Repository: envoyproxy/envoy
File: test/extensions/filters/http/proto_api_scrubber/integration_test.cc (C++)

Code before:
                              RestrictionType type = RestrictionType::Request,
                              const std::string& cel_matcher_proto_text = kCelAlwaysTrue) {

    std::string full_config_text;
    if (method_name.empty() || field_to_scrub.empty()) {
      // Simple config with just descriptor
      full_config_text = fmt::format(
          R"pb(
            filtering_mode: OVERRIDE
            descriptor_set {{ data_source {{ filename: "{0}" }} }}
          )pb",
          descriptor_path);
    } else {
      std::string restriction_key = (type == RestrictionType::Request)
                                        ? "request_field_restrictions"
                                        : "response_field_restrictions";

      // Format the full config.
      full_config_text = fmt::format(R"pb(
      filtering_mode: OVERRIDE
      descriptor_set {{
        data_source {{
          filename: "{0}"
        }}
      }}
      restrictions {{
        method_restrictions {{
          key: "{1}"
          value {{
            {2} {{
              key: "{3}"
              value {{
                matcher {{
                  matcher_list {{
                    matchers {{
                      predicate {{
                        single_predicate {{
                          input {{
                            name: "envoy.matching.inputs.cel_data_input"
                            typed_config {{
                              [type.googleapis.com/xds.type.matcher.v3.HttpAttributesCelMatchInput] {{}}
                            }}
                          }}
                          custom_match {{
                            name: "envoy.matching.matchers.cel_matcher"
                            typed_config {{
                              [type.googleapis.com/xds.type.matcher.v3.CelMatcher] {{
                                expr_match {{
                                  {4}
                                }}
                              }}

Review comment (suggestion):
nit: use yaml instead of this (no need for double curly brackets everywhere, and makes the code a bit more concise - [example](https://github.com/envoyproxy/envoy/blob/716a49650f551c6211a196f5828a5a6deaf5080c/test/integration/extension_discovery_integration_test.cc#L27)).

Code after:
                  RestrictionType type = RestrictionType::Request,
                  const xds::type::matcher::v3::Matcher::MatcherList::Predicate& match_predicate =
                      buildCelPredicate("true")) {
    std::string full_config_text;
    if (method_name.empty() || field_to_scrub.empty()) {
      full_config_text = fmt::format(R"pb(
      filtering_mode: OVERRIDE
      descriptor_set {{ data_source {{ filename: "{0}" }} }}
    )pb",
                                     descriptor_path);
    } else {
      std::string restriction_key = (type == RestrictionType::Request)
                                        ? "request_field_restrictions"
                                        : "response_field_restrictions";

      // Build the Matcher
      xds::type::matcher::v3::Matcher matcher_proto;
      auto* matcher_entry = matcher_proto.mutable_matcher_list()->add_matchers();
      *matcher_entry->mutable_predicate() = match_predicate;
      envoy::extensions::filters::http::proto_api_scrubber::v3::RemoveFieldAction remove_action;
      matcher_entry->mutable_on_match()->mutable_action()->mutable_typed_config()->PackFrom(
          remove_action);
      matcher_entry->mutable_on_match()->mutable_action()->set_name("remove_field");

      full_config_text = fmt::format(R"pb(
      filtering_mode: OVERRIDE
      descriptor_set {{
        data_source {{ filename: "{0}" }}
      }}
      restrictions {{
        method_restrictions {{
          key: "{1}"
          value {{
            {2} {{
              key: "{3}"
              value {{
                matcher {{ {4} }}
              }}
            }}
          }}
        }}
      }}
    )pb",
                                     descriptor_path,            // {0}
                                     method_name,                // {1}
                                     restriction_key,            // {2}
                                     field_to_scrub,             // {3}
                                     matcher_proto.DebugString() // {4} Inject the Generic Matcher
      );
    }