// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        v7.35.1
// source: envoy/extensions/filters/network/ext_authz/v3/ext_authz.proto

package ext_authzv3

import (
	_ "github.com/cncf/xds/go/udpa/annotations"
	v3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	v31 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
	_ "github.com/envoyproxy/protoc-gen-validate/validate"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

// External Authorization filter calls out to an external service over the
// gRPC Authorization API defined by
// :ref:`CheckRequest <envoy_v3_api_msg_service.auth.v3.CheckRequest>`.
// A failed check will cause this filter to close the TCP connection.
// [#next-free-field: 12]
type ExtAuthz struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The prefix to use when emitting statistics.
	StatPrefix string `protobuf:"bytes,1,opt,name=stat_prefix,json=statPrefix,proto3" json:"stat_prefix,omitempty"`
	// The external authorization gRPC service configuration.
	// The default timeout is set to 200ms by this filter.
	GrpcService *v3.GrpcService `protobuf:"bytes,2,opt,name=grpc_service,json=grpcService,proto3" json:"grpc_service,omitempty"`
	// The filter's behaviour in case the external authorization service does
	// not respond back. When it is set to true, Envoy will also allow traffic in case of
	// communication failure between authorization service and the proxy.
	// Defaults to false.
	FailureModeAllow bool `protobuf:"varint,3,opt,name=failure_mode_allow,json=failureModeAllow,proto3" json:"failure_mode_allow,omitempty"`
	// Specifies if the peer certificate is sent to the external service.
	//
	// When this field is true, Envoy will include the peer X.509 certificate, if available, in the
	// :ref:`certificate<envoy_v3_api_field_service.auth.v3.AttributeContext.Peer.certificate>`.
	IncludePeerCertificate bool `protobuf:"varint,4,opt,name=include_peer_certificate,json=includePeerCertificate,proto3" json:"include_peer_certificate,omitempty"`
	// API version for ext_authz transport protocol. This describes the ext_authz gRPC endpoint and
	// version of Check{Request,Response} used on the wire.
	TransportApiVersion v3.ApiVersion `protobuf:"varint,5,opt,name=transport_api_version,json=transportApiVersion,proto3,enum=envoy.config.core.v3.ApiVersion" json:"transport_api_version,omitempty"`
	// Specifies if the filter is enabled with metadata matcher.
	// If this field is not specified, the filter will be enabled for all requests.
	FilterEnabledMetadata *v31.MetadataMatcher `protobuf:"bytes,6,opt,name=filter_enabled_metadata,json=filterEnabledMetadata,proto3" json:"filter_enabled_metadata,omitempty"`
	// Optional labels that will be passed to :ref:`labels<envoy_v3_api_field_service.auth.v3.AttributeContext.Peer.labels>` in
	// :ref:`destination<envoy_v3_api_field_service.auth.v3.AttributeContext.destination>`.
	// The labels will be read from :ref:`metadata<envoy_v3_api_msg_config.core.v3.Node>` with the specified key.
	BootstrapMetadataLabelsKey string `protobuf:"bytes,7,opt,name=bootstrap_metadata_labels_key,json=bootstrapMetadataLabelsKey,proto3" json:"bootstrap_metadata_labels_key,omitempty"`
	// Specifies if the TLS session level details like SNI are sent to the external service.
	//
	// When this field is true, Envoy will include the SNI name used for TLSClientHello, if available, in the
	// :ref:`tls_session<envoy_v3_api_field_service.auth.v3.AttributeContext.tls_session>`.
	IncludeTlsSession bool `protobuf:"varint,8,opt,name=include_tls_session,json=includeTlsSession,proto3" json:"include_tls_session,omitempty"`
	// When set to “true“, the filter will send a TLS “access_denied(49)“ alert before closing
	// the connection when authorization is denied. This provides better visibility to TLS clients
	// about the reason for connection closure. This alert is only sent for TLS connections. The
	// non-TLS connections will be closed without sending an alert.
	//
	// Defaults to “false“.
	SendTlsAlertOnDenial bool `protobuf:"varint,9,opt,name=send_tls_alert_on_denial,json=sendTlsAlertOnDenial,proto3" json:"send_tls_alert_on_denial,omitempty"`
	// Specifies a list of metadata namespaces whose values, if present, will be passed to the
	// ext_authz service. The :ref:`filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.filter_metadata>`
	// is passed as an opaque “protobuf::Struct“.
	//
	// For example, if the “proxy_protocol“ listener filter is used and populates TLV metadata,
	// then the following will pass that metadata to the authorization server for making decisions
	// based on proxy protocol information.
	//
	// .. code-block:: yaml
	//
	//	metadata_context_namespaces:
	//	- envoy.filters.listener.proxy_protocol
	MetadataContextNamespaces []string `protobuf:"bytes,10,rep,name=metadata_context_namespaces,json=metadataContextNamespaces,proto3" json:"metadata_context_namespaces,omitempty"`
	// Specifies a list of metadata namespaces whose values, if present, will be passed to the
	// ext_authz service. :ref:`typed_filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.typed_filter_metadata>`
	// is passed as a “protobuf::Any“.
	//
	// This works similarly to “metadata_context_namespaces“ but allows Envoy and the ext_authz server to share
	// the protobuf message definition in order to perform safe parsing.
	TypedMetadataContextNamespaces []string `protobuf:"bytes,11,rep,name=typed_metadata_context_namespaces,json=typedMetadataContextNamespaces,proto3" json:"typed_metadata_context_namespaces,omitempty"`
	unknownFields                  protoimpl.UnknownFields
	sizeCache                      protoimpl.SizeCache
}

