// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        v6.33.2
// source: envoy/extensions/filters/http/oauth2/v3/oauth.proto

package oauth2v3

import (
	_ "github.com/cncf/xds/go/udpa/annotations"
	v31 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	v33 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
	v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
	v32 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
	_ "github.com/envoyproxy/protoc-gen-validate/validate"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	durationpb "google.golang.org/protobuf/types/known/durationpb"
	wrapperspb "google.golang.org/protobuf/types/known/wrapperspb"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

type CookieConfig_SameSite int32

const (
	CookieConfig_DISABLED CookieConfig_SameSite = 0
	CookieConfig_STRICT   CookieConfig_SameSite = 1
	CookieConfig_LAX      CookieConfig_SameSite = 2
	CookieConfig_NONE     CookieConfig_SameSite = 3
)

// Enum value maps for CookieConfig_SameSite.
var (
	CookieConfig_SameSite_name = map[int32]string{
		0: "DISABLED",
		1: "STRICT",
		2: "LAX",
		3: "NONE",
	}
	CookieConfig_SameSite_value = map[string]int32{
		"DISABLED": 0,
		"STRICT":   1,
		"LAX":      2,
		"NONE":     3,
	}
)

func (x CookieConfig_SameSite) Enum() *CookieConfig_SameSite {
	p := new(CookieConfig_SameSite)
	*p = x
	return p
}

func (x CookieConfig_SameSite) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (CookieConfig_SameSite) Descriptor() protoreflect.EnumDescriptor {
	return file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_enumTypes[0].Descriptor()
}

func (CookieConfig_SameSite) Type() protoreflect.EnumType {
	return &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_enumTypes[0]
}

func (x CookieConfig_SameSite) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use CookieConfig_SameSite.Descriptor instead.
func (CookieConfig_SameSite) EnumDescriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescGZIP(), []int{0, 0}
}

type OAuth2Config_AuthType int32

const (
	// The “client_id“ and “client_secret“ will be sent in the URL encoded request body.
	// This type should only be used when Auth server does not support Basic authentication.
	OAuth2Config_URL_ENCODED_BODY OAuth2Config_AuthType = 0
	// The “client_id“ and “client_secret“ will be sent using HTTP Basic authentication scheme.
	OAuth2Config_BASIC_AUTH OAuth2Config_AuthType = 1
	// The client will be authenticated using mutual TLS (mTLS) with a client certificate.
	// The “client_secret“ is not required and will not be sent in the request to the
	// authorization server.
	// The client certificate must be configured in the cluster used by “token_endpoint“ via
	// transport socket configuration.
	// This implements OAuth 2.0 Mutual-TLS Client Authentication as defined in RFC 8705.
	OAuth2Config_TLS_CLIENT_AUTH OAuth2Config_AuthType = 2
)

// Enum value maps for OAuth2Config_AuthType.
var (
	OAuth2Config_AuthType_name = map[int32]string{
		0: "URL_ENCODED_BODY",
		1: "BASIC_AUTH",
		2: "TLS_CLIENT_AUTH",
	}
	OAuth2Config_AuthType_value = map[string]int32{
		"URL_ENCODED_BODY": 0,
		"BASIC_AUTH":       1,
		"TLS_CLIENT_AUTH":  2,
	}
)

func (x OAuth2Config_AuthType) Enum() *OAuth2Config_AuthType {
	p := new(OAuth2Config_AuthType)
	*p = x
	return p
}

func (x OAuth2Config_AuthType) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (OAuth2Config_AuthType) Descriptor() protoreflect.EnumDescriptor {
	return file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_enumTypes[1].Descriptor()
}

func (OAuth2Config_AuthType) Type() protoreflect.EnumType {
	return &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_enumTypes[1]
}

func (x OAuth2Config_AuthType) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use OAuth2Config_AuthType.Descriptor instead.
func (OAuth2Config_AuthType) EnumDescriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescGZIP(), []int{3, 0}
}

// OAuth cookie configuration attributes.
type CookieConfig struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The value used for the SameSite cookie attribute.
	SameSite CookieConfig_SameSite `protobuf:"varint,1,opt,name=same_site,json=sameSite,proto3,enum=envoy.extensions.filters.http.oauth2.v3.CookieConfig_SameSite" json:"same_site,omitempty"`
	// The path attribute for the cookie.
	//
	// This controls the scope of the cookie and is useful for path-based routing scenarios
	// where different logical boundaries or applications may operate with different OAuth2 clients.
	// The CSRF cookie (nonce cookie) can be configured with a different path than session cookies
	// to support flows where the callback URL is on a different path.
	//
	// If not specified, defaults to “/“.
	Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
	// If true, the “Partitioned“ attribute will be set on the cookie.
	//
	// Modern browsers (Firefox, Chrome with third-party cookie deprecation) warn or block
	// "foreign" cookies unless they carry the “Partitioned“ attribute alongside “SameSite=None; Secure“.
	// When Envoy is used in a gateway/IdP flow that sets OAuth/OIDC cookies for a parent domain
	// (e.g., “Domain=.example.com“) while running on a different host, those cookies are
	// considered third-party and will be rejected without “Partitioned“.
	//
	// See `CHIPS <https://developers.google.com/privacy-sandbox/3pcd/chips>`_ for more information.
	//
	// Default is false.
	Partitioned   bool `protobuf:"varint,3,opt,name=partitioned,proto3" json:"partitioned,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CookieConfig) Reset() {
	*x = CookieConfig{}
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CookieConfig) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CookieConfig) ProtoMessage() {}

func (x *CookieConfig) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CookieConfig.ProtoReflect.Descriptor instead.
func (*CookieConfig) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescGZIP(), []int{0}
}

func (x *CookieConfig) GetSameSite() CookieConfig_SameSite {
	if x != nil {
		return x.SameSite
	}
	return CookieConfig_DISABLED
}

func (x *CookieConfig) GetPath() string {
	if x != nil {
		return x.Path
	}
	return ""
}

func (x *CookieConfig) GetPartitioned() bool {
	if x != nil {
		return x.Partitioned
	}
	return false
}

