// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0

//go:build !consulent
// +build !consulent

package xds

import (
	"path/filepath"
	"sort"
	"testing"

	envoy_cluster_v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
	envoy_endpoint_v3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
	envoy_listener_v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
	envoy_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
	"github.com/hashicorp/consul/agent/xds/testcommon"
	testinf "github.com/mitchellh/go-testing-interface"
	"github.com/stretchr/testify/require"
	"google.golang.org/protobuf/proto"

	"github.com/hashicorp/consul/agent/envoyextensions"
	propertyoverride "github.com/hashicorp/consul/agent/envoyextensions/builtin/property-override"
	"github.com/hashicorp/consul/agent/proxycfg"
	"github.com/hashicorp/consul/agent/structs"
	"github.com/hashicorp/consul/agent/xds/extensionruntime"
	"github.com/hashicorp/consul/api"
	"github.com/hashicorp/consul/envoyextensions/extensioncommon"
	"github.com/hashicorp/consul/envoyextensions/xdscommon"
	"github.com/hashicorp/consul/sdk/testutil"
)

func TestEnvoyExtenderWithSnapshot(t *testing.T) {
	// If opposite is true, the returned service defaults config entry will have
	// payload-passthrough=true and invocation-mode=asynchronous.
	// Otherwise payload-passthrough=false and invocation-mode=synchronous.
	// This is used to test all the permutations.
	makeLambdaServiceDefaults := func(opposite bool) *structs.ServiceConfigEntry {
		payloadPassthrough := true
		if opposite {
			payloadPassthrough = false
		}

		invocationMode := "synchronous"
		if opposite {
			invocationMode = "asynchronous"
		}

		return &structs.ServiceConfigEntry{
			Kind:     structs.ServiceDefaults,
			Name:     "db",
			Protocol: "http",
			EnvoyExtensions: []structs.EnvoyExtension{
				{
					Name: api.BuiltinAWSLambdaExtension,
					Arguments: map[string]interface{}{
						"ARN":                "arn:aws:lambda:us-east-1:111111111111:function:lambda-1234",
						"PayloadPassthrough": payloadPassthrough,
						"InvocationMode":     invocationMode,
					},
				},
			},
		}
	}

	// Apply Lua extension to the local service and ensure http is used so the extension can be applied.
	makeLuaNsFunc := func(inbound bool) func(ns *structs.NodeService) {
		listener := "inbound"
		if !inbound {
			listener = "outbound"
		}

		return func(ns *structs.NodeService) {
			ns.Proxy.Config["protocol"] = "http"
			ns.Proxy.EnvoyExtensions = []structs.EnvoyExtension{
				{
					Name: api.BuiltinLuaExtension,
					Arguments: map[string]interface{}{
						"ProxyType": "connect-proxy",
						"Listener":  listener,
						"Script": `
function envoy_on_request(request_handle)
  request_handle:headers():add("test", "test")
end`,
					},
				},
			}
		}
	}

	// Apply Prop Override extension to the local service and ensure http is used so the extension can be applied.
	makePropOverrideNsFunc := func(args map[string]interface{}) func(ns *structs.NodeService) {
		return func(ns *structs.NodeService) {
			ns.Proxy.Config["protocol"] = "http"
			if _, ok := args["ProxyType"]; !ok {
				args["ProxyType"] = api.ServiceKindConnectProxy
			}
			ns.Proxy.EnvoyExtensions = []structs.EnvoyExtension{
				{
					Name:      api.BuiltinPropertyOverrideExtension,
					Arguments: args,
				},
			}
		}
	}

	propertyOverrideServiceDefaultsAddOutlierDetectionSingle := makePropOverrideNsFunc(
		map[string]interface{}{
			"Patches": []map[string]interface{}{
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeCluster,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
					},
					"Op":    "add",
					"Path":  "/outlier_detection/success_rate_minimum_hosts",
					"Value": 1234,
				},
			},
		})

