}

    /** The unique identifier for the access result. */
    protected IDTYPE id;

    /** The session ID associated with the access result. */
    protected String sessionId;

    /** The rule ID that matched the accessed resource. */
    protected String ruleId;

    /** The URL of the accessed resource. */
    protected String url;

    /** The parent URL of the accessed resource. */
    protected String parentUrl;

   * given predicate, if such an element exists.
   *
   * <p><b>Warning:</b> avoid using a {@code predicate} that matches {@code null}. If {@code null}
   * is matched in {@code iterable}, a NullPointerException will be thrown.
   *
   * <p><b>{@code Stream} equivalent:</b> {@code stream.filter(predicate).findFirst()}
   *
   * @since 11.0
   */

   * @param errorMessageTemplate a template for the exception message should the check fail. The
   *     message is formed by replacing each {@code %s} placeholder in the template with an
   *     argument. These are matched by position - the first {@code %s} gets {@code
   *     errorMessageArgs[0]}, etc. Unmatched arguments will be appended to the formatted message in
   *     square braces. Unmatched placeholders will be left as-is.

func (sys *IAMSys) getStoredLDAPPolicyMappingKeys(ctx context.Context, isGroup bool) set.StringSet {
	entityKeysInStorage := set.NewStringSet()
	cache := sys.store.rlock()
	defer sys.store.runlock()
	cachedPolicyMap := cache.iamSTSPolicyMap
	if isGroup {
		cachedPolicyMap = cache.iamGroupPolicyMap
	}
	cachedPolicyMap.Range(func(k string, v MappedPolicy) bool {
		entityKeysInStorage.Add(k)
		return true
	})

        });

        // Test witness address validation
        assertNotNull(mockWitnessAddress);
        assertTrue(mockWitnessAddress.getHostAddress().matches("\\d+\\.\\d+\\.\\d+\\.\\d+"));

        // Test service endpoint formatting
        String serviceEndpoint = "ncacn_ip_tcp:" + mockWitnessAddress.getHostAddress() + "[135]";
        assertNotNull(serviceEndpoint);

 * available online).
 * <p>
 * Direct ACEs are evaluated first in order. The SID of the user performing
 * the operation and the desired access bits are compared to the SID
 * and access mask of each ACE. If the SID matches, the allow/deny flags
 * and access mask are considered. If the ACE is a "deny"
 * ACE and <i>any</i> of the desired access bits match bits in the access
 * mask of the ACE, the whole access check fails. If the ACE is an "allow"

            }
            fail("Should have thrown RuntimeException");
        } catch (RuntimeException e) {
            assertEquals("Simulated processing error", e.getMessage());
            // If InputStream wasn't properly closed, this would leak resources
            // try-with-resources ensures cleanup happens
        } catch (IOException e) {
            fail("Should not throw IOException: " + e.getMessage());
        }

    }

    @Test
    public void testDeleteByQueryWithNoMatches() {
        // Test delete with query that matches nothing
        boolean result = SuggestUtil.deleteByQuery(client, settings, TEST_INDEX, QueryBuilders.termQuery("nonexistent", "value"));
        assertTrue(result); // Should still return true even with no matches
    }

    @Test(expected = SuggesterException.class)
    public void testDeleteByQueryWithInvalidIndex() {

        byte[] buffer = new byte[request.size()];
        int encodedLength = request.encode(buffer, 0);

        // Verify encoded length matches size
        assertEquals(request.size(), encodedLength);

        // Verify capabilities (4 bytes)
        assertEquals(DEFAULT_CAPABILITIES, SMBUtil.readInt4(buffer, 0));

        // Verify client GUID (16 bytes)

            try {
                target = ingester.process(target, paramMap);
            } catch (final Exception e) {
                logger.warn("[{}] Failed to process ingester", ingester.getClass().getSimpleName(), e);
            }
        }
        return target;
    }

    /**
     * Commits any remaining documents in the cache to the index.
     * This method ensures all pending documents are processed.
     */