// [#next-free-field: 8]
type CookieConfigs struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Configuration for the bearer token cookie.
	BearerTokenCookieConfig *CookieConfig `protobuf:"bytes,1,opt,name=bearer_token_cookie_config,json=bearerTokenCookieConfig,proto3" json:"bearer_token_cookie_config,omitempty"`
	// Configuration for the OAuth HMAC cookie.
	OauthHmacCookieConfig *CookieConfig `protobuf:"bytes,2,opt,name=oauth_hmac_cookie_config,json=oauthHmacCookieConfig,proto3" json:"oauth_hmac_cookie_config,omitempty"`
	// Configuration for the OAuth expires cookie.
	OauthExpiresCookieConfig *CookieConfig `protobuf:"bytes,3,opt,name=oauth_expires_cookie_config,json=oauthExpiresCookieConfig,proto3" json:"oauth_expires_cookie_config,omitempty"`
	// Configuration for the ID token cookie.
	IdTokenCookieConfig *CookieConfig `protobuf:"bytes,4,opt,name=id_token_cookie_config,json=idTokenCookieConfig,proto3" json:"id_token_cookie_config,omitempty"`
	// Configuration for the refresh token cookie.
	RefreshTokenCookieConfig *CookieConfig `protobuf:"bytes,5,opt,name=refresh_token_cookie_config,json=refreshTokenCookieConfig,proto3" json:"refresh_token_cookie_config,omitempty"`
	// Configuration for the OAuth nonce cookie.
	OauthNonceCookieConfig *CookieConfig `protobuf:"bytes,6,opt,name=oauth_nonce_cookie_config,json=oauthNonceCookieConfig,proto3" json:"oauth_nonce_cookie_config,omitempty"`
	// Configuration for the code verifier cookie.
	CodeVerifierCookieConfig *CookieConfig `protobuf:"bytes,7,opt,name=code_verifier_cookie_config,json=codeVerifierCookieConfig,proto3" json:"code_verifier_cookie_config,omitempty"`
	unknownFields            protoimpl.UnknownFields
	sizeCache                protoimpl.SizeCache
}

func (x *CookieConfigs) Reset() {
	*x = CookieConfigs{}
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CookieConfigs) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CookieConfigs) ProtoMessage() {}

func (x *CookieConfigs) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CookieConfigs.ProtoReflect.Descriptor instead.
func (*CookieConfigs) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescGZIP(), []int{1}
}

func (x *CookieConfigs) GetBearerTokenCookieConfig() *CookieConfig {
	if x != nil {
		return x.BearerTokenCookieConfig
	}
	return nil
}

func (x *CookieConfigs) GetOauthHmacCookieConfig() *CookieConfig {
	if x != nil {
		return x.OauthHmacCookieConfig
	}
	return nil
}

func (x *CookieConfigs) GetOauthExpiresCookieConfig() *CookieConfig {
	if x != nil {
		return x.OauthExpiresCookieConfig
	}
	return nil
}

func (x *CookieConfigs) GetIdTokenCookieConfig() *CookieConfig {
	if x != nil {
		return x.IdTokenCookieConfig
	}
	return nil
}

func (x *CookieConfigs) GetRefreshTokenCookieConfig() *CookieConfig {
	if x != nil {
		return x.RefreshTokenCookieConfig
	}
	return nil
}

func (x *CookieConfigs) GetOauthNonceCookieConfig() *CookieConfig {
	if x != nil {
		return x.OauthNonceCookieConfig
	}
	return nil
}

func (x *CookieConfigs) GetCodeVerifierCookieConfig() *CookieConfig {
	if x != nil {
		return x.CodeVerifierCookieConfig
	}
	return nil
}

// [#next-free-field: 6]
type OAuth2Credentials struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The client_id to be used in the authorize calls. This value will be URL encoded when sent to the OAuth server.
	ClientId string `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// The secret used to retrieve the access token. This value will be URL encoded when sent to the OAuth server.
	// This field is required unless :ref:`auth_type <envoy_v3_api_field_extensions.filters.http.oauth2.v3.OAuth2Config.auth_type>`
	// is set to “TLS_CLIENT_AUTH“, in which case authentication is done via the client certificate.
	TokenSecret *v3.SdsSecretConfig `protobuf:"bytes,2,opt,name=token_secret,json=tokenSecret,proto3" json:"token_secret,omitempty"`
	// Configures how the secret token should be created.
	//
	// Types that are valid to be assigned to TokenFormation:
	//
	//	*OAuth2Credentials_HmacSecret
	TokenFormation isOAuth2Credentials_TokenFormation `protobuf_oneof:"token_formation"`
	// The cookie names used in OAuth filters flow.
	CookieNames *OAuth2Credentials_CookieNames `protobuf:"bytes,4,opt,name=cookie_names,json=cookieNames,proto3" json:"cookie_names,omitempty"`
	// The domain to set the cookie on. If not set, the cookie will default to the host of the request, not including the subdomains.
	// This is useful when token cookies need to be shared across multiple subdomains.
	CookieDomain  string `protobuf:"bytes,5,opt,name=cookie_domain,json=cookieDomain,proto3" json:"cookie_domain,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *OAuth2Credentials) Reset() {
	*x = OAuth2Credentials{}
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[2]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *OAuth2Credentials) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*OAuth2Credentials) ProtoMessage() {}

func (x *OAuth2Credentials) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[2]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use OAuth2Credentials.ProtoReflect.Descriptor instead.
func (*OAuth2Credentials) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescGZIP(), []int{2}
}

func (x *OAuth2Credentials) GetClientId() string {
	if x != nil {
		return x.ClientId
	}
	return ""
}

func (x *OAuth2Credentials) GetTokenSecret() *v3.SdsSecretConfig {
	if x != nil {
		return x.TokenSecret
	}
	return nil
}

func (x *OAuth2Credentials) GetTokenFormation() isOAuth2Credentials_TokenFormation {
	if x != nil {
		return x.TokenFormation
	}
	return nil
}

func (x *OAuth2Credentials) GetHmacSecret() *v3.SdsSecretConfig {
	if x != nil {
		if x, ok := x.TokenFormation.(*OAuth2Credentials_HmacSecret); ok {
			return x.HmacSecret
		}
	}
	return nil
}

func (x *OAuth2Credentials) GetCookieNames() *OAuth2Credentials_CookieNames {
	if x != nil {
		return x.CookieNames
	}
	return nil
}

func (x *OAuth2Credentials) GetCookieDomain() string {
	if x != nil {
		return x.CookieDomain
	}
	return ""
}

type isOAuth2Credentials_TokenFormation interface {
	isOAuth2Credentials_TokenFormation()
}

type OAuth2Credentials_HmacSecret struct {
	// If present, the secret token will be a HMAC using the provided secret.
	HmacSecret *v3.SdsSecretConfig `protobuf:"bytes,3,opt,name=hmac_secret,json=hmacSecret,proto3,oneof"`
}

