}
	// Collect group names for ReplaceAttr.
	if s.groups != nil {
		*s.groups = append(*s.groups, name)
	}
}

// closeGroup ends the group with the given name.
func (s *handleState) closeGroup(name string) {
	if s.h.json {
		s.buf.WriteByte('}')
	} else {
		(*s.prefix) = (*s.prefix)[:len(*s.prefix)-len(name)-1 /* for keyComponentSep */]
	}
	s.sep = s.h.attrSep()
	if s.groups != nil {

		t.Fatalf("unexpected error: %v", err)
	}
	assert.Equal(t, 6, len(groupList.Groups))
	assert.Equal(t, "x", groupList.Groups[0].Name)
	assert.Equal(t, "y", groupList.Groups[1].Name)
	assert.Equal(t, "z", groupList.Groups[2].Name)
	assert.Equal(t, "b", groupList.Groups[3].Name)
	assert.Equal(t, "c", groupList.Groups[4].Name)
	assert.Equal(t, "a", groupList.Groups[5].Name)

        if (this.groups == null) {
            this.groups = new ArrayList<>();
        }
        this.groups.addAll(groups);
    }

    /**
     * Returns the task groups to be displayed.
     *
     * Task groups can be added via command-line option '--groups'.
     *
     * @since 7.5
     */
    @Incubating
    @Console
    public List<String> getDisplayGroups() {

    private SingleProjectTaskReportModel(SetMultimap<String, TaskDetails> groups) {
        this.groups = groups;
    }

    @Override
    public Set<String> getGroups() {
        return groups.keySet();
    }

    @Override
    public Set<TaskDetails> getTasksForGroup(String group) {
        if (!groups.containsKey(group)) {
            throw new IllegalArgumentException(String.format("Unknown group '%s'", group));

        };
        final SetMultimap<String, TaskDetails> groups = TreeMultimap.create(keyComparator, taskComparator);
        for (String group : model.getGroups()) {
            groups.putAll(group, model.getTasksForGroup(group));
        }
        String otherGroupName = findOtherGroup(groups.keySet());
        if (otherGroupName != null && groups.keySet().contains(DEFAULT_GROUP)) {
            groups.putAll(otherGroupName, groups.removeAll(DEFAULT_GROUP));

							Expression: "claims.username",
						},
						Groups: apiserver.PrefixedClaimOrExpression{
							Claim:  "groups",
							Prefix: pointer.String("system:"),
						},
					},
					UserValidationRules: []apiserver.UserValidationRule{
						{
							Expression: "user.groups.all(group, !group.startsWith('system:'))",
							Message:    "groups cannot used reserved system: prefix",
						},
					},

	Groups []string
}

// NewTokenGroupAdder wraps a token authenticator, and adds the specified groups to the returned user when authentication succeeds
func NewTokenGroupAdder(auth authenticator.Token, groups []string) authenticator.Token {
	return &TokenGroupAdder{auth, groups}
}

func (g *TokenGroupAdder) AuthenticateToken(ctx context.Context, token string) (*authenticator.Response, bool, error) {

				Groups: []string{user.AllUnauthenticated, "some-group"},
			},
			expectedUser: &user.DefaultInfo{
				Name:   "user",
				Groups: []string{user.AllUnauthenticated, "some-group"},
			},
		},
	}

	for _, test := range tests {
		capacity := make([]string, 0, 1024)
		user := test.inputUser
		user.Groups = append(capacity, user.Groups...) // make sure there is capacity in the groups array to trigger potential mutation

			user: &user.DefaultInfo{
				Name:   "dev",
				Groups: []string{"wheel", "group-impersonater"},
			},
			impersonationUser:   "system:admin",
			impersonationGroups: []string{"some-group"},
			expectedUser: &user.DefaultInfo{
				Name:   "system:admin",
				Groups: []string{"some-group", "system:authenticated"},
				Extra:  map[string][]string{},
			},
			expectedCode: http.StatusOK,
		},
		{

			User: user.DefaultInfo{Name: "Bar", Groups: []string{"A", "B", "C", user.AllAuthenticated}},
			Policy: &v0.Policy{
				User:  "Foo",
				Group: "B",
			},
			ExpectMatch: false,
		},
		"v0 user and group policy requires group match": {
			User: user.DefaultInfo{Name: "Foo", Groups: []string{"A", "B", "C", user.AllAuthenticated}},
			Policy: &v0.Policy{
				User:  "Foo",
				Group: "D",