}

	if numPeers == 0 {
		allErrs = append(allErrs, field.Required(peerPath, "must specify a peer"))
	} else if numPeers > 1 && peer.IPBlock != nil {
		allErrs = append(allErrs, field.Forbidden(peerPath, "may not specify both ipBlock and another peer"))
	}

	return allErrs
}

// ValidateNetworkPolicySpec tests if required fields in the networkpolicy spec are set.

				"`parameters.scope` is set to 'Namespace'")},
		},
		"namespace is forbidden when scope is Cluster": {
			ingressClass: makeValidIngressClass("test123", "foo.co/bar",
				setParams(makeIngressClassParams(nil, "foo", "bar", utilpointer.String("Cluster"), utilpointer.String("foo-ns"))),
			),
			expectedErrs: field.ErrorList{field.Forbidden(field.NewPath("spec.parameters.namespace"),
				"`parameters.scope` is set to 'Cluster'")},

			fn:                    IsTooManyRequests,
		}, {
			name:                  "Forbidden",
			knownReason:           metav1.StatusReasonForbidden,
			otherReason:           metav1.StatusReasonNotFound,
			otherReasonConsidered: true,
			code:                  http.StatusForbidden,
			fn:                    IsForbidden,
		}, {
			name:                  "NotFound",
			knownReason:           metav1.StatusReasonNotFound,

			err:          aggregate{errors.New("my-error"), errors.New("my-other-error")},
			matchAgainst: fmt.Errorf("no entry %s", "here"),
		},
		{
			name:         "match via .Is()",
			err:          aggregate{errors.New("forbidden"), alwaysMatchingError{}},
			matchAgainst: errors.New("unauthorized"),
			expectMatch:  true,
		},
		{
			name:         "match via equality",
			err:          aggregate{errors.New("err"), someError{}},

			return
		}
		if decision != authorizer.DecisionAllow {
			klog.V(2).InfoS("Forbidden", "user", attrs.GetUser().GetName(), "verb", attrs.GetVerb(), "resource", attrs.GetResource(), "subresource", attrs.GetSubresource())
			msg := fmt.Sprintf("Forbidden (user=%s, verb=%s, resource=%s, subresource=%s)", attrs.GetUser().GetName(), attrs.GetVerb(), attrs.GetResource(), attrs.GetSubresource())

   */
  open fun canceled(call: Call) {
  }

  /**
   * Invoked when a call fails due to cache rules.
   * For example, we're forbidden from using the network and the cache is insufficient
   */
  open fun satisfactionFailure(
    call: Call,
    response: Response,
  ) {
  }

  /**

	// but switches back to normal pruning behaviour if nested
	// properties or additionalProperties are specified in the schema.
	// This can either be true or undefined. False is forbidden.
	XPreserveUnknownFields *bool

	// x-kubernetes-embedded-resource defines that the value is an
	// embedded Kubernetes runtime.Object, with TypeMeta and
	// ObjectMeta. The type must be object. It is allowed to further

            if (i != 0) {
              AddUse(op, tensor);
            }
            tensor = AddTensor(extra_size);
            AddUse(op, tensor);
          }
          // using negative sizes to signal forbidden operations.
          op = AddOperation(/*is_stateful=*/size < 0);
          if (extra_ops > 0) {
            AddUse(op, tensor);
          }
          tensor = AddTensor(std::abs(size));

			true,
		},
		{ // non-duplicate, but 'all' present in config file, while values are in CLI, which is forbidden
			[]string{"a", "b"},
			[]string{"all"},
			sets.New[string](),
			true,
		},
		{ // non-duplicate, but 'all' present in CLI, while values are in config file, which is forbidden
			[]string{"all"},
			[]string{"a", "b"},
			sets.New[string](),
			true,
		},
	}

		// and stop when c goes out of the (l, u) interval.
		l := (lower + 9) / 10
		c, cdigit := central/10, central%10
		u := upper / 10
		if l > u {
			// don't trim the last digit as it is forbidden to go below l
			// other, trim and exit now.
			break
		}
		// Check that we didn't cross the lower boundary.
		// The case where l < u but c == l-1 is essentially impossible,
		// but may happen if: