opt,name=http_service,json=httpService,proto3,oneof"`
}

func (*ExtAuthz_GrpcService) isExtAuthz_Services() {}

func (*ExtAuthz_HttpService) isExtAuthz_Services() {}

// Serialized form of the shadow-mode authorization decision written to FilterState
// when :ref:`shadow_mode
// <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.shadow_mode>` is
// enabled. Consumed by a downstream filter that decides whether to enforce the
// decision.
type ShadowDecision struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The decision the auth server returned.
	CheckResult ShadowDecision_CheckResult `protobuf:"varint,1,opt,name=check_result,json=checkResult,proto3,enum=envoy.extensions.filters.http.ext_authz.v3.ShadowDecision_CheckResult" json:"check_result,omitempty"`
	// Response status code associated with the decision. For “DENIED“ and “ERROR“ this is
	// the code the filter would have set on termination (the auth server's code for “DENIED“,
	// or :ref:`status_on_error
	// <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.status_on_error>` fallback
	// for “ERROR“). For “OK“ this defaults to “200“ so consumers always see a populated
	// value — the upstream response code is not known at shadow-decision time.
	StatusCode uint32 `protobuf:"varint,2,opt,name=status_code,json=statusCode,proto3" json:"status_code,omitempty"`
	// Response headers the auth server asked to set on a denied response
	// (e.g. “WWW-Authenticate“, “Set-Cookie“). Populated for “DENIED“ only.
	// Preserves ordering and duplicate header names.
	ResponseHeaders []*v3.HeaderValue `protobuf:"bytes,3,rep,name=response_headers,json=responseHeaders,proto3" json:"response_headers,omitempty"`
	unknownFields   protoimpl.UnknownFields
	sizeCache       protoimpl.SizeCache
}

func (x *ShadowDecision) Reset() {
	*x = ShadowDecision{}
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ShadowDecision) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ShadowDecision) ProtoMessage() {}

func (x *ShadowDecision) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ShadowDecision.ProtoReflect.Descriptor instead.
func (*ShadowDecision) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescGZIP(), []int{1}
}

func (x *ShadowDecision) GetCheckResult() ShadowDecision_CheckResult {
	if x != nil {
		return x.CheckResult
	}
	return ShadowDecision_UNSPECIFIED
}

func (x *ShadowDecision) GetStatusCode() uint32 {
	if x != nil {
		return x.StatusCode
	}
	return 0
}

func (x *ShadowDecision) GetResponseHeaders() []*v3.HeaderValue {
	if x != nil {
		return x.ResponseHeaders
	}
	return nil
}

// Configuration for buffering the request data.
type BufferSettings struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sets the maximum size of a message body that the filter will hold in memory. Envoy will return
	// “HTTP 413“ and will *not* initiate the authorization process when the buffer reaches the size
	// set in this field.
	//
	// .. note::
	//
	//	This setting will have precedence over :ref:`failure_mode_allow
	//	<envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.failure_mode_allow>`.
	MaxRequestBytes uint32 `protobuf:"varint,1,opt,name=max_request_bytes,json=maxRequestBytes,proto3" json:"max_request_bytes,omitempty"`
	// When this field is “true“, Envoy will buffer the message until “max_request_bytes“ is reached.
	// The authorization request will be dispatched and no 413 HTTP error will be returned by the
	// filter.
	//
	// Defaults to “false“.
	AllowPartialMessage bool `protobuf:"varint,2,opt,name=allow_partial_message,json=allowPartialMessage,proto3" json:"allow_partial_message,omitempty"`
	// If “true“, the body sent to the external authorization service is set as raw bytes and populates
	// :ref:`raw_body<envoy_v3_api_field_service.auth.v3.AttributeContext.HttpRequest.raw_body>`
	// in the HTTP request attribute context. Otherwise, :ref:`body
	// <envoy_v3_api_field_service.auth.v3.AttributeContext.HttpRequest.body>` will be populated
	// with a UTF-8 string request body.
	//
	// This field only affects configurations using a :ref:`grpc_service
	// <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.grpc_service>`. In configurations that use
	// an :ref:`http_service <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.http_service>`, this
	// has no effect.
	//
	// Defaults to “false“.
	PackAsBytes   bool `protobuf:"varint,3,opt,name=pack_as_bytes,json=packAsBytes,proto3" json:"pack_as_bytes,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *BufferSettings) Reset() {
	*x = BufferSettings{}
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[2]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *BufferSettings) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*BufferSettings) ProtoMessage() {}

func (x *BufferSettings) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[2]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use BufferSettings.ProtoReflect.Descriptor instead.
func (*BufferSettings) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescGZIP(), []int{2}
}

func (x *BufferSettings) GetMaxRequestBytes() uint32 {
	if x != nil {
		return x.MaxRequestBytes
	}
	return 0
}

func (x *BufferSettings) GetAllowPartialMessage() bool {
	if x != nil {
		return x.AllowPartialMessage
	}
	return false
}

func (x *BufferSettings) GetPackAsBytes() bool {
	if x != nil {
		return x.PackAsBytes
	}
	return false
}

