assertFalse(user.isEditable());

        // Test with different user configurations
        user = new TestFessUser("admin", new String[] { "admin" }, new String[] { "admins" }, new String[] { "*" });
        assertFalse(user.isEditable());

        user = new TestFessUser("", new String[] {}, new String[] {}, new String[] {});
        assertFalse(user.isEditable());

 - `kubeadm`: a separate "super-admin.conf" file is now deployed. The User in `admin.conf` is now bound to a new RBAC Group `kubeadm:cluster-admins` that has `cluster-admin` `ClusterRole` access. The User in `super-admin.conf` is now bound to the `system:masters` built-in super-powers / break-glass Group that can bypass RBAC. Before this change, the default `admin.conf` was bound to `system:masters` Group, which was undesired. Executing `kubeadm...

- DRA: Starting Kubernetes 1.33, only users with access to an admin namespace with the `kubernetes.io/dra-admin-access` label are authorized to create ResourceClaim or ResourceClaimTemplate objects with the `adminAccess` field in this admin namespace if they want to and only they can reference these ResourceClaims or ResourceClaimTemplates in their pod or deployment specs. ([#130225](https://github...

- DRA: Starting with Kubernetes 1.34, the alpha-level `resource.k8s.io/admin-access` label has been updated to `resource.kubernetes.io/admin-access`. Admins using the alpha feature and updating from 1.33 can set both labels, upgrade, then remove `resource.k8s.io/admin-access` when no downgrade is going to happen anymore. ([#131996](https://github.com/kubernetes/kubernetes/pull/131996), [@ritazh](https://github.com/ritazh))...

        for (String val : updatedList) {
            assertEquals(val, "{role}admin-api2");
        }
    }

    private void testPermission() {
        // Create access token
        final String name = NAME_PREFIX + 0;
        final Map<String, Object> requestBody = new HashMap<>();
        requestBody.put("name", name);
        requestBody.put("permissions", "Radmin-api");

                .body("{\"index\":{\"_index\":\"fess_config.access_token\",\"_id\":\"" + DEFAULT_TEST_TOKEN_ID
                        + "\"}}\n{\"updatedTime\":1490250145200,\"updatedBy\":\"admin\",\"createdBy\":\"admin\",\"permissions\":[\"Radmin-api\",\"Rguest\"],\"name\":\"Admin API\",\"createdTime\":1490250145200,\"token\":\""
                        + DEFAULT_TEST_TOKEN + "\"}\n")
                .when()
                .post(getEsUrl() + "/_bulk");

- Add "reason" field to image_garbage_collected_total metric, so admins can differentiate images that were collected for reason "age" vs "space" ([#123345](https://github.com/kubernetes/kubernetes/pull/123345), [@haircommander](https://github.com/haircommander)) [SIG Node]

        testUser.setRoleNames(new String[] { "admin" });
        String[] roles = fessUserBean.getRoles();
        assertEquals(1, roles.length);
        assertEquals("admin", roles[0]);

        // Test with multiple roles
        testUser.setRoleNames(new String[] { "admin", "user", "manager" });
        roles = fessUserBean.getRoles();
        assertEquals(3, roles.length);
        assertEquals("admin", roles[0]);

 */
package org.codelibs.fess.app.web.api.admin;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.codelibs.fess.app.web.api.FessApiAction;
import org.codelibs.fess.exception.InvalidAccessTokenException;

/**
 * Abstract base class for admin API actions in Fess.
 * This class extends FessApiAction to provide admin-specific functionality

 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.app.web.api.admin.user;

import static org.codelibs.fess.app.web.admin.user.AdminUserAction.getUser;
import static org.codelibs.fess.app.web.admin.user.AdminUserAction.validateAttributes;

import java.util.List;
import java.util.stream.Collectors;

import org.apache.logging.log4j.LogManager;