rpcSid.sub_authority = new int[] { 32, 544 };

        SID sid = new SID(rpcSid, SID.SID_TYPE_WKN_GRP, "BUILTIN", "Administrators", false);
        assertEquals(SID.SID_TYPE_WKN_GRP, sid.getType());
        assertEquals("BUILTIN", sid.getDomainName());
        assertEquals("Administrators", sid.getAccountName());
        assertEquals(adminSidString, sid.toString());
    }

    /**

        assertEquals("******@****.***", permissionHelper.encode("{user}******@****.***"));
        assertEquals("2group/subgroup", permissionHelper.encode("{group}group/subgroup"));
        assertEquals("RAdministrators", permissionHelper.encode("{role}Administrators"));
        assertEquals("D1user with spaces", permissionHelper.encode("(deny){user}user with spaces"));

            byte[] ident = new byte[] { 0, 0, 0, 0, 0, 5 };
            // Well-known group
            SID wkn = new SID(buildSidT((byte) 1, ident, 32), jcifs.SID.SID_TYPE_WKN_GRP, "BUILTIN", "Administrators", false);
            assertEquals("Administrators", wkn.toDisplayString());

            // BUILTIN with unknown type -> falls back to numeric toString

requires-python = ">=3.10"
authors = [
    { name = "Sebastián Ramírez", email = "******@****.***" },
]
classifiers = [
    "Intended Audience :: Information Technology",
    "Intended Audience :: System Administrators",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python",
    "Topic :: Internet",

 * Class-level state (static fields, metaclass mutations) persists across evaluations
 * of the same script. In Fess, scripts are short expressions configured by
 * administrators (e.g., "data1 > 10", "10 * boost1 + boost2") and do not use
 * static state, so this is acceptable.</p>
 *
 * <p>Resource Management: Each cached entry's GroovyClassLoader is closed on

 * {@code S-1-5-21-1496946806-2192648263-3843101252-1029} but they may
 * also be resolved to yield the name of the associated Windows account
 * such as {@code Administrators} or {@code MYDOM\alice}.
 * <p>
 * Consider the following output of {@code examples/SidLookup.java}:
 *
 * <pre>
 *        toString: S-1-5-21-4133388617-793952518-2001621813-512
 * toDisplayString: WNET\Domain Admins

        ace.allow = false;
        ace.access = 0x001F01FF;
        ace.flags = ACE.FLAGS_INHERITED | ACE.FLAGS_OBJECT_INHERIT | ACE.FLAGS_CONTAINER_INHERIT;
        ace.sid = new SID("S-1-5-32-544"); // Administrators

        String result = ace.toString();

        assertTrue(result.startsWith("Deny  "));
        // Hexdump.toHexString produces uppercase hex
        assertTrue(result.toLowerCase().contains("0x001f01ff"));

            assertFalse((aliceDirectACE & ACE.FILE_WRITE_DATA) != 0, "Alice's direct ACE should not allow FILE_WRITE_DATA");

            // Inherited ACE: Allow Administrators 0x001F01FF
            int adminInheritedACE = 0x001F01FF;
            assertTrue((adminInheritedACE & ACE.FILE_READ_DATA) != 0, "Admin inherited ACE should allow FILE_READ_DATA");

 * {@code S-1-5-21-1496946806-2192648263-3843101252-1029} but they may
 * also be resolved to yield the name of the associated Windows account
 * such as {@code Administrators} or {@code MYDOM\alice}.
 * <p>
 * Consider the following output of {@code examples/SidLookup.java}:
 * <pre>
 *        toString: S-1-5-21-4133388617-793952518-2001621813-512
 * toDisplayString: WNET\Domain Admins

        assertEquals("logged_in", roleQueryHelper.cookieNameMap.get("session"));

        roleQueryHelper.addCookieNameMapping("admin", "administrator");
        assertEquals(2, roleQueryHelper.cookieNameMap.size());
        assertEquals("administrator", roleQueryHelper.cookieNameMap.get("admin"));
    }

    @Test
    public void test_addRoleFromCookieMapping() {