func (*OAuth2Credentials_HmacSecret) isOAuth2Credentials_TokenFormation() {}

// OAuth config
//
// [#next-free-field: 28]
type OAuth2Config struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Endpoint on the authorization server to retrieve the access token from.
	TokenEndpoint *v31.HttpUri `protobuf:"bytes,1,opt,name=token_endpoint,json=tokenEndpoint,proto3" json:"token_endpoint,omitempty"`
	// Specifies the retry policy for requests to the OAuth server. If not specified, then no retries will be performed.
	RetryPolicy *v31.RetryPolicy `protobuf:"bytes,18,opt,name=retry_policy,json=retryPolicy,proto3" json:"retry_policy,omitempty"`
	// The endpoint redirect to for authorization in response to unauthorized requests.
	AuthorizationEndpoint string `protobuf:"bytes,2,opt,name=authorization_endpoint,json=authorizationEndpoint,proto3" json:"authorization_endpoint,omitempty"`
	// The endpoint at the authorization server to request the user be logged out of the Authorization server.
	// This field is optional and should be set only if openid is in the auth_scopes and the authorization server
	// supports the OpenID Connect RP-Initiated Logout specification.
	// For more information, see https://openid.net/specs/openid-connect-rpinitiated-1_0.html
	//
	// If configured, the OAuth2 filter will redirect users to this endpoint when they access the signout_path.
	EndSessionEndpoint string `protobuf:"bytes,23,opt,name=end_session_endpoint,json=endSessionEndpoint,proto3" json:"end_session_endpoint,omitempty"`
	// Credentials used for OAuth.
	Credentials *OAuth2Credentials `protobuf:"bytes,3,opt,name=credentials,proto3" json:"credentials,omitempty"`
	// The redirect URI passed to the authorization endpoint. Supports header formatting
	// tokens. For more information, including details on header value syntax, see the
	// documentation on :ref:`custom request headers <config_http_conn_man_headers_custom_request_headers>`.
	//
	// This URI should not contain any query parameters.
	RedirectUri string `protobuf:"bytes,4,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	// Matching criteria used to determine whether a path appears to be the result of a redirect from the authorization server.
	RedirectPathMatcher *v32.PathMatcher `protobuf:"bytes,5,opt,name=redirect_path_matcher,json=redirectPathMatcher,proto3" json:"redirect_path_matcher,omitempty"`
	// The path to sign a user out, clearing their credential cookies.
	SignoutPath *v32.PathMatcher `protobuf:"bytes,6,opt,name=signout_path,json=signoutPath,proto3" json:"signout_path,omitempty"`
	// Forward the OAuth token as a Bearer to upstream web service.
	ForwardBearerToken bool `protobuf:"varint,7,opt,name=forward_bearer_token,json=forwardBearerToken,proto3" json:"forward_bearer_token,omitempty"`
	// If set to true, preserve the existing authorization header.
	// By default the client strips the existing authorization header before forwarding upstream.
	// Can not be set to true if forward_bearer_token is already set to true.
	// Default value is false.
	PreserveAuthorizationHeader bool `protobuf:"varint,16,opt,name=preserve_authorization_header,json=preserveAuthorizationHeader,proto3" json:"preserve_authorization_header,omitempty"`
	// Any request that matches any of the provided matchers will be passed through without OAuth validation.
	PassThroughMatcher []*v33.HeaderMatcher `protobuf:"bytes,8,rep,name=pass_through_matcher,json=passThroughMatcher,proto3" json:"pass_through_matcher,omitempty"`
	// Optional list of OAuth scopes to be claimed in the authorization request. If not specified,
	// defaults to "user" scope.
	// OAuth RFC https://tools.ietf.org/html/rfc6749#section-3.3
	AuthScopes []string `protobuf:"bytes,9,rep,name=auth_scopes,json=authScopes,proto3" json:"auth_scopes,omitempty"`
	// Optional resource parameter for authorization request
	// RFC: https://tools.ietf.org/html/rfc8707
	Resources []string `protobuf:"bytes,10,rep,name=resources,proto3" json:"resources,omitempty"`
	// Defines how “client_id“ and “client_secret“ are sent in OAuth client to OAuth server requests.
	// RFC https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1
	AuthType OAuth2Config_AuthType `protobuf:"varint,11,opt,name=auth_type,json=authType,proto3,enum=envoy.extensions.filters.http.oauth2.v3.OAuth2Config_AuthType" json:"auth_type,omitempty"`
	// If set to true, allows automatic access token refresh using the associated refresh token (see
	// `RFC 6749 section 6 <https://datatracker.ietf.org/doc/html/rfc6749#section-6>`_), provided that the OAuth server supports that.
	// Default value is true.
	UseRefreshToken *wrapperspb.BoolValue `protobuf:"bytes,12,opt,name=use_refresh_token,json=useRefreshToken,proto3" json:"use_refresh_token,omitempty"`
	// The default lifetime in seconds of the access token, if omitted by the authorization server.
	//
	// If this value is not set, it will default to “0s“. In this case, the expiry must be set by
	// the authorization server or the OAuth flow will fail.
	DefaultExpiresIn *durationpb.Duration `protobuf:"bytes,13,opt,name=default_expires_in,json=defaultExpiresIn,proto3" json:"default_expires_in,omitempty"`
	// Any request that matches any of the provided matchers won't be redirected to OAuth server when tokens are not valid.
	// Automatic access token refresh will be performed for these requests, if enabled.
	// This behavior can be useful for AJAX requests.
	DenyRedirectMatcher []*v33.HeaderMatcher `protobuf:"bytes,14,rep,name=deny_redirect_matcher,json=denyRedirectMatcher,proto3" json:"deny_redirect_matcher,omitempty"`
	// The default lifetime in seconds of the refresh token, if the exp (expiration time) claim is omitted in the refresh token or the refresh token is not JWT.
	//
	// If this value is not set, it will default to “604800s“. In this case, the cookie with the refresh token will be expired
	// in a week.
	// This setting is only considered if “use_refresh_token“ is set to true, otherwise the authorization server expiration or “default_expires_in“ is used.
	DefaultRefreshTokenExpiresIn *durationpb.Duration `protobuf:"bytes,15,opt,name=default_refresh_token_expires_in,json=defaultRefreshTokenExpiresIn,proto3" json:"default_refresh_token_expires_in,omitempty"`
	// If set to true, the client will not set a cookie for ID Token even if one is received from the Identity Provider. This may be useful in cases where the ID
	// Token is too large for HTTP cookies (longer than 4096 characters). Enabling this option will only disable setting the cookie response header, the filter
	// will still process incoming ID Tokens as part of the HMAC if they are there. This is to ensure compatibility while switching this setting on. Future
	// sessions would not set the IdToken cookie header.
	DisableIdTokenSetCookie bool `protobuf:"varint,17,opt,name=disable_id_token_set_cookie,json=disableIdTokenSetCookie,proto3" json:"disable_id_token_set_cookie,omitempty"`
	// If set to true, the client will not set a cookie for Access Token even if one is received from the Identity Provider.
	// Enabling this option will only disable setting the cookie response header, the filter
	// will still process incoming Access Tokens as part of the HMAC if they are there. This is to ensure compatibility while switching this setting on. Future
	// sessions would not set the Access Token cookie header.
	DisableAccessTokenSetCookie bool `protobuf:"varint,19,opt,name=disable_access_token_set_cookie,json=disableAccessTokenSetCookie,proto3" json:"disable_access_token_set_cookie,omitempty"`
	// If set to true, the client will not set a cookie for Refresh Token even if one is received from the Identity Provider.
	// Enabling this option will only disable setting the cookie response header, the filter
	// will still process incoming Refresh Tokens as part of the HMAC if they are there. This is to ensure compatibility while switching this setting on. Future
	// sessions would not set the Refresh Token cookie header.
	DisableRefreshTokenSetCookie bool `protobuf:"varint,20,opt,name=disable_refresh_token_set_cookie,json=disableRefreshTokenSetCookie,proto3" json:"disable_refresh_token_set_cookie,omitempty"`
	// Controls for attributes that can be set on the cookies.
	CookieConfigs *CookieConfigs `protobuf:"bytes,21,opt,name=cookie_configs,json=cookieConfigs,proto3" json:"cookie_configs,omitempty"`
	// Optional additional prefix to use when emitting statistics.
	StatPrefix string `protobuf:"bytes,22,opt,name=stat_prefix,json=statPrefix,proto3" json:"stat_prefix,omitempty"`
	// Optional expiration time for the CSRF protection token cookie.
	// The CSRF token prevents cross-site request forgery attacks during the OAuth2 flow.
	// If not specified, defaults to “600s“ (10 minutes), which should provide sufficient time
	// for users to complete the OAuth2 authorization flow.
	CsrfTokenExpiresIn *durationpb.Duration `protobuf:"bytes,24,opt,name=csrf_token_expires_in,json=csrfTokenExpiresIn,proto3" json:"csrf_token_expires_in,omitempty"`
	// Optional expiration time for the code verifier cookie.
	// The code verifier is stored in a secure, HTTP-only cookie during the OAuth2 authorization process.
	// If not specified, defaults to “600s“ (10 minutes), which should provide sufficient time
	// for users to complete the OAuth2 authorization flow.
	CodeVerifierTokenExpiresIn *durationpb.Duration `protobuf:"bytes,25,opt,name=code_verifier_token_expires_in,json=codeVerifierTokenExpiresIn,proto3" json:"code_verifier_token_expires_in,omitempty"`
	// Disable token encryption. When set to true, both the access token and the ID token will be stored in plain text.
	// This option should only be used in secure environments where token encryption is not required.
	// Default is false (tokens are encrypted).
	DisableTokenEncryption bool `protobuf:"varint,26,opt,name=disable_token_encryption,json=disableTokenEncryption,proto3" json:"disable_token_encryption,omitempty"`
	// Any request that matches any of the provided matchers will be allowed to continue to upstream
	// even if OAuth validation fails (missing, invalid, or expired credentials).
	// This is useful for services that can handle both authenticated and unauthenticated requests,
	// enabling graceful degradation patterns.
	//
	// When triggered, all OAuth cookies are stripped from the request and the request proceeds as unauthenticated.
	// Context headers “x-envoy-oauth-status: failed“ and “x-envoy-oauth-failure-reason“ are added to inform upstream.
	//
	// Note: If a request matches pass_through_matcher, it bypasses OAuth validation and this matcher won't be evaluated.
	// This matcher takes precedence over deny_redirect_matcher.
	AllowFailedMatcher []*v33.HeaderMatcher `protobuf:"bytes,27,rep,name=allow_failed_matcher,json=allowFailedMatcher,proto3" json:"allow_failed_matcher,omitempty"`
	unknownFields      protoimpl.UnknownFields
	sizeCache          protoimpl.SizeCache
}

