test := test
		t.Run("", func(t *testing.T) {
			contains := containsReservedMetadata(test.header)
			if contains && !test.shouldFail {
				t.Errorf("contains reserved header but should not fail")
			} else if !contains && test.shouldFail {
				t.Errorf("does not contain reserved header but failed")
			}
		})
	}
}

var sseTLSHandlerTests = []struct {
	URL               *url.URL
	Header            http.Header

		Message:    "Invalid remote tier credentials",
		StatusCode: http.StatusBadRequest,
	}
	// error returned when reserved internal names are used.
	errTierReservedName = AdminError{
		Code:       "XMinioAdminTierReserved",
		Message:    "Cannot use reserved tier name",
		StatusCode: http.StatusBadRequest,
	}
)

func (api adminAPIHandlers) AddTierHandler(w http.ResponseWriter, r *http.Request) {

		return ErrAlreadyLocked
	}
	return err
}

func lockFileEx(h syscall.Handle, flags, locklow, lockhigh uint32, ol *syscall.Overlapped) (err error) {
	reserved := uint32(0)
	r1, _, e1 := syscall.Syscall6(procLockFileEx.Addr(), 6, uintptr(h), uintptr(flags),
		uintptr(reserved), uintptr(locklow), uintptr(lockhigh), uintptr(unsafe.Pointer(ol)))
	if r1 == 0 {
		if e1 != 0 {
			err = error(e1)
		} else {
			err = syscall.EINVAL

| claims             | key-value pairs                         | Claims to be associated with the requested credentials |

The keys "exp", "parent" and "sub" in the `claims` object are reserved and if present are ignored by MinIO.

If the token is not valid or access is not approved, the plugin must return a `403` (forbidden) HTTP status code. The body must have an `application/json` content-type with the following structure:

### What are the coding guidelines for MinIO?

         a0:31:fe:86:e3:8e:3f:49:af:6d:d5:ac:c7:c4:57:47:ce:97:
         7d:ab:b8:e9:75:ec:b4:39:fb:c8:cf:53:16:5b:1f:15:b6:7f:
         5a:d1:35:2d:fc:31:3a:10:e7:0c
```

> Observe the `Subject: CN = consoleAdmin` field.

Also, note that the certificate has to contain the `Extended Key Usage: TLS Web Client Authentication`. Otherwise, MinIO would not accept the certificate as client certificate.

		// observations. This is to test the channel based
		// synchronization used internally.
		select {
		case <-ticker.C:
			ttfbHist.With(prometheus.Labels{"api": obs.label}).Observe(obs.val)
		}
	}

	metrics := getHistogramMetrics(ttfbHist, getBucketTTFBDistributionMD(), false)
	// additional labels for +Inf for all histogram metrics

		allDriveLabels...)
	driveReadsKBPerSecMD = NewGaugeMD(driveReadsKBPerSec,
		"Kilobytes read per second on a drive",
		allDriveLabels...)
	driveReadsAwaitMD = NewGaugeMD(driveReadsAwait,
		"Average time for read requests served on a drive",
		allDriveLabels...)
	driveWritesPerSecMD = NewGaugeMD(driveWritesPerSec,
		"Writes per second on a drive",
		allDriveLabels...)
	driveWritesKBPerSecMD = NewGaugeMD(driveWritesKBPerSec,

				// If escapeHTML is set, it also escapes <, >, and &
				// because they can lead to security holes when
				// user-controlled strings are rendered into JSON
				// and served to some browsers.
				dst.WriteString(`u00`)
				dst.WriteByte(hexTable[b>>4])
				dst.WriteByte(hexTable[b&0xF])
			}
			i++
			start = i
			continue
		}
		c, size := utf8.DecodeRuneInString(s[i:])

// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package cmd

import (
	"testing"
	"time"
)

func TestTierMetrics(t *testing.T) {
	tier := "WARM-1"
	globalTierMetrics.Observe(tier, 200*time.Millisecond)
	expSuccess := 10
	expFailure := 5
	for i := 0; i < expSuccess; i++ {
		globalTierMetrics.logSuccess(tier)
	}
	for i := 0; i < expFailure; i++ {
		globalTierMetrics.logFailure(tier)
	}