*
     * @return whether DFS lookup is disabled
     */
    boolean isDfsDisabled();

    /**
     * Enable hack to make kerberos auth work with DFS sending short names
     *
     * This works by appending the domain name to the netbios short name and will fail horribly if this mapping is not
     * correct for your domain.
     *
     * Property {@code jcifs.smb.client.dfs.convertToFQDN} (boolean, default false)
     *

			}
			opts.claims[k] = v
		}
	} else {
		// We still need to ensure that the target user is a valid LDAP user.
		//
		// The target user may be supplied as a (short) username or a DN.
		// However, for now, we only support using the short username.

		isDN := globalIAMSys.LDAPConfig.ParsesAsDN(targetUser)
		opts.claims[ldapUserN] = targetUser // simple username
		var lookupResult *xldap.DNSearchResult

        helper.delayByRules();
        end = System.currentTimeMillis();
        assertTrue(end - start < 50); // Should return quickly

        // Test with rule that has delay (we'll use a very short delay for testing)
        helper.ruleList.clear();
        helper.addIntervalRule("12:00", "13:00", "*", 10);
        start = System.currentTimeMillis();
        helper.delayByRules();

   * value. Otherwise, a call that passes one {@code loader} may return the result of another call
   * with a differently behaving {@code loader}. For example, a call that requests a short timeout
   * for an RPC may wait for a similar call that requests a long timeout, or a call by an
   * unprivileged user may return a resource accessible only to a privileged user making a similar

    -> TYPE_VALID

    TYPE_DISALLOWED -> TYPE_DISALLOWED

    else -> error("unexpected type: $type")
  }

internal infix fun Byte.and(mask: Int): Int = toInt() and mask

internal infix fun Short.and(mask: Int): Int = toInt() and mask

    @Test
    @DisplayName("Test automatic cleanup of old resources")
    @Timeout(value = 5, unit = TimeUnit.SECONDS)
    void testAutomaticCleanup() throws InterruptedException {
        // Configure with very short max age for testing
        resourceManager.configure(100, 50, true, true);

        TestResource resource = new TestResource("old");
        resourceManager.registerResource(resource);

            assertArrayEquals("Hello".getBytes(), java.util.Arrays.copyOfRange(buffer, 0, 5));
        }

        @Test
        @DisplayName("readn should throw IOException when buffer too short")
        void shouldThrowWhenBufferTooShort() {
            InputStream is = new ByteArrayInputStream("test".getBytes());
            assertThrows(IOException.class, () -> Transport.readn(is, new byte[5], 0, 10));
        }

    }

    /**
     * Adds sort builders to the query context.
     * @param sortBuilders Variable number of sort builders to add.
     */
    public void addSorts(final SortBuilder<?>... sortBuilders) {
        stream(sortBuilders).of(stream -> stream.forEach(sortBuilder -> sortBuilderList.add(sortBuilder)));
    }

    /**
     * Checks if any sort builders have been added to this context.

        assertEquals(4, readLen, "Byte count returned should be 4");
    }

    @Test
    @DisplayName("readParameterWordsWireFormat with a too-short buffer - throws exception")
    void testReadParameterWordsWithShortBuffer() {
        byte[] buffer = new byte[] { 0x00, 0x01, 0x02 }; // only three bytes

            new KerberosPacAuthData(emptyToken, keys);
        });
        assertTrue(e.getMessage().contains("PAC"));
    }

    // Test exception for short PAC
    @Test
    void testConstructorShortPac() {
        byte[] shortToken = new byte[7];
        PACDecodingException e = assertThrows(PACDecodingException.class, () -> {