*
     * @param authType the type of authorization data
     * @param token the authorization data token
     * @param keys the Kerberos keys for decryption
     * @return a list of parsed authorization data
     * @throws PACDecodingException if the data cannot be decoded
     */
    public static List<KerberosAuthData> parse(int authType, byte[] token, Map<Integer, KerberosKey> keys) throws PACDecodingException {

    void testSerializationOmittingNullFields() throws IOException {
        NegTokenTarg token = new NegTokenTarg();
        token.setResult(NegTokenTarg.ACCEPT_INCOMPLETE);
        // mechanism, token and mic are left null

        byte[] bytes = token.toByteArray();
        NegTokenTarg parsed = new NegTokenTarg(bytes);

    private static SpnegoToken getToken(final byte[] token, final int off, final int len) throws SpnegoException {
        byte[] b = new byte[len];
        if (off == 0 && token.length == len) {
            b = token;
        } else {
            System.arraycopy(token, off, b, 0, len);
        }
        return getToken(b);
    }

    private static SpnegoToken getToken(final byte[] token) throws SpnegoException {

 */
class KerberosTokenTest {

    /**
     * Test constructor with an empty token.
     */
    @Test
    void testConstructorWithEmptyToken() {
        byte[] emptyToken = new byte[0];
        assertThrows(PACDecodingException.class, () -> new KerberosToken(emptyToken));
    }

    /**
     * Test constructor with a malformed token (not ASN.1).
     */
    @Test
    void testConstructorWithMalformedToken() {

                .result());
    }

    // GET /api/admin/accesstoken/setting/{id}
    /**
     * Retrieves a specific access token setting by ID.
     *
     * @param id the access token ID to retrieve
     * @return JSON response with the access token setting
     */
    @Execute
    public JsonResponse<ApiResult> get$setting(final String id) {

     * Gets the server path with access token for API requests.
     *
     * @return the complete server path including the access token
     * @throws FessSystemException if no access token is available
     */
    public String getServerPath() {
        return getSessionManager().getAttribute(Constants.SEARCH_ENGINE_API_ACCESS_TOKEN, String.class)
                .map(token -> ADMIN_SERVER + token)

import org.codelibs.fess.app.web.api.admin.BaseSearchBody;

/**
 * Search request body for access token administration.
 * Extends BaseSearchBody with access token-specific search parameters.
 */
public class SearchBody extends BaseSearchBody {

    /** The access token ID to search for. */
    public String id;

    /**
     * Default constructor for SearchBody.
     */
    public SearchBody() {

        byte[] token = createTestTicketBytes(new BigInteger(KerberosConstants.KERBEROS_VERSION), SERVER_REALM, SERVER_PRINCIPAL_NAME,
                ENCRYPTION_TYPE, ENCRYPTED_DATA, null);
        when(kerberosKey.getKeyType()).thenReturn(99); // Different key type

        PACDecodingException e = assertThrows(PACDecodingException.class, () -> new KerberosTicket(token, (byte) 0, keys));

    /**
     * Constructs KerberosRelevantAuthData from token bytes.
     *
     * @param token the authorization data token
     * @param keys map of Kerberos keys indexed by key type
     * @throws PACDecodingException if decoding fails
     */
    public KerberosRelevantAuthData(byte[] token, Map<Integer, KerberosKey> keys) throws PACDecodingException {
        ASN1Sequence authSequence;

        SpnegoContext ctx = newContext();

        // The initial token path should ask the mechanism for a zero-length optimistic token
        when(this.mechContext.getFlags()).thenReturn(0x1234);
        when(this.mechContext.initSecContext(any(byte[].class), eq(0), eq(0))).thenReturn(new byte[] { 0x01, 0x02 });

        // Act: len==0 triggers initial token construction
        byte[] out = ctx.initSecContext(null, 0, 0);