	propertyOverrideServiceDefaultsAddOutlierDetectionMultiple := makePropOverrideNsFunc(
		map[string]interface{}{
			"Patches": []map[string]interface{}{
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeCluster,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
					},
					"Op":   "add",
					"Path": "/outlier_detection",
					"Value": map[string]interface{}{
						"success_rate_minimum_hosts":        1234,
						"failure_percentage_request_volume": 2345,
					},
				},
			},
		})

	propertyOverrideServiceDefaultsRemoveOutlierDetection := makePropOverrideNsFunc(
		map[string]interface{}{
			"Patches": []map[string]interface{}{
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeCluster,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
					},
					"Op":   "remove",
					"Path": "/outlier_detection",
				},
			},
		})

	propertyOverrideServiceDefaultsAddKeepalive := makePropOverrideNsFunc(
		map[string]interface{}{
			"Patches": []map[string]interface{}{
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeCluster,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
					},
					"Op":    "add",
					"Path":  "/upstream_connection_options/tcp_keepalive/keepalive_probes",
					"Value": 5,
				},
			},
		})

	propertyOverrideServiceDefaultsAddRoundRobinLbConfig := makePropOverrideNsFunc(
		map[string]interface{}{
			"Patches": []map[string]interface{}{
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeCluster,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
					},
					"Op":    "add",
					"Path":  "/round_robin_lb_config",
					"Value": map[string]interface{}{},
				},
			},
		})

	propertyOverrideServiceDefaultsClusterLoadAssignmentOutboundAdd := makePropOverrideNsFunc(
		map[string]interface{}{
			"Patches": []map[string]interface{}{
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeClusterLoadAssignment,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
					},
					"Op":    "add",
					"Path":  "/policy/overprovisioning_factor",
					"Value": 123,
				},
			},
		})

	propertyOverrideServiceDefaultsClusterLoadAssignmentInboundAdd := makePropOverrideNsFunc(
		map[string]interface{}{
			"Patches": []map[string]interface{}{
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeClusterLoadAssignment,
						"TrafficDirection": extensioncommon.TrafficDirectionInbound,
					},
					"Op":    "add",
					"Path":  "/policy/overprovisioning_factor",
					"Value": 123,
				},
			},
		})

	propertyOverrideServiceDefaultsListenerInboundAdd := makePropOverrideNsFunc(
		map[string]interface{}{
			"Patches": []map[string]interface{}{
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeListener,
						"TrafficDirection": extensioncommon.TrafficDirectionInbound,
					},
					"Op":    "add",
					"Path":  "/stat_prefix",
					"Value": "custom.stats",
				},
			},
		})

	propertyOverrideServiceDefaultsListenerOutboundAdd := makePropOverrideNsFunc(
		map[string]interface{}{
			"Patches": []map[string]interface{}{
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeListener,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
					},
					"Op":    "add",
					"Path":  "/stat_prefix",
					"Value": "custom.stats",
				},
			},
		})

	propertyOverrideServiceDefaultsListenerOutboundDoesntApplyToInbound := makePropOverrideNsFunc(
		map[string]interface{}{
			"Patches": []map[string]interface{}{
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeListener,
						"TrafficDirection": extensioncommon.TrafficDirectionInbound,
					},
					"Op":    "add",
					"Path":  "/stat_prefix",
					"Value": "custom.stats.inbound.only",
				},
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeListener,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
					},
					"Op":    "add",
					"Path":  "/stat_prefix",
					"Value": "custom.stats.outbound.only",
				},
			},
		})

	// Reverse order of above patches, to prove order is inconsequential
	propertyOverrideServiceDefaultsListenerInboundDoesntApplyToOutbound := makePropOverrideNsFunc(
		map[string]interface{}{
			"Patches": []map[string]interface{}{
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeListener,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
					},
					"Op":    "add",
					"Path":  "/stat_prefix",
					"Value": "custom.stats.outbound.only",
				},
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeListener,
						"TrafficDirection": extensioncommon.TrafficDirectionInbound,
					},
					"Op":    "add",
					"Path":  "/stat_prefix",
					"Value": "custom.stats.inbound.only",
				},
			},
		})