// HttpService is used for raw HTTP communication between the filter and the authorization service.
// When configured, the filter will parse the client request and use these attributes to call the
// authorization server. Depending on the response, the filter may reject or accept the client
// request.
//
// .. note::
//
//	In any of these events, metadata can be added, removed or overridden by the filter:
//
// On authorization request, a list of allowed request headers may be supplied. See
// :ref:`allowed_headers
// <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.AuthorizationRequest.allowed_headers>`
// for details. Additional headers metadata may be added to the authorization request. See
// :ref:`headers_to_add
// <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.AuthorizationRequest.headers_to_add>` for
// details.
//
// On authorization response status “HTTP 200 OK“, the filter will allow traffic to the upstream and
// additional headers metadata may be added to the original client request. See
// :ref:`allowed_upstream_headers
// <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.AuthorizationResponse.allowed_upstream_headers>`
// for details. Additionally, the filter may add additional headers to the client's response. See
// :ref:`allowed_client_headers_on_success
// <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.AuthorizationResponse.allowed_client_headers_on_success>`
// for details.
//
// On other authorization response statuses, the filter will not allow traffic. Additional headers
// metadata as well as body may be added to the client's response. See :ref:`allowed_client_headers
// <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.AuthorizationResponse.allowed_client_headers>`
// for details.
// [#next-free-field: 11]
type HttpService struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sets the HTTP server URI which the authorization requests must be sent to.
	ServerUri *v3.HttpUri `protobuf:"bytes,1,opt,name=server_uri,json=serverUri,proto3" json:"server_uri,omitempty"`
	// Sets a prefix to the value of authorization request header “Path“.
	// Only one of “path_prefix“ or “path_override“ may be set.
	PathPrefix string `protobuf:"bytes,2,opt,name=path_prefix,json=pathPrefix,proto3" json:"path_prefix,omitempty"`
	// Replaces the value of authorization request header “Path“ with this value.
	// Only one of “path_prefix“ or “path_override“ may be set.
	PathOverride string `protobuf:"bytes,10,opt,name=path_override,json=pathOverride,proto3" json:"path_override,omitempty"`
	// Settings used for controlling authorization request metadata.
	AuthorizationRequest *AuthorizationRequest `protobuf:"bytes,7,opt,name=authorization_request,json=authorizationRequest,proto3" json:"authorization_request,omitempty"`
	// Settings used for controlling authorization response metadata.
	AuthorizationResponse *AuthorizationResponse `protobuf:"bytes,8,opt,name=authorization_response,json=authorizationResponse,proto3" json:"authorization_response,omitempty"`
	// Optional retry policy for requests to the authorization server.
	// If not set, no retries will be performed.
	//
	// .. note::
	//
	//	When this field is set, the ``ext_authz`` filter will buffer the request body for retry purposes.
	RetryPolicy   *v3.RetryPolicy `protobuf:"bytes,9,opt,name=retry_policy,json=retryPolicy,proto3" json:"retry_policy,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *HttpService) Reset() {
	*x = HttpService{}
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[3]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *HttpService) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*HttpService) ProtoMessage() {}

func (x *HttpService) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[3]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use HttpService.ProtoReflect.Descriptor instead.
func (*HttpService) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescGZIP(), []int{3}
}

func (x *HttpService) GetServerUri() *v3.HttpUri {
	if x != nil {
		return x.ServerUri
	}
	return nil
}

func (x *HttpService) GetPathPrefix() string {
	if x != nil {
		return x.PathPrefix
	}
	return ""
}

func (x *HttpService) GetPathOverride() string {
	if x != nil {
		return x.PathOverride
	}
	return ""
}

func (x *HttpService) GetAuthorizationRequest() *AuthorizationRequest {
	if x != nil {
		return x.AuthorizationRequest
	}
	return nil
}

func (x *HttpService) GetAuthorizationResponse() *AuthorizationResponse {
	if x != nil {
		return x.AuthorizationResponse
	}
	return nil
}

func (x *HttpService) GetRetryPolicy() *v3.RetryPolicy {
	if x != nil {
		return x.RetryPolicy
	}
	return nil
}

type AuthorizationRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Authorization request includes the client request headers that have a corresponding match
	// in the list.
	// This field has been deprecated in favor of :ref:`allowed_headers
	// <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.allowed_headers>`.
	//
	// .. note::
	//
	//	In addition to the user's supplied matchers, ``Host``, ``Method``, ``Path``,
	//	``Content-Length``, and ``Authorization`` are **automatically included** in the list.
	//
	// .. note::
	//
	//	By default, the ``Content-Length`` header is set to ``0`` and the request to the authorization
	//	service has no message body. However, the authorization request *may* include the buffered
	//	client request body (controlled by :ref:`with_request_body
	//	<envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.with_request_body>`
	//	setting); hence the value of its ``Content-Length`` reflects the size of its payload.
	//
	// Deprecated: Marked as deprecated in envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto.
	AllowedHeaders *v32.ListStringMatcher `protobuf:"bytes,1,opt,name=allowed_headers,json=allowedHeaders,proto3" json:"allowed_headers,omitempty"`
	// Sets a list of headers that will be included in the request to the authorization service.
	//
	// .. note::
	//
	//	Client request headers with the same key will be overridden.
	HeadersToAdd  []*v3.HeaderValue `protobuf:"bytes,2,rep,name=headers_to_add,json=headersToAdd,proto3" json:"headers_to_add,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AuthorizationRequest) Reset() {
	*x = AuthorizationRequest{}
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[4]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AuthorizationRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AuthorizationRequest) ProtoMessage() {}

func (x *AuthorizationRequest) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[4]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AuthorizationRequest.ProtoReflect.Descriptor instead.
func (*AuthorizationRequest) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescGZIP(), []int{4}
}

