private static final double TIMING_TOLERANCE = 2.0; // 200% tolerance - JVM timing is inherently variable for timing variations

    @BeforeEach
    public void setUp() {
        // Warm up JVM to reduce JIT compilation effects
        for (int i = 0; i < 100; i++) {
            NtlmPasswordAuthenticator auth1 = new NtlmPasswordAuthenticator("testdomain", "testuser", "password123");

        cache.resolveSids(ctx, null, arr, 2, 1); // resolve only s3

        // Verify cache behavior - after reset, spying on the same cache won't work
        // Since we're working with internal state, we'll verify the side effects
        assertEquals("DOM", s1.getDomainName());
        assertEquals("user1", s1.getAccountName());
        assertEquals("DOM", s2.getDomainName());
        assertEquals("user2", s2.getAccountName());

     */
    @Size(max = 10000)
    public String appValue;

    /**
     * Default label value to use when no specific label is selected.
     * This affects which documents are included in search results by default.
     */
    @Size(max = 1000)
    public String defaultLabelValue;

    /**
     * Default sort order for search results.

        assertArrayEquals(h2, h1, "nTOWFv1 should return NT hash");
        assertEquals(16, h1.length, "NT hash length is 16 bytes");
    }

    @Test
    @DisplayName("nTOWFv2: overloads produce same result and domain affects key")
    void testNTOWFv2_overloadsAndDomainSensitivity() {
        // Arrange
        String domain = "Domain";
        String user = "User";
        String password = "password";

        // Act

        try {
            robotsTxt = robotsTxtHelper.parse(in);
        } finally {
            CloseableUtil.closeQuietly(in);
        }

        // Floating point crawl-delay should be ignored (as it expects integer)
        assertNotNull(robotsTxt);
        // Should either parse as 2 or be ignored
        assertTrue(robotsTxt.getCrawlDelay("TestBot") >= 0);
    }

        final Class<?> ret = getWrapperClass(clazz);
        if (ret != null) {
            return ret;
        }
        return clazz;
    }

    /**
     * Returns a {@link Constructor} object that reflects the specified {@code public} constructor of the class represented by the {@link Class} object.
     *
     * @param <T>
     *            The class represented by the {@link Class} object
     * @param clazz

        lenient().when(mockAddress.getHostName()).thenReturn("WORKSTATION");
    }

    /**
     * Test case for when the 'Authorization' header is missing.
     * Expects the server to respond with a 'WWW-Authenticate: NTLM' header and a 401 status.
     * @throws IOException
     */
    @Test
    public void testAuthenticate_NoAuthorizationHeader() throws IOException {

        assertDoesNotThrow(() -> ntlmServlet.init(servletConfig));
    }

    /**
     * Test the service method when no Authorization header is present and no session exists.
     * Expects a 401 Unauthorized response with NTLM and Basic authentication challenges.
     * @throws ServletException
     * @throws IOException
     */
    @Test

                | NegTokenInit.SEQUENCE_CHECKING | NegTokenInit.ANONYMITY | NegTokenInit.CONFIDENTIALITY | NegTokenInit.INTEGRITY;
        assertEquals(expected, flags);
    }

    @Test
    @DisplayName("isEstablished reflects underlying context state")
    void isEstablished_behavior() throws Exception {
        when(gssContext.isEstablished()).thenReturn(true);
        assertTrue(ctx.isEstablished());

        assertTrue(ex.getMessage().contains("failed"));
        verify(transport).hasCapability(42);
    }

    // Edge: disconnected status toggles
    @ParameterizedTest
    @DisplayName("isDisconnected reflects current mocked state")
    @ValueSource(booleans = { true, false })
    void isDisconnected_states(boolean disconnected) {
        when(transport.isDisconnected()).thenReturn(disconnected);