t.Run(test.name, func(t *testing.T) {
			claimed, err := test.manager.ClaimPods(context.TODO(), test.pods)
			if err != nil {
				t.Fatalf("Unexpected error: %v", err)
			}
			if diff := cmp.Diff(test.claimed, claimed); diff != "" {
				t.Errorf("Claimed wrong pods (-want,+got):\n%s", diff)
			}
			fakePodControl, ok := test.manager.podControl.(*FakePodControl)
			if !ok {
				return
			}

			}

			slices := tc.slices
			if slices == nil {
				slices = sliceList{}
			}
			claims := tc.claims
			if claims == nil {
				claims = claimList{}
			}
			actualResources, actualErr := newResourceModel(tCtx.Logger(), slices, claims, &inFlightAllocations)

			if actualErr != nil {
				if !tc.wantErr {
					tCtx.Fatalf("unexpected error: %v", actualErr)
				}

	}
}

func normalizeClaims(claims []resourcev1alpha2.ResourceClaim) []resourcev1alpha2.ResourceClaim {
	sort.Slice(claims, func(i, j int) bool {
		if claims[i].Namespace < claims[j].Namespace {
			return true
		}
		if claims[i].Namespace > claims[j].Namespace {
			return false
		}
		return claims[i].Name < claims[j].Name
	})
	for i := range claims {
		if len(claims[i].Status.ReservedFor) == 0 {

		}
		return
	}

	claims := struct{}{}
	if err := json.Unmarshal([]byte(c.claims), &claims); err != nil {
		t.Fatalf("failed to unmarshal claims: %v", err)
	}

	// Sign and serialize the claims in a JWT.
	jws, err := signer.Sign([]byte(c.claims))
	if err != nil {
		t.Fatalf("sign claims: %v", err)
	}
	token, err := jws.CompactSerialize()
	if err != nil {

							if claim.Name == claimName {
								claim = claim.DeepCopy()
								claim.Status.ReservedFor = inUseClaim.Status.ReservedFor
							}
							return claim
						},
					},
				},
			},
		},
		"claim-template": {
			pod:    podWithClaimTemplateInStatus,
			claims: []*resourcev1alpha2.ResourceClaim{allocatedClaim, otherClaim},
			want: want{
				prebind: result{
					changes: change{

	if claims[0].Annotations == nil {
		claims[0].Annotations = map[string]string{name: value}
	} else {
		claims[0].Annotations[name] = value
	}
	return claims
}

func claimWithDataSource(name, kind, apiGroup string, claims []*v1.PersistentVolumeClaim) []*v1.PersistentVolumeClaim {
	claims[0].Spec.DataSource = &v1.TypedLocalObjectReference{
		Name:     name,
		Kind:     kind,

	}
	value, ok := distClaims[r.claim]
	if !ok {
		return fmt.Errorf("jwt returned by distributed claim endpoint %q did not contain claim: %v", endpoint.URL, r.claim)
	}
	allClaims[r.claim] = value
	return nil
}

func (v *idTokenVerifier) Verify(ctx context.Context, rawIDToken string) (*oidc.IDToken, error) {
	t, err := v.verifier.Verify(ctx, rawIDToken)

		obj := action.(core.UpdateAction).GetObject()
		claim := obj.(*v1.PersistentVolumeClaim)

		// check the claim does not exist
		_, found := r.claims[claim.Name]
		if found {
			return true, nil, fmt.Errorf("cannot create claim %s: claim already exists", claim.Name)
		}

		// Store the updated object to appropriate places.
		r.claims[claim.Name] = claim

			if err != nil {
				return nil, err
			}
			return []string{ret}, nil
		}
		claims = append(claims, s[begin+1:end])
		begin = end + 1
	}
	return claims, nil
}

func MetadataStringMatcherForJWTClaim(claim string, m *matcherpb.StringMatcher) *matcherpb.MetadataMatcher {
	return MetadataValueMatcherForJWTClaim(claim, &matcherpb.ValueMatcher{
		MatchPattern: &matcherpb.ValueMatcher_StringMatch{
			StringMatch: m,
		},

}

// ClaimsMapper provides a CEL expression mapper configured with the claims CEL variable.
type ClaimsMapper interface {
	// EvalClaimMapping evaluates the given claim mapping expression and returns a EvaluationResult.
	// This is used for username, groups and uid claim mapping that contains a single expression.
	EvalClaimMapping(ctx context.Context, claims *unstructured.Unstructured) (EvaluationResult, error)