	propertyOverridePatchSpecificUpstreamService := makePropOverrideNsFunc(
		map[string]interface{}{
			"Patches": []map[string]interface{}{
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeListener,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
						"Services": []propertyoverride.ServiceName{
							{CompoundServiceName: api.CompoundServiceName{Name: "db"}},
						},
					},
					"Op":    "add",
					"Path":  "/stat_prefix",
					"Value": "custom.stats.outbound.only",
				},
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeRoute,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
						"Services": []propertyoverride.ServiceName{
							{CompoundServiceName: api.CompoundServiceName{Name: "db"}},
						},
					},
					"Op":    "add",
					"Path":  "/most_specific_header_mutations_wins",
					"Value": true,
				},
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeCluster,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
						"Services": []propertyoverride.ServiceName{
							{CompoundServiceName: api.CompoundServiceName{Name: "db"}},
						},
					},
					"Op":    "add",
					"Path":  "/outlier_detection/success_rate_minimum_hosts",
					"Value": 1234,
				},
				{
					"ResourceFilter": map[string]interface{}{
						"ResourceType":     propertyoverride.ResourceTypeClusterLoadAssignment,
						"TrafficDirection": extensioncommon.TrafficDirectionOutbound,
						"Services": []propertyoverride.ServiceName{
							{CompoundServiceName: api.CompoundServiceName{Name: "db"}},
						},
					},
					"Op":    "add",
					"Path":  "/policy/overprovisioning_factor",
					"Value": 1234,
				},
			},
		})