// Deprecated: Marked as deprecated in envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto.
func (x *AuthorizationRequest) GetAllowedHeaders() *v32.ListStringMatcher {
	if x != nil {
		return x.AllowedHeaders
	}
	return nil
}

func (x *AuthorizationRequest) GetHeadersToAdd() []*v3.HeaderValue {
	if x != nil {
		return x.HeadersToAdd
	}
	return nil
}

// [#next-free-field: 6]
type AuthorizationResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// When this list is set, authorization
	// response headers that have a correspondent match will be added to the original client request.
	//
	// .. note::
	//
	//	Existing headers will be overridden.
	AllowedUpstreamHeaders *v32.ListStringMatcher `protobuf:"bytes,1,opt,name=allowed_upstream_headers,json=allowedUpstreamHeaders,proto3" json:"allowed_upstream_headers,omitempty"`
	// When this list is set, authorization
	// response headers that have a correspondent match will be added to the original client request.
	//
	// .. note::
	//
	//	Existing headers will be appended.
	AllowedUpstreamHeadersToAppend *v32.ListStringMatcher `protobuf:"bytes,3,opt,name=allowed_upstream_headers_to_append,json=allowedUpstreamHeadersToAppend,proto3" json:"allowed_upstream_headers_to_append,omitempty"`
	// When this list is set, authorization
	// response headers that have a correspondent match will be added to the client's response.
	// When a header is included in this list, “Path“, “Status“, “Content-Length“, “WWW-Authenticate“ and
	// “Location“ are automatically added.
	//
	// .. note::
	//
	//	When this list is *not* set, all the authorization response headers, except
	//	``Authority (Host)``, will be in the response to the client.
	AllowedClientHeaders *v32.ListStringMatcher `protobuf:"bytes,2,opt,name=allowed_client_headers,json=allowedClientHeaders,proto3" json:"allowed_client_headers,omitempty"`
	// When this list is set, authorization
	// response headers that have a correspondent match will be added to the client's response when
	// the authorization response itself is successful, i.e. not failed or denied. When this list is
	// *not* set, no additional headers will be added to the client's response on success.
	AllowedClientHeadersOnSuccess *v32.ListStringMatcher `protobuf:"bytes,4,opt,name=allowed_client_headers_on_success,json=allowedClientHeadersOnSuccess,proto3" json:"allowed_client_headers_on_success,omitempty"`
	// When this list is set, authorization
	// response headers that have a correspondent match will be emitted as dynamic metadata to be consumed
	// by the next filter. This metadata lives in a namespace specified by the canonical name of extension filter
	// that requires it:
	//
	// - :ref:`envoy.filters.http.ext_authz <config_http_filters_ext_authz_dynamic_metadata>` for HTTP filter.
	// - :ref:`envoy.filters.network.ext_authz <config_network_filters_ext_authz_dynamic_metadata>` for network filter.
	DynamicMetadataFromHeaders *v32.ListStringMatcher `protobuf:"bytes,5,opt,name=dynamic_metadata_from_headers,json=dynamicMetadataFromHeaders,proto3" json:"dynamic_metadata_from_headers,omitempty"`
	unknownFields              protoimpl.UnknownFields
	sizeCache                  protoimpl.SizeCache
}

func (x *AuthorizationResponse) Reset() {
	*x = AuthorizationResponse{}
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[5]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AuthorizationResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AuthorizationResponse) ProtoMessage() {}

func (x *AuthorizationResponse) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[5]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AuthorizationResponse.ProtoReflect.Descriptor instead.
func (*AuthorizationResponse) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescGZIP(), []int{5}
}

func (x *AuthorizationResponse) GetAllowedUpstreamHeaders() *v32.ListStringMatcher {
	if x != nil {
		return x.AllowedUpstreamHeaders
	}
	return nil
}

func (x *AuthorizationResponse) GetAllowedUpstreamHeadersToAppend() *v32.ListStringMatcher {
	if x != nil {
		return x.AllowedUpstreamHeadersToAppend
	}
	return nil
}

func (x *AuthorizationResponse) GetAllowedClientHeaders() *v32.ListStringMatcher {
	if x != nil {
		return x.AllowedClientHeaders
	}
	return nil
}

func (x *AuthorizationResponse) GetAllowedClientHeadersOnSuccess() *v32.ListStringMatcher {
	if x != nil {
		return x.AllowedClientHeadersOnSuccess
	}
	return nil
}

func (x *AuthorizationResponse) GetDynamicMetadataFromHeaders() *v32.ListStringMatcher {
	if x != nil {
		return x.DynamicMetadataFromHeaders
	}
	return nil
}

// Extra settings on a per virtualhost/route/weighted-cluster level.
type ExtAuthzPerRoute struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Override:
	//
	//	*ExtAuthzPerRoute_Disabled
	//	*ExtAuthzPerRoute_CheckSettings
	Override      isExtAuthzPerRoute_Override `protobuf_oneof:"override"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExtAuthzPerRoute) Reset() {
	*x = ExtAuthzPerRoute{}
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[6]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExtAuthzPerRoute) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExtAuthzPerRoute) ProtoMessage() {}

func (x *ExtAuthzPerRoute) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[6]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExtAuthzPerRoute.ProtoReflect.Descriptor instead.
func (*ExtAuthzPerRoute) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescGZIP(), []int{6}
}

func (x *ExtAuthzPerRoute) GetOverride() isExtAuthzPerRoute_Override {
	if x != nil {
		return x.Override
	}
	return nil
}

func (x *ExtAuthzPerRoute) GetDisabled() bool {
	if x != nil {
		if x, ok := x.Override.(*ExtAuthzPerRoute_Disabled); ok {
			return x.Disabled
		}
	}
	return false
}

