@Override
    public void getConfig(CloudTokenDataPlaneFilterConfig.Builder builder) {
        var clientsCfg = clients.stream()
                .filter(c -> !c.tokens().isEmpty())
                .map(x -> new CloudTokenDataPlaneFilterConfig.Clients.Builder()
                        .id(x.id())
                        .tokens(tokensConfig(x.tokens()))
                        .permissions(x.permissions().stream().map(Client.Permission::asString).sorted().toList()))
                .toList();
        builder.clients(clientsCfg).tokenContext(tokenContext);
    }
@Test
    void generates_correct_config_for_tokens() throws IOException {
        var certFile = securityFolder.resolve("foo.pem");
        var clusterElem = DomBuilderTest.parse(servicesXmlTemplate.formatted(applicationFolder.toPath().relativize(certFile).toString()));
        createCertificate(certFile);
        buildModel(Set.of(tokenEndpoint, mtlsEndpoint), defaultTokens, clusterElem);

        var cfg = root.getConfig(CloudTokenDataPlaneFilterConfig.class, filterConfigId);
        var tokenClient = cfg.clients().stream().filter(c -> c.id().equals("bar")).findAny().orElse(null);
        assertNotNull(tokenClient);
        assertEquals(List.of("read"), tokenClient.permissions());
        var expectedTokenCfg = tokenConfig(
                "my-token", List.of("myfingerprint1", "myfingerprint2"), List.of("myaccesshash1", "myaccesshash2"),
                List.of("<none>", "2243-10-17T00:00:00Z"));
        assertEquals(List.of(expectedTokenCfg), tokenClient.tokens());
    }