func (x *OAuth2Config) Reset() {
	*x = OAuth2Config{}
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[3]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *OAuth2Config) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*OAuth2Config) ProtoMessage() {}

func (x *OAuth2Config) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[3]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use OAuth2Config.ProtoReflect.Descriptor instead.
func (*OAuth2Config) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescGZIP(), []int{3}
}

func (x *OAuth2Config) GetTokenEndpoint() *v31.HttpUri {
	if x != nil {
		return x.TokenEndpoint
	}
	return nil
}

func (x *OAuth2Config) GetRetryPolicy() *v31.RetryPolicy {
	if x != nil {
		return x.RetryPolicy
	}
	return nil
}

func (x *OAuth2Config) GetAuthorizationEndpoint() string {
	if x != nil {
		return x.AuthorizationEndpoint
	}
	return ""
}

func (x *OAuth2Config) GetEndSessionEndpoint() string {
	if x != nil {
		return x.EndSessionEndpoint
	}
	return ""
}

func (x *OAuth2Config) GetCredentials() *OAuth2Credentials {
	if x != nil {
		return x.Credentials
	}
	return nil
}

func (x *OAuth2Config) GetRedirectUri() string {
	if x != nil {
		return x.RedirectUri
	}
	return ""
}

func (x *OAuth2Config) GetRedirectPathMatcher() *v32.PathMatcher {
	if x != nil {
		return x.RedirectPathMatcher
	}
	return nil
}

func (x *OAuth2Config) GetSignoutPath() *v32.PathMatcher {
	if x != nil {
		return x.SignoutPath
	}
	return nil
}

func (x *OAuth2Config) GetForwardBearerToken() bool {
	if x != nil {
		return x.ForwardBearerToken
	}
	return false
}

func (x *OAuth2Config) GetPreserveAuthorizationHeader() bool {
	if x != nil {
		return x.PreserveAuthorizationHeader
	}
	return false
}

func (x *OAuth2Config) GetPassThroughMatcher() []*v33.HeaderMatcher {
	if x != nil {
		return x.PassThroughMatcher
	}
	return nil
}

func (x *OAuth2Config) GetAuthScopes() []string {
	if x != nil {
		return x.AuthScopes
	}
	return nil
}

