AvlNode<E> newRoot = new AvlNode<>(element, occurrences);
      successor(header, newRoot, header);
      rootReference.checkAndSet(root, newRoot);
      return 0;
    }
    int[] result = new int[1]; // used as a mutable int reference to hold result
    AvlNode<E> newRoot = root.add(comparator(), element, occurrences, result);
    rootReference.checkAndSet(root, newRoot);
    return result[0];
  }

      AvlNode<E> newRoot = new AvlNode<>(element, occurrences);
      successor(header, newRoot, header);
      rootReference.checkAndSet(root, newRoot);
      return 0;
    }
    int[] result = new int[1]; // used as a mutable int reference to hold result
    AvlNode<E> newRoot = root.add(comparator(), element, occurrences, result);
    rootReference.checkAndSet(root, newRoot);
    return result[0];
  }

	}

	// Try to escalate privileges
	restrictedAdmClient := s.getAdminClient(c, "restricted", "restricted123", "")
	_, err = restrictedAdmClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
		AccessKey: "newroot",
		SecretKey: "newroot123",
	})
	if err == nil {
		c.Fatalf("restricted service account was able to create service account bypassing sub-policy!")
	}
}

	restrictedAdmClient := s.getAdminClient(c, value.AccessKeyID, value.SecretAccessKey, value.SessionToken)
	_, err = restrictedAdmClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
		AccessKey: "newroot",
		SecretKey: "newroot123",
	})
	if err == nil {
		c.Fatalf("restricted STS account was able to create service account bypassing sub-policy!")
	}
}

func (s *TestSuiteIAM) TestSTSWithTags(c *check) {

            node = repoSystem.collectDependencies(pluginSession, request).getRoot();

            if (logger.isDebugEnabled()) {
                node.accept(new DependencyGraphDumper(logger::debug));
            }

            depRequest.setRoot(node);
            return repoSystem.resolveDependencies(session, depRequest);
        } catch (DependencyCollectionException e) {

    }

    /**
     * Test isPathSafe with safe path
     *
     * @throws Exception
     */
    @Test
    public void testIsPathSafe_SafePath() throws Exception {
        final Path baseDir = tempFolder.getRoot().toPath();
        final Path safePath = baseDir.resolve("subdir/file.txt");

        assertTrue("Safe path should be allowed", FileUtil.isPathSafe(safePath, baseDir));
    }

    /**

  private val addressA = factory.newAddress("a")
  private val routeA1 = factory.newRoute(addressA)
  private val addressB = factory.newAddress("b")
  private val routeB1 = factory.newRoute(addressB)
  private val addressC = factory.newAddress("c")
  private val routeC1 = factory.newRoute(addressC)

  @AfterEach fun tearDown() {
    factory.close()
    peer.close()
  }

    var planningThrowable: Throwable? = null
    var canceled = false
    var connectState = ConnectState.READY
    val connection =
      factory.newConnection(
        pool = pool,
        route = factory.newRoute(address),
        idleAtNanos = defaultConnectionIdleAtNanos,
      )
    var retry: FakePlan? = null
    var retryTaken = false
    var yieldBeforePlanReturns = false

    override val isReady: Boolean

                        Mockito.any(PathScope.class)))
                .thenReturn(resolverResult);
        Node node = Mockito.mock(Node.class);
        Mockito.when(resolverResult.getRoot()).thenReturn(node);
        Node child = Mockito.mock(Node.class);
        Mockito.when(node.getChildren()).thenReturn(List.of(child));

        services.addAll(List.of(
                new DefaultRequestCacheFactory(),

      proxyAuthenticator = proxyAuthenticator,
      proxy = proxy,
      protocols = protocols,
      connectionSpecs = connectionSpecs,
      proxySelector = proxySelector,
    )

  fun newRoute(
    address: Address = newAddress(),
    proxy: Proxy = this.proxy,
    socketAddress: InetSocketAddress = InetSocketAddress.createUnresolved(uriHost, uriPort),
  ): Route =
    Route(
      address = address,