	tests := []struct {
		name   string
		create func(t testinf.T) *proxycfg.ConfigSnapshot
	}{
		{
			name: "propertyoverride-add-outlier-detection",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, propertyOverrideServiceDefaultsAddOutlierDetectionSingle, nil)
			},
		},
		{
			name: "propertyoverride-add-outlier-detection-multiple",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, propertyOverrideServiceDefaultsAddOutlierDetectionMultiple, nil)
			},
		},
		{
			name: "propertyoverride-add-keepalive",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, propertyOverrideServiceDefaultsAddKeepalive, nil)
			},
		},
		{
			name: "propertyoverride-add-round-robin-lb-config",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, propertyOverrideServiceDefaultsAddRoundRobinLbConfig, nil)
			},
		},
		{
			name: "propertyoverride-remove-outlier-detection",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, propertyOverrideServiceDefaultsRemoveOutlierDetection, nil)
			},
		},
		{
			name: "propertyoverride-cluster-load-assignment-outbound-add",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, propertyOverrideServiceDefaultsClusterLoadAssignmentOutboundAdd, nil)
			},
		},
		{
			name: "propertyoverride-cluster-load-assignment-inbound-add",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, propertyOverrideServiceDefaultsClusterLoadAssignmentInboundAdd, nil)
			},
		},
		{
			name: "propertyoverride-listener-outbound-add",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, propertyOverrideServiceDefaultsListenerOutboundAdd, nil)
			},
		},
		{
			name: "propertyoverride-listener-inbound-add",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, propertyOverrideServiceDefaultsListenerInboundAdd, nil)
			},
		},
		{
			name: "propertyoverride-outbound-doesnt-apply-to-inbound",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, propertyOverrideServiceDefaultsListenerOutboundDoesntApplyToInbound, nil)
			},
		},
		{
			name: "propertyoverride-inbound-doesnt-apply-to-outbound",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, propertyOverrideServiceDefaultsListenerInboundDoesntApplyToOutbound, nil)
			},
		},
		{
			name: "propertyoverride-patch-specific-upstream-service-splitter",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "splitter-with-resolver-redirect-multidc", false, propertyOverridePatchSpecificUpstreamService, nil)
			},
		},
		{
			name: "propertyoverride-patch-specific-upstream-service-failover",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "failover", false, propertyOverridePatchSpecificUpstreamService, nil)
			},
		},
		{
			name: "lambda-connect-proxy",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, nil, nil, makeLambdaServiceDefaults(false))
			},
		},
		{
			name: "lambda-connect-proxy-tproxy",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				extra := makeLambdaServiceDefaults(false)
				extra.Name = "google"
				return proxycfg.TestConfigSnapshotTransparentProxyHTTPUpstream(t, extra)
			},
		},
		// Make sure that if the upstream type is different from ExtensionConfiguration.Kind is, that the resources are not patched.
		{
			name: "lambda-connect-proxy-with-terminating-gateway-upstream",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "register-to-terminating-gateway", false, nil, nil, makeLambdaServiceDefaults(false))
			},
		},
		{
			name: "lambda-connect-proxy-opposite-meta",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, nil, nil, makeLambdaServiceDefaults(true))
			},
		},
		{
			name: "lambda-terminating-gateway",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotTerminatingGatewayWithLambdaService(t)
			},
		},
		{
			name:   "lambda-terminating-gateway-with-service-resolvers",
			create: proxycfg.TestConfigSnapshotTerminatingGatewayWithLambdaServiceAndServiceResolvers,
		},
		{
			name: "lua-outbound-applies-to-local-upstreams",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				// upstreams need to be http in order for lua to be applied to listeners.
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, makeLuaNsFunc(false), nil, &structs.ServiceConfigEntry{
					Kind:     structs.ServiceDefaults,
					Name:     "db",
					Protocol: "http",
				}, &structs.ServiceConfigEntry{
					Kind:     structs.ServiceDefaults,
					Name:     "geo-cache",
					Protocol: "http",
				})
			},
		},
		{
			// We expect an inbound public listener lua filter here because the extension targets inbound.
			// The only difference between goldens for this and lua-inbound-applies-to-inbound
			// should be that db has HTTP filters rather than TCP.
			name: "lua-inbound-doesnt-apply-to-local-upstreams",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				// db is made an HTTP upstream so that the extension _could_ apply, but does not because
				// the direction for the extension is inbound.
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, makeLuaNsFunc(true), nil, &structs.ServiceConfigEntry{
					Kind:     structs.ServiceDefaults,
					Name:     "db",
					Protocol: "http",
				})
			},
		},
		{
			name: "lua-inbound-applies-to-inbound",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, makeLuaNsFunc(true), nil)
			},
		},
		{
			// We expect _no_ lua filters here, because the extension targets outbound, but there are
			// no upstream HTTP services. We also should not see public listener, which is HTTP, patched.
			name: "lua-outbound-doesnt-apply-to-inbound",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, makeLuaNsFunc(false), nil)
			},
		},
		{
			name: "lua-outbound-applies-to-local-upstreams-tproxy",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				// upstreams need to be http in order for lua to be applied to listeners.