func (x *ExtAuthzPerRoute) GetCheckSettings() *CheckSettings {
	if x != nil {
		if x, ok := x.Override.(*ExtAuthzPerRoute_CheckSettings); ok {
			return x.CheckSettings
		}
	}
	return nil
}

type isExtAuthzPerRoute_Override interface {
	isExtAuthzPerRoute_Override()
}

type ExtAuthzPerRoute_Disabled struct {
	// Disable the ext auth filter for this particular vhost or route.
	// If disabled is specified in multiple per-filter-configs, the most specific one will be used.
	// If the filter is disabled by default and this is set to “false“, the filter will be enabled
	// for this vhost or route.
	Disabled bool `protobuf:"varint,1,opt,name=disabled,proto3,oneof"`
}

type ExtAuthzPerRoute_CheckSettings struct {
	// Check request settings for this route.
	CheckSettings *CheckSettings `protobuf:"bytes,2,opt,name=check_settings,json=checkSettings,proto3,oneof"`
}

func (*ExtAuthzPerRoute_Disabled) isExtAuthzPerRoute_Override() {}

func (*ExtAuthzPerRoute_CheckSettings) isExtAuthzPerRoute_Override() {}

// Extra settings for the check request.
// [#next-free-field: 6]
type CheckSettings struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Context extensions to set on the CheckRequest's
	// :ref:`AttributeContext.context_extensions<envoy_v3_api_field_service.auth.v3.AttributeContext.context_extensions>`
	//
	// You can use this to provide extra context for the external authorization server on specific
	// virtual hosts/routes. For example, adding a context extension on the virtual host level can
	// give the ext-authz server information on what virtual host is used without needing to parse the
	// host header. If CheckSettings is specified in multiple per-filter-configs, they will be merged
	// in order, and the result will be used.
	//
	// Merge semantics for this field are such that keys from more specific configs override.
	//
	// .. note::
	//
	//	These settings are only applied to a filter configured with a
	//	:ref:`grpc_service<envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.grpc_service>`.
	ContextExtensions map[string]string `protobuf:"bytes,1,rep,name=context_extensions,json=contextExtensions,proto3" json:"context_extensions,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// When set to “true“, disable the configured :ref:`with_request_body
	// <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.with_request_body>` for a specific route.
	//
	// Only one of “disable_request_body_buffering“ and
	// :ref:`with_request_body <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.CheckSettings.with_request_body>`
	// may be specified.
	DisableRequestBodyBuffering bool `protobuf:"varint,2,opt,name=disable_request_body_buffering,json=disableRequestBodyBuffering,proto3" json:"disable_request_body_buffering,omitempty"`
	// Enable or override request body buffering, which is configured using the
	// :ref:`with_request_body <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.with_request_body>`
	// option for a specific route.
	//
	// Only one of “with_request_body“ and
	// :ref:`disable_request_body_buffering <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.CheckSettings.disable_request_body_buffering>`
	// may be specified.
	WithRequestBody *BufferSettings `protobuf:"bytes,3,opt,name=with_request_body,json=withRequestBody,proto3" json:"with_request_body,omitempty"`
	// Override the external authorization service for this route.
	// This allows different routes to use different external authorization service backends
	// and service types (gRPC or HTTP). If specified, this overrides the filter-level service
	// configuration regardless of the original service type.
	//
	// Types that are valid to be assigned to ServiceOverride:
	//
	//	*CheckSettings_GrpcService
	//	*CheckSettings_HttpService
	ServiceOverride isCheckSettings_ServiceOverride `protobuf_oneof:"service_override"`
	unknownFields   protoimpl.UnknownFields
	sizeCache       protoimpl.SizeCache
}

func (x *CheckSettings) Reset() {
	*x = CheckSettings{}
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[7]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CheckSettings) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CheckSettings) ProtoMessage() {}

func (x *CheckSettings) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[7]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CheckSettings.ProtoReflect.Descriptor instead.
func (*CheckSettings) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescGZIP(), []int{7}
}

func (x *CheckSettings) GetContextExtensions() map[string]string {
	if x != nil {
		return x.ContextExtensions
	}
	return nil
}

func (x *CheckSettings) GetDisableRequestBodyBuffering() bool {
	if x != nil {
		return x.DisableRequestBodyBuffering
	}
	return false
}

func (x *CheckSettings) GetWithRequestBody() *BufferSettings {
	if x != nil {
		return x.WithRequestBody
	}
	return nil
}

func (x *CheckSettings) GetServiceOverride() isCheckSettings_ServiceOverride {
	if x != nil {
		return x.ServiceOverride
	}
	return nil
}

func (x *CheckSettings) GetGrpcService() *v3.GrpcService {
	if x != nil {
		if x, ok := x.ServiceOverride.(*CheckSettings_GrpcService); ok {
			return x.GrpcService
		}
	}
	return nil
}

func (x *CheckSettings) GetHttpService() *HttpService {
	if x != nil {
		if x, ok := x.ServiceOverride.(*CheckSettings_HttpService); ok {
			return x.HttpService
		}
	}
	return nil
}

type isCheckSettings_ServiceOverride interface {
	isCheckSettings_ServiceOverride()
}

type CheckSettings_GrpcService struct {
	// Override with a gRPC service configuration.
	GrpcService *v3.GrpcService `protobuf:"bytes,4,opt,name=grpc_service,json=grpcService,proto3,oneof"`
}

