verify(tree, times(1)).release(); // closed after exhaustion
    }

    @ParameterizedTest
    @ValueSource(strings = { "", "file.txt", "subdir" })
    @DisplayName("Name filter interaction: accept calls and rejections")
    void nameFilterAccepts(String acceptedName) throws Exception {
        // Arrange
        stubAcquireReturnsSelf();
        when(nameFilter.accept(any(), any())).thenReturn(false);

        @Override
        public String toString() {
            return String.format(
                    "CircuitBreakerMetrics[name=%s, state=%s, requests=%d, successes=%d, "
                            + "failures=%d, rejections=%d, successRate=%.2f%%, availability=%.2f%%]",
                    name, currentState, totalRequests, totalSuccesses, totalFailures, totalRejections, successRate, availability);
        }
    }

    /**

        loadBalancer.setStrategy(LoadBalancingStrategy.WEIGHTED_RANDOM);
        when(mockChannelManager.getHealthyChannels()).thenReturn(Arrays.asList(channel1, channel2));

        // Test multiple selections to ensure it works
        for (int i = 0; i < 10; i++) {
            ChannelInfo selected = loadBalancer.selectChannel(mockMessage);
            assertTrue(Arrays.asList(channel1, channel2).contains(selected));
        }

        when(treeHandle.send(any(), any(), (RequestParam[]) any())).thenAnswer(invocation -> {
            return invocation.getArgument(1);
        });

        // When: Create iterator with rejecting filter
        NetServerEnumIterator iterator = new NetServerEnumIterator(parent, treeHandle, "*", 0, nameFilter);

        // Then: Iterator should have no elements
        assertFalse(iterator.hasNext());

        // With filter, resource should be closed due to try-with-resources
        verify(filter).accept(resource);
        verify(resource).close();
    }

    @Test
    @DisplayName("Iterator with rejecting filter - finds next acceptable")
    void iteratorWithRejectingFilter() throws Exception {
        // Setup: first entry rejected, second accepted
        FileEntry entry1 = mock(FileEntry.class);

        normalizedPath = noUncValidator.validatePath("////server//share");
        assertEquals("\\server\\share", normalizedPath);

        // To properly test UNC rejection, we would need to fix the normalization logic
        // to preserve the leading double backslash for UNC paths
    }

    @Test
    public void testInvalidUncPath() throws Exception {

	}
	if len(ldapPolicies) == 0 && newGlobalAuthZPluginFn() == nil {
		writeSTSErrorResponse(ctx, w, ErrSTSInvalidParameterValue,
			fmt.Errorf("expecting a policy to be set for user `%s` or one of their groups: `%s` - rejecting this request",
				ldapActualUserDN, strings.Join(groupDistNames, "`,`")))
		return
	}

	expiryDur, err := globalIAMSys.LDAPConfig.GetExpiryDuration(r.Form.Get(stsDurationSeconds))
	if err != nil {

                    throw new RuntimeException(e);
                }
            });
        } catch (SimpleCircuitBreaker.CircuitBreakerOpenException e) {
            // Log circuit breaker rejection
            auditLogger.logSecurityViolation("Circuit breaker open for SMB connection",
                    java.util.Map.of("address", address.getHostAddress(), "port", String.valueOf(port)));

		if availablePoliciesStr == "" {
			// all policies presented in the claim should exist
			iamLogIf(GlobalContext, fmt.Errorf("expected policy (%s) missing from the JWT claim %s, rejecting the request", policies, iamPolicyClaimNameOpenID()))

			return false
		}
		combinedPolicy = c
	}

	// 3. If an inline session-policy is present, evaluate it.

  
  Action required for custom scheduler plugin developers:
  Plugins **have to** implement a QueueingHint for Pod/Update event if the rejection from them could be resolved by updating unscheduled Pods themselves.
  Example: suppose you develop a custom plugin that denies Pods that have a `schedulable=false` label.