#include "source/common/config/well_known_names.h"

#include "absl/strings/str_replace.h"

namespace Envoy {

namespace Config {

namespace {

const absl::string_view TAG_VALUE_REGEX = R"([^\.]+)";

// To allow for more readable regular expressions to be declared below, and to

// reduce duplication, define a few common pattern substitutions for regex

// segments.

              // Cipher names can contain alphanumerics with dashes and

              // underscores.

              // TLS version strings are always of the form "TLSv1.3".

              // A generic name can contain any character except dots.

              // Route names may contain dots and slashes in addition to

              // alphanumerics, underscores, and dashes.

              // Scoped Route names are named similarly to route config names.

              // Match a prefix that is either a listener plus name or cluster plus name

} // namespace

  // Note: the default regexes are defined below in the order that they will typically be matched

  // (see the TagExtractor class definition for an explanation of the iterative matching process).

  // This ordering is roughly from most specific to least specific. Despite the fact that these

  // regexes are defined with a particular ordering in mind, users can customize the ordering of the

  // processing of the default tag extraction regexes and include custom tags with regexes via the

  // bootstrap configuration. Because of this flexibility, these regexes are designed to not

  // interfere with one another no matter the ordering. They are tested in forward and reverse

  // ordering to ensure they will be safe in most ordering configurations.

  // To give a more user-friendly explanation of the intended behavior of each regex, each is

  // preceded by a comment with a simplified notation to explain what the regex is designed to

  // match:

  // - The text that the regex is intended to capture will be enclosed in ().

  // - Other default tags that are expected to exist in the name (and may or may not have been

  // removed before this regex has been applied) are enclosed in [].

  // - Stand-ins for a variable segment of the name (including inside capture groups) will be

  // enclosed in <>.

  // - Typical * notation will be used to denote an arbitrary set of characters.

  // *_rq(_<response_code>)

  // *_rq_(<response_code_class>)xx

  // http.[<stat_prefix>.]dynamodb.table.[<table_name>.]capacity.[<operation_name>.](__partition_id=<last_seven_characters_from_partition_id>)

  // http.[<stat_prefix>.]dynamodb.operation.(<operation_name>.)* or

  // http.[<stat_prefix>.]dynamodb.table.[<table_name>.]capacity.(<operation_name>.)[<partition_id>]

  // mongo.[<stat_prefix>.]collection.[<collection>.]callsite.(<callsite>.)query.*

  // http.[<stat_prefix>.]dynamodb.table.(<table_name>.)* or

  // http.[<stat_prefix>.]dynamodb.error.(<table_name>.)*

  // mongo.[<stat_prefix>.]collection.(<collection>.)query.*

  // mongo.[<stat_prefix>.]cmd.(<cmd>.)*

  // cluster.[<route_target_cluster>.]grpc.[<grpc_service>.](<grpc_method>.)*

  // http.[<stat_prefix>.]user_agent.(<user_agent>.)*

  // vhost.[<virtual host name>.]vcluster.(<virtual_cluster_name>.)*

  // http.[<stat_prefix>.]fault.(<downstream_cluster>.)*

  // listener.[<address>.]ssl.ciphers.(<cipher>)

  // Curves and ciphers have the same pattern so they use the same regex.

  // listener.[<address>.]ssl.curves.(<curve>)

  // Signing algorithms and ciphers have the same pattern so they use the same regex.

  // listener.[<address>.]ssl.sigalgs.(<algorithm>)

  // listener.[<address>.]ssl.versions.(<version>)

  // cluster.[<cluster_name>.]ssl.ciphers.(<cipher>)

  // cluster.[<route_target_cluster>.]grpc.(<grpc_service>.)*

  // tcp.(<stat_prefix>.)*

  // udp.(<stat_prefix>.)*

  // auth.clientssl.(<stat_prefix>.)*

  // ratelimit.(<stat_prefix>.)*

  // cluster.(<cluster_name>.)*

  // listener.[<address>.]http.(<stat_prefix>.)*

  // The <address> part can be anything here (.*?) for the sake of a simpler

  // internal state of the regex which performs better.

  // Extract ext_authz stat_prefix field

  // cluster.[<cluster>.]ext_authz.[<ext_authz_prefix>.]*

  // http.[<http_conn_mgr_prefix>.]ext_authz.[<ext_authz_prefix>.]*

  // http.(<stat_prefix>.)*

  // listener.<address|stat_prefix>.(worker_<id>.)*

  // listener_manager.(worker_<id>.)*

  // server.(worker_<id>.)*

  // thread_local_cluster_manager.(worker_<id>.)*

  // listener.(<address|stat_prefix>.)*, but specifically excluding "admin"

  // vhost.(<virtual host name>.)*

  // mongo.(<stat_prefix>.)*

  // http.[<stat_prefix>.]rds.(<route_config_name>.)<base_stat>

  // Note: <route_config_name> can contain dots thus we have to maintain full

  // match.

  // http.[<stat_prefix>.]scoped_rds.(<scoped_route_config_name>.)<base_stat>

  // vhost.[<virtual host name>.]route.(<route_stat_prefix>.)*

  // thrift.(<stat_prefix>.)*

  // redis.(<stat_prefix>.)*

  // (<stat_prefix>.).http_local_rate_limit.**

  // local_rate_limit.(<stat_prefix>.)

  // listener_local_rate_limit.(<stat_prefix>.)

  // dns_filter.(<stat_prefix>.).**

  // connection_limit.(<stat_prefix>.)*

  // http.[<stat_prefix>.]rbac.[<optional stat_prefix>]policy.(<policy

  // name>.).(allowed|shadow_allowed|denied|shadow_denied)

  // (<stat_prefix>.).rbac.**

  // http.<stat_prefix>.rbac.(<rules_stat_prefix>.)* but excluding policy

  // proxy_proto.(<stat_prefix>.)**

  // proxy_proto.([<optional stat_prefix>.]versions.v(<version_number>).)(found|disallowed|error)

  //

  // Strips out:  [<optional stat_prefix>.]versions.v(<version_number>).

  // Leaving: proxy_proto.(found|disallowed|error)

  // grpc.(<stat_prefix>).**

  // listener.[<address>.]ssl.certificate.(<cert_name>).<metric_name> or

  // cluster.[<cluster_name>.]ssl.certificate.(<cert_name>).<metric_name>

  // sds.[<resource_name>.]**

void TagNameValues::addRe2(const std::string& name, const std::string& regex,

} // namespace Config

} // namespace Envoy