default:
		writeSTSErrorResponse(ctx, w, ErrSTSInvalidParameterValue, fmt.Errorf("Unsupported action %s", action))
		return
	}

	ctx = newContext(r, w, action)

	token := r.Form.Get(stsToken)
	if token == "" {
		token = r.Form.Get(stsWebIdentityToken)
	}

	accessToken := r.Form.Get(stsWebIdentityAccessToken)

	// RoleARN parameter processing: If a role ARN is given in the request, we

type clientCertAuth struct {
	CAKey         crypto.Signer
	Organizations []string
}

// tokenAuth struct holds info required to use a token to provide authentication info in a kubeconfig object
type tokenAuth struct {
	Token string `datapolicy:"token"`
}

// kubeConfigSpec struct holds info required to build a KubeConfig object
type kubeConfigSpec struct {
	CACert              *x509.Certificate

    override val coneType: ConeClassLikeType,
    private val coneDiagnostic: ConeDiagnostic,
    private val builder: KaSymbolByFirBuilder,
) : KaClassErrorType(), KaFirType {
    override val token: KaLifetimeToken get() = builder.token

    override val qualifiers: List<KaClassTypeQualifier> by cached {
        when (coneDiagnostic) {
            is ConeUnresolvedError ->

internal class KaFirReceiverParameterSymbol(
    val firSymbol: FirCallableSymbol<*>,
    val analysisSession: KaFirSession,
) : KaReceiverParameterSymbol(), KaLifetimeOwner {
    override val token: KaLifetimeToken get() = analysisSession.token
    override val psi: PsiElement? = withValidityAssertion { firSymbol.fir.receiverParameter?.typeRef?.psi }

    init {

    override val firSymbol: FirNamedFunctionSymbol,
    override val analysisSession: KaFirSession,
) : KaSamConstructorSymbol(), KaFirSymbol<FirNamedFunctionSymbol> {
    override val token: KaLifetimeToken get() = builder.token
    override val psi: PsiElement? by cached { firSymbol.findPsi() }

    override val annotations: KaAnnotationList
        get() = withValidityAssertion {

internal class KaFirJavaFieldSymbol(
    override val firSymbol: FirFieldSymbol,
    override val analysisSession: KaFirSession,
) : KaJavaFieldSymbol(), KaFirSymbol<FirFieldSymbol> {
    override val token: KaLifetimeToken get() = builder.token
    override val psi: PsiElement? by cached { firSymbol.findPsi() }

    override val annotations: KaAnnotationList
        get() = withValidityAssertion {

		"--audit-webhook-truncate-max-event-size=42",
		"--audit-webhook-initial-backoff=2s",
		"--audit-webhook-version=audit.k8s.io/v1",
		"--authentication-token-webhook-cache-ttl=3m",
		"--authentication-token-webhook-config-file=/token-webhook-config",
		"--authorization-mode=AlwaysDeny,RBAC",
		"--authorization-policy-file=/policy",
		"--authorization-webhook-cache-authorized-ttl=3m",

                            factoryName = FirErrors.OTHER_ERROR.name,
                            defaultMessage = "type of arrayOf call is not resolved",
                            token = token
                        ),
                        token
                    )
                }
            val call = arrayTypeToArrayOfCall[type.lookupTag.classId] ?: arrayOf
            arrayOfSymbol(call)
        } ?: return null

                    KaClassTypeQualifier.KaResolvedClassTypeQualifier(
                        it.toKaClassSymbol(analysisContext),
                        emptyList(),
                        token
                    )
                }

                nestedType.allInnerTypes.mapTo(this) { innerType ->
                    KaClassTypeQualifier.KaResolvedClassTypeQualifier(

func setupKubeConfigWithTokenAuth(t *testing.T, caCert *x509.Certificate, apiServer, clientName, token, clustername string) *clientcmdapi.Config {
	spec := &kubeConfigSpec{
		CACert:     caCert,
		APIServer:  apiServer,
		ClientName: clientName,
		TokenAuth: &tokenAuth{
			Token: token,
		},
	}