type CheckSettings_HttpService struct {
	// Override with an HTTP service configuration.
	HttpService *HttpService `protobuf:"bytes,5,opt,name=http_service,json=httpService,proto3,oneof"`
}

func (*CheckSettings_GrpcService) isCheckSettings_ServiceOverride() {}

func (*CheckSettings_HttpService) isCheckSettings_ServiceOverride() {}

var File_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto protoreflect.FileDescriptor

const file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDesc = "" +
	"\n" +
	":envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto\x12*envoy.extensions.filters.http.ext_authz.v3\x1a:envoy/config/common/mutation_rules/v3/mutation_rules.proto\x1a\x1fenvoy/config/core/v3/base.proto\x1a(envoy/config/core/v3/config_source.proto\x1a'envoy/config/core/v3/grpc_service.proto\x1a#envoy/config/core/v3/http_uri.proto\x1a$envoy/type/matcher/v3/metadata.proto\x1a\"envoy/type/matcher/v3/string.proto\x1a\x1fenvoy/type/v3/http_status.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a#envoy/annotations/deprecation.proto\x1a udpa/annotations/sensitive.proto\x1a\x1dudpa/annotations/status.proto\x1a!udpa/annotations/versioning.proto\x1a\x17validate/validate.proto\"\x9f\x12\n" +
	"\bExtAuthz\x12F\n" +
	"\fgrpc_service\x18\x01 \x01(\v2!.envoy.config.core.v3.GrpcServiceH\x00R\vgrpcService\x12\\\n" +
	"\fhttp_service\x18\x03 \x01(\v27.envoy.extensions.filters.http.ext_authz.v3.HttpServiceH\x00R\vhttpService\x12^\n" +
	"\x15transport_api_version\x18\f \x01(\x0e2 .envoy.config.core.v3.ApiVersionB\b\xfaB\x05\x82\x01\x02\x10\x01R\x13transportApiVersion\x12,\n" +
	"\x12failure_mode_allow\x18\x02 \x01(\bR\x10failureModeAllow\x12@\n" +
	"\x1dfailure_mode_allow_header_add\x18\x13 \x01(\bR\x19failureModeAllowHeaderAdd\x12f\n" +
	"\x11with_request_body\x18\x05 \x01(\v2:.envoy.extensions.filters.http.ext_authz.v3.BufferSettingsR\x0fwithRequestBody\x12*\n" +
	"\x11clear_route_cache\x18\x06 \x01(\bR\x0fclearRouteCache\x12A\n" +
	"\x0fstatus_on_error\x18\a \x01(\v2\x19.envoy.type.v3.HttpStatusR\rstatusOnError\x12-\n" +
	"\x12validate_mutations\x18\x18 \x01(\bR\x11validateMutations\x12>\n" +
	"\x1bmetadata_context_namespaces\x18\b \x03(\tR\x19metadataContextNamespaces\x12I\n" +
	"!typed_metadata_context_namespaces\x18\x10 \x03(\tR\x1etypedMetadataContextNamespaces\x12I\n" +
	"!route_metadata_context_namespaces\x18\x15 \x03(\tR\x1erouteMetadataContextNamespaces\x12T\n" +
	"'route_typed_metadata_context_namespaces\x18\x16 \x03(\tR#routeTypedMetadataContextNamespaces\x12U\n" +
	"\x0efilter_enabled\x18\t \x01(\v2..envoy.config.core.v3.RuntimeFractionalPercentR\rfilterEnabled\x12^\n" +
	"\x17filter_enabled_metadata\x18\x0e \x01(\v2&.envoy.type.matcher.v3.MetadataMatcherR\x15filterEnabledMetadata\x12P\n" +
	"\x0fdeny_at_disable\x18\v \x01(\v2(.envoy.config.core.v3.RuntimeFeatureFlagR\rdenyAtDisable\x128\n" +
	"\x18include_peer_certificate\x18\n" +
	" \x01(\bR\x16includePeerCertificate\x12\x1f\n" +
	"\vstat_prefix\x18\r \x01(\tR\n" +
	"statPrefix\x12A\n" +
	"\x1dbootstrap_metadata_labels_key\x18\x0f \x01(\tR\x1abootstrapMetadataLabelsKey\x12Q\n" +
	"\x0fallowed_headers\x18\x11 \x01(\v2(.envoy.type.matcher.v3.ListStringMatcherR\x0eallowedHeaders\x12W\n" +
	"\x12disallowed_headers\x18\x19 \x01(\v2(.envoy.type.matcher.v3.ListStringMatcherR\x11disallowedHeaders\x12.\n" +
	"\x13include_tls_session\x18\x12 \x01(\bR\x11includeTlsSession\x12]\n" +
	"\x1dcharge_cluster_response_stats\x18\x14 \x01(\v2\x1a.google.protobuf.BoolValueR\x1achargeClusterResponseStats\x12,\n" +
	"\x12encode_raw_headers\x18\x17 \x01(\bR\x10encodeRawHeaders\x12}\n" +
	"\x1ddecoder_header_mutation_rules\x18\x1a \x01(\v2:.envoy.config.common.mutation_rules.v3.HeaderMutationRulesR\x1adecoderHeaderMutationRules\x12e\n" +
	"!enable_dynamic_metadata_ingestion\x18\x1b \x01(\v2\x1a.google.protobuf.BoolValueR\x1eenableDynamicMetadataIngestion\x12@\n" +
	"\x0ffilter_metadata\x18\x1c \x01(\v2\x17.google.protobuf.StructR\x0efilterMetadata\x125\n" +
	"\x17emit_filter_state_stats\x18\x1d \x01(\bR\x14emitFilterStateStats\x12B\n" +
	"\x1emax_denied_response_body_bytes\x18\x1e \x01(\rR\x1amaxDeniedResponseBodyBytes\x12C\n" +
	"\x1eenforce_response_header_limits\x18\x1f \x01(\bR\x1benforceResponseHeaderLimits\x12\x1f\n" +
	"\vshadow_mode\x18  \x01(\bR\n" +
	"shadowMode:5\x9aň\x1e0\n" +