func (x *OAuth2Config) GetResources() []string {
	if x != nil {
		return x.Resources
	}
	return nil
}

func (x *OAuth2Config) GetAuthType() OAuth2Config_AuthType {
	if x != nil {
		return x.AuthType
	}
	return OAuth2Config_URL_ENCODED_BODY
}

func (x *OAuth2Config) GetUseRefreshToken() *wrapperspb.BoolValue {
	if x != nil {
		return x.UseRefreshToken
	}
	return nil
}

func (x *OAuth2Config) GetDefaultExpiresIn() *durationpb.Duration {
	if x != nil {
		return x.DefaultExpiresIn
	}
	return nil
}

func (x *OAuth2Config) GetDenyRedirectMatcher() []*v33.HeaderMatcher {
	if x != nil {
		return x.DenyRedirectMatcher
	}
	return nil
}

func (x *OAuth2Config) GetDefaultRefreshTokenExpiresIn() *durationpb.Duration {
	if x != nil {
		return x.DefaultRefreshTokenExpiresIn
	}
	return nil
}

func (x *OAuth2Config) GetDisableIdTokenSetCookie() bool {
	if x != nil {
		return x.DisableIdTokenSetCookie
	}
	return false
}

func (x *OAuth2Config) GetDisableAccessTokenSetCookie() bool {
	if x != nil {
		return x.DisableAccessTokenSetCookie
	}
	return false
}

func (x *OAuth2Config) GetDisableRefreshTokenSetCookie() bool {
	if x != nil {
		return x.DisableRefreshTokenSetCookie
	}
	return false
}

func (x *OAuth2Config) GetCookieConfigs() *CookieConfigs {
	if x != nil {
		return x.CookieConfigs
	}
	return nil
}

func (x *OAuth2Config) GetStatPrefix() string {
	if x != nil {
		return x.StatPrefix
	}
	return ""
}

func (x *OAuth2Config) GetCsrfTokenExpiresIn() *durationpb.Duration {
	if x != nil {
		return x.CsrfTokenExpiresIn
	}
	return nil
}

func (x *OAuth2Config) GetCodeVerifierTokenExpiresIn() *durationpb.Duration {
	if x != nil {
		return x.CodeVerifierTokenExpiresIn
	}
	return nil
}

func (x *OAuth2Config) GetDisableTokenEncryption() bool {
	if x != nil {
		return x.DisableTokenEncryption
	}
	return false
}

func (x *OAuth2Config) GetAllowFailedMatcher() []*v33.HeaderMatcher {
	if x != nil {
		return x.AllowFailedMatcher
	}
	return nil
}

// Per-route OAuth2 config.
//
// This message supplies an OAuth2Config for the matched route.
// It overrides the filter-level config for requests matching the route.
// If neither the global config nor a per-route config is specified, OAuth2 is disabled for the route.
type OAuth2PerRoute struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Full OAuth2 config for this route.
	Config        *OAuth2Config `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *OAuth2PerRoute) Reset() {
	*x = OAuth2PerRoute{}
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[4]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *OAuth2PerRoute) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*OAuth2PerRoute) ProtoMessage() {}

func (x *OAuth2PerRoute) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[4]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use OAuth2PerRoute.ProtoReflect.Descriptor instead.
func (*OAuth2PerRoute) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescGZIP(), []int{4}
}

func (x *OAuth2PerRoute) GetConfig() *OAuth2Config {
	if x != nil {
		return x.Config
	}
	return nil
}

// Filter config.
type OAuth2 struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The OAuth2 filter config.
	Config        *OAuth2Config `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *OAuth2) Reset() {
	*x = OAuth2{}
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[5]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *OAuth2) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*OAuth2) ProtoMessage() {}

func (x *OAuth2) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[5]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use OAuth2.ProtoReflect.Descriptor instead.
func (*OAuth2) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescGZIP(), []int{5}
}

func (x *OAuth2) GetConfig() *OAuth2Config {
	if x != nil {
		return x.Config
	}
	return nil
}

// [#next-free-field: 8]
type OAuth2Credentials_CookieNames struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Cookie name to hold OAuth bearer token value. When the authentication server validates the
	// client and returns an authorization token back to the OAuth filter, no matter what format
	// that token is, if :ref:`forward_bearer_token <envoy_v3_api_field_extensions.filters.http.oauth2.v3.OAuth2Config.forward_bearer_token>`
	// is set to true the filter will send over the bearer token as a cookie with this name to the
	// upstream. Defaults to “BearerToken“.
	BearerToken string `protobuf:"bytes,1,opt,name=bearer_token,json=bearerToken,proto3" json:"bearer_token,omitempty"`
	// Cookie name to hold OAuth HMAC value. Defaults to “OauthHMAC“.
	OauthHmac string `protobuf:"bytes,2,opt,name=oauth_hmac,json=oauthHmac,proto3" json:"oauth_hmac,omitempty"`
	// Cookie name to hold OAuth expiry value. Defaults to “OauthExpires“.
	OauthExpires string `protobuf:"bytes,3,opt,name=oauth_expires,json=oauthExpires,proto3" json:"oauth_expires,omitempty"`
	// Cookie name to hold the id token. Defaults to “IdToken“.
	IdToken string `protobuf:"bytes,4,opt,name=id_token,json=idToken,proto3" json:"id_token,omitempty"`
	// Cookie name to hold the refresh token. Defaults to “RefreshToken“.
	RefreshToken string `protobuf:"bytes,5,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
	// Cookie name to hold the nonce value. Defaults to “OauthNonce“.
	OauthNonce string `protobuf:"bytes,6,opt,name=oauth_nonce,json=oauthNonce,proto3" json:"oauth_nonce,omitempty"`
	// Cookie name to hold the PKCE code verifier. Defaults to “OauthCodeVerifier“.
	CodeVerifier  string `protobuf:"bytes,7,opt,name=code_verifier,json=codeVerifier,proto3" json:"code_verifier,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *OAuth2Credentials_CookieNames) Reset() {
	*x = OAuth2Credentials_CookieNames{}
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[6]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *OAuth2Credentials_CookieNames) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*OAuth2Credentials_CookieNames) ProtoMessage() {}

func (x *OAuth2Credentials_CookieNames) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[6]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use OAuth2Credentials_CookieNames.ProtoReflect.Descriptor instead.
func (*OAuth2Credentials_CookieNames) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescGZIP(), []int{2, 0}
}

func (x *OAuth2Credentials_CookieNames) GetBearerToken() string {
	if x != nil {
		return x.BearerToken
	}
	return ""
}