				return proxycfg.TestConfigSnapshotTransparentProxyDestinationHTTP(t, makeLuaNsFunc(false))
			},
		},
		{
			name: "lua-connect-proxy-with-terminating-gateway-upstream",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "register-to-terminating-gateway", false, nil, nil, makeLambdaServiceDefaults(false))
			},
		},
		{
			name: "lambda-and-lua-connect-proxy",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				nsFunc := func(ns *structs.NodeService) {
					ns.Proxy.Config["protocol"] = "http"
					ns.Proxy.EnvoyExtensions = []structs.EnvoyExtension{
						{
							Name: api.BuiltinLuaExtension,
							Arguments: map[string]interface{}{
								"ProxyType": "connect-proxy",
								"Listener":  "inbound",
								"Script": `
function envoy_on_request(request_handle)
  request_handle:headers():add("test", "test")
end`,
							},
						},
					}
				}
				return proxycfg.TestConfigSnapshotDiscoveryChain(t, "default", false, nsFunc, nil, makeLambdaServiceDefaults(true))
			},
		},
		{
			name: "http-local-ratelimit-applyto-filter",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config["protocol"] = "http"
					ns.Proxy.EnvoyExtensions = []structs.EnvoyExtension{
						{
							Name: api.BuiltinLocalRatelimitExtension,
							Arguments: map[string]interface{}{
								"ProxyType":      "connect-proxy",
								"MaxTokens":      3,
								"TokensPerFill":  2,
								"FillInterval":   10,
								"FilterEnabled":  100,
								"FilterEnforced": 100,
							},
						},
					}
				}, nil)
			},
		},
		{
			name: "wasm-http-local-file",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config["protocol"] = "http"
					ns.Proxy.EnvoyExtensions = makeWasmEnvoyExtension("http", "inbound", "local")
				}, nil)
			},
		},
		{
			name: "wasm-http-remote-file",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config["protocol"] = "http"
					ns.Proxy.EnvoyExtensions = makeWasmEnvoyExtension("http", "inbound", "remote")
				}, nil)
			},
		},
		{
			name: "wasm-tcp-local-file",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config["protocol"] = "tcp"
					ns.Proxy.EnvoyExtensions = makeWasmEnvoyExtension("tcp", "inbound", "local")
				}, nil)
			},
		},
		{
			name: "wasm-tcp-remote-file",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config["protocol"] = "tcp"
					ns.Proxy.EnvoyExtensions = makeWasmEnvoyExtension("tcp", "inbound", "remote")
				}, nil)
			},
		},
		{
			name: "wasm-tcp-local-file-outbound",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config["protocol"] = "tcp"
					ns.Proxy.EnvoyExtensions = makeWasmEnvoyExtension("tcp", "outbound", "local")
				}, nil)
			},
		},
		{
			name: "wasm-tcp-remote-file-outbound",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config["protocol"] = "tcp"
					ns.Proxy.EnvoyExtensions = makeWasmEnvoyExtension("tcp", "outbound", "remote")
				}, nil)
			},
		},
		{
			// Insert an HTTP ext_authz filter at the start of the filter chain with the default gRPC config options.
			name: "ext-authz-http-local-grpc-service",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config = map[string]any{"protocol": "http"}
					ns.Proxy.EnvoyExtensions = makeExtAuthzEnvoyExtension(
						"grpc",
						"dest=local",
					)
				}, nil)
			},
		},
		{
			// Insert an ext_authz HTTP filter after all the header_to_metadata filters, with the default HTTP config options.
			name: "ext-authz-http-local-http-service",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config = map[string]any{"protocol": "http"}
					ns.Proxy.EnvoyExtensions = makeExtAuthzEnvoyExtension(
						"http",
						"dest=local",
						"insert=AfterLastMatch:envoy.filters.http.header_to_metadata",
					)
				}, nil)
			},
		},
		{
			// Insert an ext_authz HTTP filter before the router filter, specifying all gRPC config options.
			name: "ext-authz-http-upstream-grpc-service",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config = map[string]any{"protocol": "http"}
					ns.Proxy.EnvoyExtensions = makeExtAuthzEnvoyExtension(
						"grpc",
						"required=true",
						"dest=upstream",
						"insert=BeforeFirstMatch:envoy.filters.http.router",
						"config-type=full",
					)
				}, nil)
			},
		},
		{
			// Insert an ext_authz HTTP filter after intentions, specifying all HTTP config options.
			name: "ext-authz-http-upstream-http-service",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config = map[string]any{"protocol": "http"}
					ns.Proxy.EnvoyExtensions = makeExtAuthzEnvoyExtension(
						"http",
						"required=true",
						"dest=upstream",
						"insert=AfterLastMatch:envoy.filters.http.rbac",
						"config-type=full",
					)
				}, nil)
			},
		},
		{
			// Insert an ext_authz TCP filter at the start of the filter chain, with the default gRPC config options.
			name: "ext-authz-tcp-local-grpc-service",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config = map[string]any{"protocol": "tcp"}
					ns.Proxy.EnvoyExtensions = makeExtAuthzEnvoyExtension("grpc")
				}, nil)
			},
		},
		{
			// Insert an ext_authz TCP filter after intentions, specifying all gRPC config options.
			name: "ext-authz-tcp-upstream-grpc-service",
			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
				return proxycfg.TestConfigSnapshot(t, func(ns *structs.NodeService) {
					ns.Proxy.Config = map[string]any{"protocol": "tcp"}
					ns.Proxy.EnvoyExtensions = makeExtAuthzEnvoyExtension(
						"grpc",
						"required=true",
						"dest=upstream",
						"insert=AfterLastMatch:envoy.filters.network.rbac",
						"config-type=full",
					)
				}, nil)
			},
		},
	}