	".envoy.config.filter.http.ext_authz.v3.ExtAuthzB\n" +
	"\n" +
	"\bservicesJ\x04\b\x04\x10\x05R\tuse_alpha\"\xb7\x02\n" +
	"\x0eShadowDecision\x12i\n" +
	"\fcheck_result\x18\x01 \x01(\x0e2F.envoy.extensions.filters.http.ext_authz.v3.ShadowDecision.CheckResultR\vcheckResult\x12-\n" +
	"\vstatus_code\x18\x02 \x01(\rB\f\xfaB\t*\a\x18\xd7\x04(d@\x01R\n" +
	"statusCode\x12L\n" +
	"\x10response_headers\x18\x03 \x03(\v2!.envoy.config.core.v3.HeaderValueR\x0fresponseHeaders\"=\n" +
	"\vCheckResult\x12\x0f\n" +
	"\vUNSPECIFIED\x10\x00\x12\x06\n" +
	"\x02OK\x10\x01\x12\n" +
	"\n" +
	"\x06DENIED\x10\x02\x12\t\n" +
	"\x05ERROR\x10\x03\"\xda\x01\n" +
	"\x0eBufferSettings\x123\n" +
	"\x11max_request_bytes\x18\x01 \x01(\rB\a\xfaB\x04*\x02 \x00R\x0fmaxRequestBytes\x122\n" +
	"\x15allow_partial_message\x18\x02 \x01(\bR\x13allowPartialMessage\x12\"\n" +
	"\rpack_as_bytes\x18\x03 \x01(\bR\vpackAsBytes:;\x9aň\x1e6\n" +
	"4envoy.config.filter.http.ext_authz.v2.BufferSettings\"\x9a\x04\n" +
	"\vHttpService\x12<\n" +
	"\n" +
	"server_uri\x18\x01 \x01(\v2\x1d.envoy.config.core.v3.HttpUriR\tserverUri\x12\x1f\n" +
	"\vpath_prefix\x18\x02 \x01(\tR\n" +
	"pathPrefix\x12#\n" +
	"\rpath_override\x18\n" +
	" \x01(\tR\fpathOverride\x12u\n" +
	"\x15authorization_request\x18\a \x01(\v2@.envoy.extensions.filters.http.ext_authz.v3.AuthorizationRequestR\x14authorizationRequest\x12x\n" +
	"\x16authorization_response\x18\b \x01(\v2A.envoy.extensions.filters.http.ext_authz.v3.AuthorizationResponseR\x15authorizationResponse\x12D\n" +
	"\fretry_policy\x18\t \x01(\v2!.envoy.config.core.v3.RetryPolicyR\vretryPolicy:8\x9aň\x1e3\n" +
	"1envoy.config.filter.http.ext_authz.v2.HttpServiceJ\x04\b\x03\x10\x04J\x04\b\x04\x10\x05J\x04\b\x05\x10\x06J\x04\b\x06\x10\a\"\x82\x02\n" +
	"\x14AuthorizationRequest\x12^\n" +
	"\x0fallowed_headers\x18\x01 \x01(\v2(.envoy.type.matcher.v3.ListStringMatcherB\v\x92ǆ\xd8\x04\x033.0\x18\x01R\x0eallowedHeaders\x12G\n" +
	"\x0eheaders_to_add\x18\x02 \x03(\v2!.envoy.config.core.v3.HeaderValueR\fheadersToAdd:A\x9aň\x1e<\n" +
	":envoy.config.filter.http.ext_authz.v2.AuthorizationRequest\"\xf6\x04\n" +
	"\x15AuthorizationResponse\x12b\n" +
	"\x18allowed_upstream_headers\x18\x01 \x01(\v2(.envoy.type.matcher.v3.ListStringMatcherR\x16allowedUpstreamHeaders\x12t\n" +
	"\"allowed_upstream_headers_to_append\x18\x03 \x01(\v2(.envoy.type.matcher.v3.ListStringMatcherR\x1eallowedUpstreamHeadersToAppend\x12^\n" +
	"\x16allowed_client_headers\x18\x02 \x01(\v2(.envoy.type.matcher.v3.ListStringMatcherR\x14allowedClientHeaders\x12r\n" +
	"!allowed_client_headers_on_success\x18\x04 \x01(\v2(.envoy.type.matcher.v3.ListStringMatcherR\x1dallowedClientHeadersOnSuccess\x12k\n" +
	"\x1ddynamic_metadata_from_headers\x18\x05 \x01(\v2(.envoy.type.matcher.v3.ListStringMatcherR\x1adynamicMetadataFromHeaders:B\x9aň\x1e=\n" +
	";envoy.config.filter.http.ext_authz.v2.AuthorizationResponse\"\xee\x01\n" +
	"\x10ExtAuthzPerRoute\x12\x1c\n" +
	"\bdisabled\x18\x01 \x01(\bH\x00R\bdisabled\x12l\n" +
	"\x0echeck_settings\x18\x02 \x01(\v29.envoy.extensions.filters.http.ext_authz.v3.CheckSettingsB\b\xfaB\x05\x8a\x01\x02\x10\x01H\x00R\rcheckSettings:=\x9aň\x1e8\n" +
	"6envoy.config.filter.http.ext_authz.v2.ExtAuthzPerRouteB\x0f\n" +
	"\boverride\x12\x03\xf8B\x01\"\x82\x05\n" +
	"\rCheckSettings\x12\x87\x01\n" +
	"\x12context_extensions\x18\x01 \x03(\v2P.envoy.extensions.filters.http.ext_authz.v3.CheckSettings.ContextExtensionsEntryB\x06\xb8\xb7\x8b\xa4\x02\x01R\x11contextExtensions\x12C\n" +
	"\x1edisable_request_body_buffering\x18\x02 \x01(\bR\x1bdisableRequestBodyBuffering\x12f\n" +
	"\x11with_request_body\x18\x03 \x01(\v2:.envoy.extensions.filters.http.ext_authz.v3.BufferSettingsR\x0fwithRequestBody\x12F\n" +
	"\fgrpc_service\x18\x04 \x01(\v2!.envoy.config.core.v3.GrpcServiceH\x00R\vgrpcService\x12\\\n" +
	"\fhttp_service\x18\x05 \x01(\v27.envoy.extensions.filters.http.ext_authz.v3.HttpServiceH\x00R\vhttpService\x1aD\n" +
	"\x16ContextExtensionsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01::\x9aň\x1e5\n" +
	"3envoy.config.filter.http.ext_authz.v2.CheckSettingsB\x12\n" +
	"\x10service_overrideB\xb2\x01\xba\x80\xc8\xd1\x06\x02\x10\x02\n" +
	"8io.envoyproxy.envoy.extensions.filters.http.ext_authz.v3B\rExtAuthzProtoP\x01Z]github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3;ext_authzv3b\x06proto3"

