final int _domainss = _src.dec_ndr_long();
                final int _domainsi = _src.index;
                _src.advance(12 * _domainss);

                if (this.domains == null) {
                    if (_domainss < 0 || _domainss > 0xFFFF) {
                        throw new NdrException(NdrException.INVALID_CONFORMANCE);
                    }
                    this.domains = new LsarTrustInformation[_domainss];

                final int _domainss = _src.dec_ndr_long();
                final int _domainsi = _src.index;
                _src.advance(12 * _domainss);

                if (domains == null) {
                    if (_domainss < 0 || _domainss > 0xFFFF) {
                        throw new NdrException(NdrException.INVALID_CONFORMANCE);
                    }
                    domains = new LsarTrustInformation[_domainss];
                }

        when(mockDeferredNdrBuffer.dec_ndr_long()).thenReturn(2); // _domainss

        refDomainList.decode(mockNdrBuffer);

        assertEquals(2, refDomainList.count);
        assertEquals(5, refDomainList.max_count);
        assertNotNull(refDomainList.domains);
        assertEquals(2, refDomainList.domains.length);

        if (DISABLED || auth.domain == "?") {
            return null;
        }

        if (_domains != null && System.currentTimeMillis() > _domains.expiration) {
            _domains = null;
        }
        if (_domains != null) {
            return _domains.map;
        }
        try {
            final UniAddress addr = UniAddress.getByName(auth.domain, true);

                || tf.getCredentials().getUserDomain().isEmpty()) {
            return null;
        }

        if (this._domains != null && System.currentTimeMillis() > this._domains.expiration) {
            this._domains = null;
        }
        if (this._domains != null) {
            return this._domains.map;
        }
        try {
            final String authDomain = tf.getCredentials().getUserDomain();

            }
            rpc.domains = new lsarpc.LsarRefDomainList();
            rpc.domains.count = 1;
            rpc.domains.max_count = 1;
            rpc.domains.domains = new lsarpc.LsarTrustInformation[1];
            rpc.domains.domains[0] = new lsarpc.LsarTrustInformation();
            rpc.domains.domains[0].name = new UnicodeString("", false);
            rpc.domains.domains[0].sid = new jcifs.dcerpc.rpc.sid_t();

        cacheEntry.map = trustedDomains;
        dfs._domains = cacheEntry;

        assertEquals(trustedDomains, dfs.getTrustedDomains(auth));
    }

    @Test
    void testGetTrustedDomains_ExpiredCache() throws IOException, SmbAuthException {
        // Set up an expired cache entry
        Dfs.CacheEntry expiredEntry = new Dfs.CacheEntry(-1); // Expired
        testDfs._domains = expiredEntry;

				},
			},
			domains:          []string{"mys3.bucket.org"},
			bucket:           "mybucket",
			object:           "test/1.txt",
			expectedLocation: "https://mybucket.mys3.bucket.org/test/1.txt",
		},
	}
	for _, testCase := range testCases {
		t.Run("", func(t *testing.T) {
			gotLocation := getObjectLocation(testCase.request, testCase.domains, testCase.bucket, testCase.object)

* The encryption of the connection happens at the **TCP level**.
    * That's one layer **below HTTP**.
    * So, the **certificate and encryption** handling is done **before HTTP**.
* **TCP doesn't know about "domains"**. Only about IP addresses.
    * The information about the **specific domain** requested goes in the **HTTP data**.

    }

    @ParameterizedTest
    @MethodSource("domains")
    @DisplayName("getUserDomain handles null and empty")
    void getUserDomain_edges(String domain) {
        TestCredentials creds = new TestCredentials(domain, false, false, new Subject(), false);
        assertEquals(domain, creds.getUserDomain());
    }

    static Stream<String> domains() {
        return Stream.of(null, "", "SALES");
    }