func (x *ExtAuthz) Reset() {
	*x = ExtAuthz{}
	mi := &file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExtAuthz) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExtAuthz) ProtoMessage() {}

func (x *ExtAuthz) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExtAuthz.ProtoReflect.Descriptor instead.
func (*ExtAuthz) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_rawDescGZIP(), []int{0}
}

func (x *ExtAuthz) GetStatPrefix() string {
	if x != nil {
		return x.StatPrefix
	}
	return ""
}

func (x *ExtAuthz) GetGrpcService() *v3.GrpcService {
	if x != nil {
		return x.GrpcService
	}
	return nil
}

func (x *ExtAuthz) GetFailureModeAllow() bool {
	if x != nil {
		return x.FailureModeAllow
	}
	return false
}

func (x *ExtAuthz) GetIncludePeerCertificate() bool {
	if x != nil {
		return x.IncludePeerCertificate
	}
	return false
}

func (x *ExtAuthz) GetTransportApiVersion() v3.ApiVersion {
	if x != nil {
		return x.TransportApiVersion
	}
	return v3.ApiVersion(0)
}

func (x *ExtAuthz) GetFilterEnabledMetadata() *v31.MetadataMatcher {
	if x != nil {
		return x.FilterEnabledMetadata
	}
	return nil
}

func (x *ExtAuthz) GetBootstrapMetadataLabelsKey() string {
	if x != nil {
		return x.BootstrapMetadataLabelsKey
	}
	return ""
}

func (x *ExtAuthz) GetIncludeTlsSession() bool {
	if x != nil {
		return x.IncludeTlsSession
	}
	return false
}

func (x *ExtAuthz) GetSendTlsAlertOnDenial() bool {
	if x != nil {
		return x.SendTlsAlertOnDenial
	}
	return false
}

func (x *ExtAuthz) GetMetadataContextNamespaces() []string {
	if x != nil {
		return x.MetadataContextNamespaces
	}
	return nil
}

func (x *ExtAuthz) GetTypedMetadataContextNamespaces() []string {
	if x != nil {
		return x.TypedMetadataContextNamespaces
	}
	return nil
}

var File_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto protoreflect.FileDescriptor