func (x *OAuth2Credentials_CookieNames) GetOauthHmac() string {
	if x != nil {
		return x.OauthHmac
	}
	return ""
}

func (x *OAuth2Credentials_CookieNames) GetOauthExpires() string {
	if x != nil {
		return x.OauthExpires
	}
	return ""
}

func (x *OAuth2Credentials_CookieNames) GetIdToken() string {
	if x != nil {
		return x.IdToken
	}
	return ""
}

func (x *OAuth2Credentials_CookieNames) GetRefreshToken() string {
	if x != nil {
		return x.RefreshToken
	}
	return ""
}

func (x *OAuth2Credentials_CookieNames) GetOauthNonce() string {
	if x != nil {
		return x.OauthNonce
	}
	return ""
}

func (x *OAuth2Credentials_CookieNames) GetCodeVerifier() string {
	if x != nil {
		return x.CodeVerifier
	}
	return ""
}

var File_envoy_extensions_filters_http_oauth2_v3_oauth_proto protoreflect.FileDescriptor

const file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDesc = "" +
	"\n" +
	"3envoy/extensions/filters/http/oauth2/v3/oauth.proto\x12'envoy.extensions.filters.http.oauth2.v3\x1a\x1fenvoy/config/core/v3/base.proto\x1a#envoy/config/core/v3/http_uri.proto\x1a,envoy/config/route/v3/route_components.proto\x1a6envoy/extensions/transport_sockets/tls/v3/secret.proto\x1a envoy/type/matcher/v3/path.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a\x1dudpa/annotations/status.proto\x1a\x17validate/validate.proto\"\x8c\x02\n" +
	"\fCookieConfig\x12e\n" +
	"\tsame_site\x18\x01 \x01(\x0e2>.envoy.extensions.filters.http.oauth2.v3.CookieConfig.SameSiteB\b\xfaB\x05\x82\x01\x02\x10\x01R\bsameSite\x12:\n" +
	"\x04path\x18\x02 \x01(\tB&\xfaB#r!2\x1f^$|^/[^\\x00-\\x1f\\x7f \",;<>\\\\]*$R\x04path\x12 \n" +
	"\vpartitioned\x18\x03 \x01(\bR\vpartitioned\"7\n" +
	"\bSameSite\x12\f\n" +
	"\bDISABLED\x10\x00\x12\n" +
	"\n" +
	"\x06STRICT\x10\x01\x12\a\n" +
	"\x03LAX\x10\x02\x12\b\n" +
	"\x04NONE\x10\x03\"\xb3\x06\n" +
	"\rCookieConfigs\x12r\n" +
	"\x1abearer_token_cookie_config\x18\x01 \x01(\v25.envoy.extensions.filters.http.oauth2.v3.CookieConfigR\x17bearerTokenCookieConfig\x12n\n" +
	"\x18oauth_hmac_cookie_config\x18\x02 \x01(\v25.envoy.extensions.filters.http.oauth2.v3.CookieConfigR\x15oauthHmacCookieConfig\x12t\n" +
	"\x1boauth_expires_cookie_config\x18\x03 \x01(\v25.envoy.extensions.filters.http.oauth2.v3.CookieConfigR\x18oauthExpiresCookieConfig\x12j\n" +
	"\x16id_token_cookie_config\x18\x04 \x01(\v25.envoy.extensions.filters.http.oauth2.v3.CookieConfigR\x13idTokenCookieConfig\x12t\n" +
	"\x1brefresh_token_cookie_config\x18\x05 \x01(\v25.envoy.extensions.filters.http.oauth2.v3.CookieConfigR\x18refreshTokenCookieConfig\x12p\n" +
	"\x19oauth_nonce_cookie_config\x18\x06 \x01(\v25.envoy.extensions.filters.http.oauth2.v3.CookieConfigR\x16oauthNonceCookieConfig\x12t\n" +
	"\x1bcode_verifier_cookie_config\x18\a \x01(\v25.envoy.extensions.filters.http.oauth2.v3.CookieConfigR\x18codeVerifierCookieConfig\"\xa8\x06\n" +
	"\x11OAuth2Credentials\x12$\n" +
	"\tclient_id\x18\x01 \x01(\tB\a\xfaB\x04r\x02\x10\x01R\bclientId\x12]\n" +
	"\ftoken_secret\x18\x02 \x01(\v2:.envoy.extensions.transport_sockets.tls.v3.SdsSecretConfigR\vtokenSecret\x12g\n" +
	"\vhmac_secret\x18\x03 \x01(\v2:.envoy.extensions.transport_sockets.tls.v3.SdsSecretConfigB\b\xfaB\x05\x8a\x01\x02\x10\x01H\x00R\n" +
	"hmacSecret\x12i\n" +
	"\fcookie_names\x18\x04 \x01(\v2F.envoy.extensions.filters.http.oauth2.v3.OAuth2Credentials.CookieNamesR\vcookieNames\x12J\n" +
	"\rcookie_domain\x18\x05 \x01(\tB%\xfaB\"r 2\x1e^$|^[^\\x00-\\x1f\\x7f \",;<>\\\\]+$R\fcookieDomain\x1a\xd5\x02\n" +
	"\vCookieNames\x12.\n" +
	"\fbearer_token\x18\x01 \x01(\tB\v\xfaB\br\x06\xd0\x01\x01\xc0\x01\x01R\vbearerToken\x12*\n" +
	"\n" +
	"oauth_hmac\x18\x02 \x01(\tB\v\xfaB\br\x06\xd0\x01\x01\xc0\x01\x01R\toauthHmac\x120\n" +
	"\roauth_expires\x18\x03 \x01(\tB\v\xfaB\br\x06\xd0\x01\x01\xc0\x01\x01R\foauthExpires\x12&\n" +
