if !cfg.Enabled {
		return nil, nil
	}
	cli, err := clientv3.New(cfg.Config)
	if err != nil {
		return nil, err
	}
	cli.KV = namespace.NewKV(cli.KV, cfg.PathPrefix)
	cli.Watcher = namespace.NewWatcher(cli.Watcher, cfg.PathPrefix)
	cli.Lease = namespace.NewLease(cli.Lease, cfg.PathPrefix)
	return cli, nil
}

func parseEndpoints(endpoints string) ([]string, bool, error) {

}

const maxDurationSecondsForLog = 5

func (sys *IAMSys) periodicRoutines(ctx context.Context, baseInterval time.Duration) {
	// Watch for IAM config changes for iamStorageWatcher.
	watcher, isWatcher := sys.store.IAMStorageAPI.(iamStorageWatcher)
	if isWatcher {
		go func() {
			ch := watcher.watch(ctx, iamConfigPrefix)
			for event := range ch {
				if err := sys.loadWatchedEvent(ctx, event); err != nil {
					// we simply log errors

// layer.
type IAMStoreSys struct {
	IAMStorageAPI

	group  *singleflight.Group
	policy *singleflight.Group
}

// HasWatcher - returns if the storage system has a watcher.
func (store *IAMStoreSys) HasWatcher() bool {
	_, ok := store.IAMStorageAPI.(iamStorageWatcher)
	return ok
}

// GetUser - fetches credential from memory.

        inline fun <reified T> inAnyOrder(items: List<T>): Matcher<Iterable<T>> = inAnyOrder(items.toTypedArray())

        /**
         * Matcher checking each item is present exactly once in a given iterable, but an any position,
         * and that there are no unexpected items.
         */
        private
        fun <T> inAnyOrder(items: Array<out T>): Matcher<Iterable<T>> = Matchers.containsInAnyOrder(*items)

     * Returns a filter for directories that may contain paths accepted by the given matcher.
     * The given path matcher should be an instance created by this service.
     * The path matcher returned by this method expects directory paths.
     * If that matcher returns {@code false}, then the directory will definitively not contain
     * the paths selected by the matcher given in argument to this method.

        final Matcher matcher = Pattern.compile(tokenPattern).matcher(content);
        if (matcher.find()) {
            if (logger.isDebugEnabled()) {
                logger.debug("Matched: {}", matcher.group());
            }
            if (matcher.groupCount() > 0) {
                return matcher.group(1);
            }
        }
        return null;
    }

                if (excludedPaths != null && excludedPaths.matcher(path).matches()) {
                    if (logger.isDebugEnabled()) {
                        logger.debug("Path {} matches the include/exclude path expression {} on {} of label.", path, excludedPaths, value);
                    }
                    return false;
                }
                if (logger.isDebugEnabled()) {

                value = resourceName;
            }

            if (value != null) {
                for (final Map.Entry<Pattern, String> entry : passwordMap.entrySet()) {
                    if (entry.getKey().matcher(value).matches()) {
                        return entry.getValue();
                    }
                }
            }
        }

        if (params != null && url != null) {

    void oidFormat() {
        assertAll(() -> assertTrue(OID_PATTERN.matcher(SpnegoConstants.SPNEGO_MECHANISM).matches(), "Invalid OID: SPNEGO_MECHANISM"),
                () -> assertTrue(OID_PATTERN.matcher(SpnegoConstants.KERBEROS_MECHANISM).matches(), "Invalid OID: KERBEROS_MECHANISM"),
                () -> assertTrue(OID_PATTERN.matcher(SpnegoConstants.LEGACY_KERBEROS_MECHANISM).matches(),
                        "Invalid OID: LEGACY_KERBEROS_MECHANISM"),

            throw new IllegalArgumentException("Path exceeds maximum length: " + path.length());
        }
        if (PATH_TRAVERSAL.matcher(path).find()) {
            throw new IllegalArgumentException("Path contains directory traversal sequences: " + path);
        }
        if (INVALID_PATH_CHARS.matcher(path).find()) {
            throw new IllegalArgumentException("Path contains invalid characters: " + path);
        }
    }