const file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_rawDesc = "" +
	"\n" +
	"=envoy/extensions/filters/network/ext_authz/v3/ext_authz.proto\x12-envoy.extensions.filters.network.ext_authz.v3\x1a(envoy/config/core/v3/config_source.proto\x1a'envoy/config/core/v3/grpc_service.proto\x1a$envoy/type/matcher/v3/metadata.proto\x1a\x1dudpa/annotations/status.proto\x1a!udpa/annotations/versioning.proto\x1a\x17validate/validate.proto\"\x92\x06\n" +
	"\bExtAuthz\x12(\n" +
	"\vstat_prefix\x18\x01 \x01(\tB\a\xfaB\x04r\x02\x10\x01R\n" +
	"statPrefix\x12D\n" +
	"\fgrpc_service\x18\x02 \x01(\v2!.envoy.config.core.v3.GrpcServiceR\vgrpcService\x12,\n" +
	"\x12failure_mode_allow\x18\x03 \x01(\bR\x10failureModeAllow\x128\n" +
	"\x18include_peer_certificate\x18\x04 \x01(\bR\x16includePeerCertificate\x12^\n" +
	"\x15transport_api_version\x18\x05 \x01(\x0e2 .envoy.config.core.v3.ApiVersionB\b\xfaB\x05\x82\x01\x02\x10\x01R\x13transportApiVersion\x12^\n" +
	"\x17filter_enabled_metadata\x18\x06 \x01(\v2&.envoy.type.matcher.v3.MetadataMatcherR\x15filterEnabledMetadata\x12A\n" +
	"\x1dbootstrap_metadata_labels_key\x18\a \x01(\tR\x1abootstrapMetadataLabelsKey\x12.\n" +
	"\x13include_tls_session\x18\b \x01(\bR\x11includeTlsSession\x126\n" +
	"\x18send_tls_alert_on_denial\x18\t \x01(\bR\x14sendTlsAlertOnDenial\x12>\n" +
	"\x1bmetadata_context_namespaces\x18\n" +
	" \x03(\tR\x19metadataContextNamespaces\x12I\n" +
	"!typed_metadata_context_namespaces\x18\v \x03(\tR\x1etypedMetadataContextNamespaces:8\x9aň\x1e3\n" +
	"1envoy.config.filter.network.ext_authz.v2.ExtAuthzB\xb8\x01\xba\x80\xc8\xd1\x06\x02\x10\x02\n" +
	";io.envoyproxy.envoy.extensions.filters.network.ext_authz.v3B\rExtAuthzProtoP\x01Z`github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/ext_authz/v3;ext_authzv3b\x06proto3"

var (
	file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_rawDescOnce sync.Once
	file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_rawDescData []byte
)

func file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_rawDescGZIP() []byte {
	file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_rawDescOnce.Do(func() {
		file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_rawDesc), len(file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_rawDesc)))
	})
	return file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_rawDescData
}

var file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
var file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_goTypes = []any{
	(*ExtAuthz)(nil),            // 0: envoy.extensions.filters.network.ext_authz.v3.ExtAuthz
	(*v3.GrpcService)(nil),      // 1: envoy.config.core.v3.GrpcService
	(v3.ApiVersion)(0),          // 2: envoy.config.core.v3.ApiVersion
	(*v31.MetadataMatcher)(nil), // 3: envoy.type.matcher.v3.MetadataMatcher
}
var file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_depIdxs = []int32{
	1, // 0: envoy.extensions.filters.network.ext_authz.v3.ExtAuthz.grpc_service:type_name -> envoy.config.core.v3.GrpcService
	2, // 1: envoy.extensions.filters.network.ext_authz.v3.ExtAuthz.transport_api_version:type_name -> envoy.config.core.v3.ApiVersion
	3, // 2: envoy.extensions.filters.network.ext_authz.v3.ExtAuthz.filter_enabled_metadata:type_name -> envoy.type.matcher.v3.MetadataMatcher
	3, // [3:3] is the sub-list for method output_type
	3, // [3:3] is the sub-list for method input_type
	3, // [3:3] is the sub-list for extension type_name
	3, // [3:3] is the sub-list for extension extendee
	0, // [0:3] is the sub-list for field type_name
}

func init() { file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_init() }
func file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_init() {
	if File_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto != nil {
		return
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_rawDesc), len(file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_rawDesc)),
			NumEnums:      0,
			NumMessages:   1,
			NumExtensions: 0,
			NumServices:   0,
		},
		GoTypes:           file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_goTypes,
		DependencyIndexes: file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_depIdxs,
		MessageInfos:      file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_msgTypes,
	}.Build()
	File_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto = out.File
	file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_goTypes = nil
	file_envoy_extensions_filters_network_ext_authz_v3_ext_authz_proto_depIdxs = nil
}