	"\bid_token\x18\x04 \x01(\tB\v\xfaB\br\x06\xd0\x01\x01\xc0\x01\x01R\aidToken\x120\n" +
	"\rrefresh_token\x18\x05 \x01(\tB\v\xfaB\br\x06\xd0\x01\x01\xc0\x01\x01R\frefreshToken\x12,\n" +
	"\voauth_nonce\x18\x06 \x01(\tB\v\xfaB\br\x06\xd0\x01\x01\xc0\x01\x01R\n" +
	"oauthNonce\x120\n" +
	"\rcode_verifier\x18\a \x01(\tB\v\xfaB\br\x06\xd0\x01\x01\xc0\x01\x01R\fcodeVerifierB\x16\n" +
	"\x0ftoken_formation\x12\x03\xf8B\x01\"\xe7\x0f\n" +
	"\fOAuth2Config\x12D\n" +
	"\x0etoken_endpoint\x18\x01 \x01(\v2\x1d.envoy.config.core.v3.HttpUriR\rtokenEndpoint\x12D\n" +
	"\fretry_policy\x18\x12 \x01(\v2!.envoy.config.core.v3.RetryPolicyR\vretryPolicy\x12>\n" +
	"\x16authorization_endpoint\x18\x02 \x01(\tB\a\xfaB\x04r\x02\x10\x01R\x15authorizationEndpoint\x120\n" +
	"\x14end_session_endpoint\x18\x17 \x01(\tR\x12endSessionEndpoint\x12f\n" +
	"\vcredentials\x18\x03 \x01(\v2:.envoy.extensions.filters.http.oauth2.v3.OAuth2CredentialsB\b\xfaB\x05\x8a\x01\x02\x10\x01R\vcredentials\x12*\n" +
	"\fredirect_uri\x18\x04 \x01(\tB\a\xfaB\x04r\x02\x10\x01R\vredirectUri\x12`\n" +
	"\x15redirect_path_matcher\x18\x05 \x01(\v2\".envoy.type.matcher.v3.PathMatcherB\b\xfaB\x05\x8a\x01\x02\x10\x01R\x13redirectPathMatcher\x12O\n" +
	"\fsignout_path\x18\x06 \x01(\v2\".envoy.type.matcher.v3.PathMatcherB\b\xfaB\x05\x8a\x01\x02\x10\x01R\vsignoutPath\x120\n" +
	"\x14forward_bearer_token\x18\a \x01(\bR\x12forwardBearerToken\x12B\n" +
	"\x1dpreserve_authorization_header\x18\x10 \x01(\bR\x1bpreserveAuthorizationHeader\x12V\n" +
	"\x14pass_through_matcher\x18\b \x03(\v2$.envoy.config.route.v3.HeaderMatcherR\x12passThroughMatcher\x12\x1f\n" +
	"\vauth_scopes\x18\t \x03(\tR\n" +
	"authScopes\x12\x1c\n" +
	"\tresources\x18\n" +
	" \x03(\tR\tresources\x12e\n" +
	"\tauth_type\x18\v \x01(\x0e2>.envoy.extensions.filters.http.oauth2.v3.OAuth2Config.AuthTypeB\b\xfaB\x05\x82\x01\x02\x10\x01R\bauthType\x12F\n" +
	"\x11use_refresh_token\x18\f \x01(\v2\x1a.google.protobuf.BoolValueR\x0fuseRefreshToken\x12G\n" +
	"\x12default_expires_in\x18\r \x01(\v2\x19.google.protobuf.DurationR\x10defaultExpiresIn\x12X\n" +
	"\x15deny_redirect_matcher\x18\x0e \x03(\v2$.envoy.config.route.v3.HeaderMatcherR\x13denyRedirectMatcher\x12a\n" +
	" default_refresh_token_expires_in\x18\x0f \x01(\v2\x19.google.protobuf.DurationR\x1cdefaultRefreshTokenExpiresIn\x12<\n" +
	"\x1bdisable_id_token_set_cookie\x18\x11 \x01(\bR\x17disableIdTokenSetCookie\x12D\n" +
	"\x1fdisable_access_token_set_cookie\x18\x13 \x01(\bR\x1bdisableAccessTokenSetCookie\x12F\n" +
	" disable_refresh_token_set_cookie\x18\x14 \x01(\bR\x1cdisableRefreshTokenSetCookie\x12]\n" +
	"\x0ecookie_configs\x18\x15 \x01(\v26.envoy.extensions.filters.http.oauth2.v3.CookieConfigsR\rcookieConfigs\x12\x1f\n" +
	"\vstat_prefix\x18\x16 \x01(\tR\n" +
	"statPrefix\x12L\n" +
	"\x15csrf_token_expires_in\x18\x18 \x01(\v2\x19.google.protobuf.DurationR\x12csrfTokenExpiresIn\x12]\n" +
	"\x1ecode_verifier_token_expires_in\x18\x19 \x01(\v2\x19.google.protobuf.DurationR\x1acodeVerifierTokenExpiresIn\x128\n" +
	"\x18disable_token_encryption\x18\x1a \x01(\bR\x16disableTokenEncryption\x12V\n" +
	"\x14allow_failed_matcher\x18\x1b \x03(\v2$.envoy.config.route.v3.HeaderMatcherR\x12allowFailedMatcher\"E\n" +
	"\bAuthType\x12\x14\n" +
	"\x10URL_ENCODED_BODY\x10\x00\x12\x0e\n" +
	"\n" +
	"BASIC_AUTH\x10\x01\x12\x13\n" +
	"\x0fTLS_CLIENT_AUTH\x10\x02\"i\n" +
	"\x0eOAuth2PerRoute\x12W\n" +
	"\x06config\x18\x01 \x01(\v25.envoy.extensions.filters.http.oauth2.v3.OAuth2ConfigB\b\xfaB\x05\x8a\x01\x02\x10\x01R\x06config\"W\n" +
	"\x06OAuth2\x12M\n" +
	"\x06config\x18\x01 \x01(\v25.envoy.extensions.filters.http.oauth2.v3.OAuth2ConfigR\x06configB\xa6\x01\xba\x80\xc8\xd1\x06\x02\x10\x02\n" +
	"5io.envoyproxy.envoy.extensions.filters.http.oauth2.v3B\n" +
	"OauthProtoP\x01ZWgithub.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/oauth2/v3;oauth2v3b\x06proto3"