var (
	file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescOnce sync.Once
	file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescData []byte
)

func file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescGZIP() []byte {
	file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescOnce.Do(func() {
		file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDesc), len(file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDesc)))
	})
	return file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDescData
}

var file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
var file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
var file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_goTypes = []any{
	(ShadowDecision_CheckResult)(0),     // 0: envoy.extensions.filters.http.ext_authz.v3.ShadowDecision.CheckResult
	(*ExtAuthz)(nil),                    // 1: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
	(*ShadowDecision)(nil),              // 2: envoy.extensions.filters.http.ext_authz.v3.ShadowDecision
	(*BufferSettings)(nil),              // 3: envoy.extensions.filters.http.ext_authz.v3.BufferSettings
	(*HttpService)(nil),                 // 4: envoy.extensions.filters.http.ext_authz.v3.HttpService
	(*AuthorizationRequest)(nil),        // 5: envoy.extensions.filters.http.ext_authz.v3.AuthorizationRequest
	(*AuthorizationResponse)(nil),       // 6: envoy.extensions.filters.http.ext_authz.v3.AuthorizationResponse
	(*ExtAuthzPerRoute)(nil),            // 7: envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
	(*CheckSettings)(nil),               // 8: envoy.extensions.filters.http.ext_authz.v3.CheckSettings
	nil,                                 // 9: envoy.extensions.filters.http.ext_authz.v3.CheckSettings.ContextExtensionsEntry
	(*v3.GrpcService)(nil),              // 10: envoy.config.core.v3.GrpcService
	(v3.ApiVersion)(0),                  // 11: envoy.config.core.v3.ApiVersion
	(*v31.HttpStatus)(nil),              // 12: envoy.type.v3.HttpStatus
	(*v3.RuntimeFractionalPercent)(nil), // 13: envoy.config.core.v3.RuntimeFractionalPercent
	(*v32.MetadataMatcher)(nil),         // 14: envoy.type.matcher.v3.MetadataMatcher
	(*v3.RuntimeFeatureFlag)(nil),       // 15: envoy.config.core.v3.RuntimeFeatureFlag
	(*v32.ListStringMatcher)(nil),       // 16: envoy.type.matcher.v3.ListStringMatcher
	(*wrapperspb.BoolValue)(nil),        // 17: google.protobuf.BoolValue
	(*v33.HeaderMutationRules)(nil),     // 18: envoy.config.common.mutation_rules.v3.HeaderMutationRules
	(*structpb.Struct)(nil),             // 19: google.protobuf.Struct
	(*v3.HeaderValue)(nil),              // 20: envoy.config.core.v3.HeaderValue
	(*v3.HttpUri)(nil),                  // 21: envoy.config.core.v3.HttpUri
	(*v3.RetryPolicy)(nil),              // 22: envoy.config.core.v3.RetryPolicy
}
var file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_depIdxs = []int32{
	10, // 0: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.grpc_service:type_name -> envoy.config.core.v3.GrpcService
	4,  // 1: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.http_service:type_name -> envoy.extensions.filters.http.ext_authz.v3.HttpService
	11, // 2: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.transport_api_version:type_name -> envoy.config.core.v3.ApiVersion
	3,  // 3: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.with_request_body:type_name -> envoy.extensions.filters.http.ext_authz.v3.BufferSettings
	12, // 4: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.status_on_error:type_name -> envoy.type.v3.HttpStatus
	13, // 5: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.filter_enabled:type_name -> envoy.config.core.v3.RuntimeFractionalPercent
	14, // 6: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.filter_enabled_metadata:type_name -> envoy.type.matcher.v3.MetadataMatcher
	15, // 7: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.deny_at_disable:type_name -> envoy.config.core.v3.RuntimeFeatureFlag
	16, // 8: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.allowed_headers:type_name -> envoy.type.matcher.v3.ListStringMatcher
	16, // 9: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.disallowed_headers:type_name -> envoy.type.matcher.v3.ListStringMatcher
	17, // 10: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.charge_cluster_response_stats:type_name -> google.protobuf.BoolValue
	18, // 11: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.decoder_header_mutation_rules:type_name -> envoy.config.common.mutation_rules.v3.HeaderMutationRules
	17, // 12: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.enable_dynamic_metadata_ingestion:type_name -> google.protobuf.BoolValue