	latestEnvoyVersion := xdscommon.EnvoyVersions[0]
	for _, envoyVersion := range xdscommon.EnvoyVersions {
		sf, err := xdscommon.DetermineSupportedProxyFeaturesFromString(envoyVersion)
		require.NoError(t, err)
		t.Run("envoy-"+envoyVersion, func(t *testing.T) {
			for _, tt := range tests {
				t.Run(tt.name, func(t *testing.T) {
					// Sanity check default with no overrides first
					snap := tt.create(t)

					// We need to replace the TLS certs with deterministic ones to make golden
					// files workable. Note we don't update these otherwise they'd change
					// golden files for every test case and so not be any use!
					testcommon.SetupTLSRootsAndLeaf(t, snap)

					g := NewResourceGenerator(testutil.Logger(t), nil, false)
					g.ProxyFeatures = sf

					res, err := g.AllResourcesFromSnapshot(snap)
					require.NoError(t, err)

					indexedResources := xdscommon.IndexResources(g.Logger, res)
					cfgs := extensionruntime.GetRuntimeConfigurations(snap)
					for _, extensions := range cfgs {
						for _, ext := range extensions {
							extender, err := envoyextensions.ConstructExtension(ext.EnvoyExtension)
							require.NoError(t, err)
							err = extender.Validate(&ext)
							require.NoError(t, err)
							indexedResources, err = extender.Extend(indexedResources, &ext)
							require.NoError(t, err)
						}
					}

					entities := []struct {
						name   string
						key    string
						sorter func([]proto.Message) func(int, int) bool
					}{
						{
							name: "clusters",
							key:  xdscommon.ClusterType,
							sorter: func(msgs []proto.Message) func(int, int) bool {
								return func(i, j int) bool {
									return msgs[i].(*envoy_cluster_v3.Cluster).Name < msgs[j].(*envoy_cluster_v3.Cluster).Name
								}
							},
						},
						{
							name: "listeners",
							key:  xdscommon.ListenerType,
							sorter: func(msgs []proto.Message) func(int, int) bool {
								return func(i, j int) bool {
									return msgs[i].(*envoy_listener_v3.Listener).Name < msgs[j].(*envoy_listener_v3.Listener).Name
								}
							},
						},
						{
							name: "routes",
							key:  xdscommon.RouteType,
							sorter: func(msgs []proto.Message) func(int, int) bool {
								return func(i, j int) bool {
									return msgs[i].(*envoy_route_v3.RouteConfiguration).Name < msgs[j].(*envoy_route_v3.RouteConfiguration).Name
								}
							},
						},
						{
							name: "endpoints",
							key:  xdscommon.EndpointType,
							sorter: func(msgs []proto.Message) func(int, int) bool {
								return func(i, j int) bool {
									return msgs[i].(*envoy_endpoint_v3.ClusterLoadAssignment).ClusterName < msgs[j].(*envoy_endpoint_v3.ClusterLoadAssignment).ClusterName
								}
							},
						},
					}

					for _, entity := range entities {
						var msgs []proto.Message
						for _, e := range indexedResources.Index[entity.key] {
							msgs = append(msgs, e)
						}

						sort.Slice(msgs, entity.sorter(msgs))
						r, err := createResponse(entity.key, "00000001", "00000001", msgs)
						require.NoError(t, err)

						t.Run(entity.name, func(t *testing.T) {
							gotJSON := protoToJSON(t, r)

							require.JSONEq(t, goldenEnvoy(t,
								filepath.Join("builtin_extension", entity.name, tt.name),
								envoyVersion, latestEnvoyVersion, gotJSON), gotJSON)
						})
					}
				})
			}
		})
	}
}