var (
	file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescOnce sync.Once
	file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescData []byte
)

func file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescGZIP() []byte {
	file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescOnce.Do(func() {
		file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDesc), len(file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDesc)))
	})
	return file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDescData
}

var file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
var file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
var file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_goTypes = []any{
	(CookieConfig_SameSite)(0),            // 0: envoy.extensions.filters.http.oauth2.v3.CookieConfig.SameSite
	(OAuth2Config_AuthType)(0),            // 1: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.AuthType
	(*CookieConfig)(nil),                  // 2: envoy.extensions.filters.http.oauth2.v3.CookieConfig
	(*CookieConfigs)(nil),                 // 3: envoy.extensions.filters.http.oauth2.v3.CookieConfigs
	(*OAuth2Credentials)(nil),             // 4: envoy.extensions.filters.http.oauth2.v3.OAuth2Credentials
	(*OAuth2Config)(nil),                  // 5: envoy.extensions.filters.http.oauth2.v3.OAuth2Config
	(*OAuth2PerRoute)(nil),                // 6: envoy.extensions.filters.http.oauth2.v3.OAuth2PerRoute
	(*OAuth2)(nil),                        // 7: envoy.extensions.filters.http.oauth2.v3.OAuth2
	(*OAuth2Credentials_CookieNames)(nil), // 8: envoy.extensions.filters.http.oauth2.v3.OAuth2Credentials.CookieNames
	(*v3.SdsSecretConfig)(nil),            // 9: envoy.extensions.transport_sockets.tls.v3.SdsSecretConfig
	(*v31.HttpUri)(nil),                   // 10: envoy.config.core.v3.HttpUri
	(*v31.RetryPolicy)(nil),               // 11: envoy.config.core.v3.RetryPolicy
	(*v32.PathMatcher)(nil),               // 12: envoy.type.matcher.v3.PathMatcher
	(*v33.HeaderMatcher)(nil),             // 13: envoy.config.route.v3.HeaderMatcher
	(*wrapperspb.BoolValue)(nil),          // 14: google.protobuf.BoolValue
	(*durationpb.Duration)(nil),           // 15: google.protobuf.Duration
}
var file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_depIdxs = []int32{
	0,  // 0: envoy.extensions.filters.http.oauth2.v3.CookieConfig.same_site:type_name -> envoy.extensions.filters.http.oauth2.v3.CookieConfig.SameSite
	2,  // 1: envoy.extensions.filters.http.oauth2.v3.CookieConfigs.bearer_token_cookie_config:type_name -> envoy.extensions.filters.http.oauth2.v3.CookieConfig
	2,  // 2: envoy.extensions.filters.http.oauth2.v3.CookieConfigs.oauth_hmac_cookie_config:type_name -> envoy.extensions.filters.http.oauth2.v3.CookieConfig
	2,  // 3: envoy.extensions.filters.http.oauth2.v3.CookieConfigs.oauth_expires_cookie_config:type_name -> envoy.extensions.filters.http.oauth2.v3.CookieConfig
	2,  // 4: envoy.extensions.filters.http.oauth2.v3.CookieConfigs.id_token_cookie_config:type_name -> envoy.extensions.filters.http.oauth2.v3.CookieConfig
	2,  // 5: envoy.extensions.filters.http.oauth2.v3.CookieConfigs.refresh_token_cookie_config:type_name -> envoy.extensions.filters.http.oauth2.v3.CookieConfig
	2,  // 6: envoy.extensions.filters.http.oauth2.v3.CookieConfigs.oauth_nonce_cookie_config:type_name -> envoy.extensions.filters.http.oauth2.v3.CookieConfig
	2,  // 7: envoy.extensions.filters.http.oauth2.v3.CookieConfigs.code_verifier_cookie_config:type_name -> envoy.extensions.filters.http.oauth2.v3.CookieConfig
	9,  // 8: envoy.extensions.filters.http.oauth2.v3.OAuth2Credentials.token_secret:type_name -> envoy.extensions.transport_sockets.tls.v3.SdsSecretConfig
	9,  // 9: envoy.extensions.filters.http.oauth2.v3.OAuth2Credentials.hmac_secret:type_name -> envoy.extensions.transport_sockets.tls.v3.SdsSecretConfig
	8,  // 10: envoy.extensions.filters.http.oauth2.v3.OAuth2Credentials.cookie_names:type_name -> envoy.extensions.filters.http.oauth2.v3.OAuth2Credentials.CookieNames
	10, // 11: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.token_endpoint:type_name -> envoy.config.core.v3.HttpUri
	11, // 12: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.retry_policy:type_name -> envoy.config.core.v3.RetryPolicy
	4,  // 13: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.credentials:type_name -> envoy.extensions.filters.http.oauth2.v3.OAuth2Credentials
	12, // 14: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.redirect_path_matcher:type_name -> envoy.type.matcher.v3.PathMatcher
	12, // 15: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.signout_path:type_name -> envoy.type.matcher.v3.PathMatcher
	13, // 16: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.pass_through_matcher:type_name -> envoy.config.route.v3.HeaderMatcher
	1,  // 17: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.auth_type:type_name -> envoy.extensions.filters.http.oauth2.v3.OAuth2Config.AuthType
	14, // 18: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.use_refresh_token:type_name -> google.protobuf.BoolValue
	15, // 19: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.default_expires_in:type_name -> google.protobuf.Duration
	13, // 20: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.deny_redirect_matcher:type_name -> envoy.config.route.v3.HeaderMatcher
	15, // 21: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.default_refresh_token_expires_in:type_name -> google.protobuf.Duration
	3,  // 22: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.cookie_configs:type_name -> envoy.extensions.filters.http.oauth2.v3.CookieConfigs
	15, // 23: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.csrf_token_expires_in:type_name -> google.protobuf.Duration
	15, // 24: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.code_verifier_token_expires_in:type_name -> google.protobuf.Duration
	13, // 25: envoy.extensions.filters.http.oauth2.v3.OAuth2Config.allow_failed_matcher:type_name -> envoy.config.route.v3.HeaderMatcher
	5,  // 26: envoy.extensions.filters.http.oauth2.v3.OAuth2PerRoute.config:type_name -> envoy.extensions.filters.http.oauth2.v3.OAuth2Config
	5,  // 27: envoy.extensions.filters.http.oauth2.v3.OAuth2.config:type_name -> envoy.extensions.filters.http.oauth2.v3.OAuth2Config
	28, // [28:28] is the sub-list for method output_type
	28, // [28:28] is the sub-list for method input_type
	28, // [28:28] is the sub-list for extension type_name
	28, // [28:28] is the sub-list for extension extendee
	0,  // [0:28] is the sub-list for field type_name
}

func init() { file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_init() }
func file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_init() {
	if File_envoy_extensions_filters_http_oauth2_v3_oauth_proto != nil {
		return
	}
	file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes[2].OneofWrappers = []any{
		(*OAuth2Credentials_HmacSecret)(nil),
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDesc), len(file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_rawDesc)),
			NumEnums:      2,
			NumMessages:   7,
			NumExtensions: 0,
			NumServices:   0,
		},
		GoTypes:           file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_goTypes,
		DependencyIndexes: file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_depIdxs,
		EnumInfos:         file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_enumTypes,
		MessageInfos:      file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_msgTypes,
	}.Build()
	File_envoy_extensions_filters_http_oauth2_v3_oauth_proto = out.File
	file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_goTypes = nil
	file_envoy_extensions_filters_http_oauth2_v3_oauth_proto_depIdxs = nil
}