	19, // 13: envoy.extensions.filters.http.ext_authz.v3.ExtAuthz.filter_metadata:type_name -> google.protobuf.Struct
	0,  // 14: envoy.extensions.filters.http.ext_authz.v3.ShadowDecision.check_result:type_name -> envoy.extensions.filters.http.ext_authz.v3.ShadowDecision.CheckResult
	20, // 15: envoy.extensions.filters.http.ext_authz.v3.ShadowDecision.response_headers:type_name -> envoy.config.core.v3.HeaderValue
	21, // 16: envoy.extensions.filters.http.ext_authz.v3.HttpService.server_uri:type_name -> envoy.config.core.v3.HttpUri
	5,  // 17: envoy.extensions.filters.http.ext_authz.v3.HttpService.authorization_request:type_name -> envoy.extensions.filters.http.ext_authz.v3.AuthorizationRequest
	6,  // 18: envoy.extensions.filters.http.ext_authz.v3.HttpService.authorization_response:type_name -> envoy.extensions.filters.http.ext_authz.v3.AuthorizationResponse
	22, // 19: envoy.extensions.filters.http.ext_authz.v3.HttpService.retry_policy:type_name -> envoy.config.core.v3.RetryPolicy
	16, // 20: envoy.extensions.filters.http.ext_authz.v3.AuthorizationRequest.allowed_headers:type_name -> envoy.type.matcher.v3.ListStringMatcher
	20, // 21: envoy.extensions.filters.http.ext_authz.v3.AuthorizationRequest.headers_to_add:type_name -> envoy.config.core.v3.HeaderValue
	16, // 22: envoy.extensions.filters.http.ext_authz.v3.AuthorizationResponse.allowed_upstream_headers:type_name -> envoy.type.matcher.v3.ListStringMatcher
	16, // 23: envoy.extensions.filters.http.ext_authz.v3.AuthorizationResponse.allowed_upstream_headers_to_append:type_name -> envoy.type.matcher.v3.ListStringMatcher
	16, // 24: envoy.extensions.filters.http.ext_authz.v3.AuthorizationResponse.allowed_client_headers:type_name -> envoy.type.matcher.v3.ListStringMatcher
	16, // 25: envoy.extensions.filters.http.ext_authz.v3.AuthorizationResponse.allowed_client_headers_on_success:type_name -> envoy.type.matcher.v3.ListStringMatcher
	16, // 26: envoy.extensions.filters.http.ext_authz.v3.AuthorizationResponse.dynamic_metadata_from_headers:type_name -> envoy.type.matcher.v3.ListStringMatcher
	8,  // 27: envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute.check_settings:type_name -> envoy.extensions.filters.http.ext_authz.v3.CheckSettings
	9,  // 28: envoy.extensions.filters.http.ext_authz.v3.CheckSettings.context_extensions:type_name -> envoy.extensions.filters.http.ext_authz.v3.CheckSettings.ContextExtensionsEntry
	3,  // 29: envoy.extensions.filters.http.ext_authz.v3.CheckSettings.with_request_body:type_name -> envoy.extensions.filters.http.ext_authz.v3.BufferSettings
	10, // 30: envoy.extensions.filters.http.ext_authz.v3.CheckSettings.grpc_service:type_name -> envoy.config.core.v3.GrpcService
	4,  // 31: envoy.extensions.filters.http.ext_authz.v3.CheckSettings.http_service:type_name -> envoy.extensions.filters.http.ext_authz.v3.HttpService
	32, // [32:32] is the sub-list for method output_type
	32, // [32:32] is the sub-list for method input_type
	32, // [32:32] is the sub-list for extension type_name
	32, // [32:32] is the sub-list for extension extendee
	0,  // [0:32] is the sub-list for field type_name
}

func init() { file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_init() }
func file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_init() {
	if File_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto != nil {
		return
	}
	file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[0].OneofWrappers = []any{
		(*ExtAuthz_GrpcService)(nil),
		(*ExtAuthz_HttpService)(nil),
	}
	file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[6].OneofWrappers = []any{
		(*ExtAuthzPerRoute_Disabled)(nil),
		(*ExtAuthzPerRoute_CheckSettings)(nil),
	}
	file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes[7].OneofWrappers = []any{
		(*CheckSettings_GrpcService)(nil),
		(*CheckSettings_HttpService)(nil),
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDesc), len(file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_rawDesc)),
			NumEnums:      1,
			NumMessages:   9,
			NumExtensions: 0,
			NumServices:   0,
		},
		GoTypes:           file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_goTypes,
		DependencyIndexes: file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_depIdxs,
		EnumInfos:         file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_enumTypes,
		MessageInfos:      file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_msgTypes,
	}.Build()
	File_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto = out.File
	file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_goTypes = nil
	file_envoy_extensions_filters_http_ext_authz_v3_ext_authz_proto_depIdxs = nil
}
