// Only stub supportsIntegrity - isEstablished won't be called due to short-circuit
            when(mockCtx.supportsIntegrity()).thenReturn(false);

            // A small consumer that only uses MIC if advertised as available
            byte[] data = new byte[] { 1, 2 };
            if (mockCtx.supportsIntegrity() && mockCtx.isEstablished()) {
                mockCtx.calculateMIC(data);
            }

                .append(Hexdump.toHexString(ntlmsspFlags, 8))
                .append(",workstation=")
                .append(workstation)
                .append(",isEstablished=")
                .append(isEstablished)
                .append(",state=")
                .append(state)
                .append(",serverChallenge=");
        if (serverChallenge == null) {
            ret.append("null");

    void testConstructor_withSigning() {
        // Test constructor when signing is enabled
        NtlmContext context = new NtlmContext(mockAuth, true);
        assertNotNull(context);
        assertFalse(context.isEstablished());
        assertNull(context.getServerChallenge());
        assertNull(context.getSigningKey());
        assertNull(context.getNetbiosName());

                .append(Hexdump.toHexString(this.ntlmsspFlags, 8))
                .append(",workstation=")
                .append(this.workstation)
                .append(",isEstablished=")
                .append(this.isEstablished)
                .append(",state=")
                .append(this.state)
                .append(",serverChallenge=");
        if (this.serverChallenge == null) {

    }

    @Test
    @DisplayName("isEstablished reflects underlying context state")
    void isEstablished_behavior() throws Exception {
        when(gssContext.isEstablished()).thenReturn(true);
        assertTrue(ctx.isEstablished());

        // When gssContext is null, isEstablished returns false
        setPrivateField(ctx, "gssContext", null);
        assertFalse(ctx.isEstablished());
        // Put it back for subsequent tests

        return new NegTokenInit(this.mechs, this.mechContext.getFlags(), mechToken, null);
    }

    @Override
    public boolean isEstablished() {
        return this.completed && this.mechContext.isEstablished();
    }

    private static SpnegoToken getToken(final byte[] token, final int off, final int len) throws SpnegoException {
        byte[] b = new byte[len];

    }

    @Test
    @DisplayName("isEstablished short-circuits on not completed and does not call delegate")
    void testIsEstablishedShortCircuit() {
        SpnegoContext ctx = newContext();
        // The mock setup is unnecessary since we never call it
        assertFalse(ctx.isEstablished());
        verify(this.mechContext, never()).isEstablished();
    }

    @Test

            tc.getCredentials();

            // Minimal behavior: return a mock SSPContext with lenient stubbing
            SSPContext ctx = mock(SSPContext.class);
            lenient().when(ctx.isEstablished()).thenReturn(false);
            return ctx;
        }

        @Override
        public Subject getSubject() {
            return this.subject;
        }

        @Override

            contextFlags |= NegTokenInit.INTEGRITY;
        }
        return contextFlags;
    }

    @Override
    public boolean isEstablished() {
        return this.gssContext != null && this.gssContext.isEstablished();
    }

    /**
     * {@inheritDoc}
     *
     * @see jcifs.smb.SSPContext#supportsIntegrity()
     */
    @Override

     */
    byte[] getSigningKey() throws CIFSException;

    /**
     * Checks whether the security context is established.
     * @return whether the context is established
     */
    boolean isEstablished();

    /**
     * Initializes the security context with the given token.
     * @param token the input token bytes
     * @param off offset into the token array
     * @param len length of token data