assertEquals(0x001200A9, ace.getAccessMask());
    }

    @Test
    @DisplayName("Test getSID returns correct SID")
    void testGetSID() throws SmbException {
        assertNull(ace.getSID());

        SID testSid = new SID("S-1-5-21-1234567890-123456789-123456789-1000");
        ace.sid = testSid;

        assertSame(testSid, ace.getSID());
    }

    @Test
    @DisplayName("Test decode with offset")

    /** SID name type: well-known group. */
    public static final int SID_NAME_WKN_GRP = 5;
    /** SID name type: deleted account. */
    public static final int SID_NAME_DELETED = 6;
    /** SID name type: invalid. */
    public static final int SID_NAME_INVALID = 7;
    /** SID name type: unknown. */
    public static final int SID_NAME_UNKNOWN = 8;

    /**
     * LSA translated SID structure for name to SID lookups.

    private final int sid;

    /**
     * Creates a new SMB1 find close request to close a search handle.
     *
     * @param config the CIFS configuration
     * @param sid the search identifier to close
     */
    public SmbComFindClose2(final Configuration config, final int sid) {
        super(config, SMB_COM_FIND_CLOSE2);
        this.sid = sid;
    }

    @Override

import jcifs.smb1.util.Hexdump;

class Trans2FindNext2 extends SmbComTransaction {

    private final int sid, informationLevel;
    private int resumeKey;
    private final int flags;
    private String filename;

    Trans2FindNext2(final int sid, final int resumeKey, final String filename) {
        this.sid = sid;
        this.resumeKey = resumeKey;
        this.filename = filename;
        command = SMB_COM_TRANSACTION2;

import org.junit.jupiter.api.Test;

import jcifs.smb.SID;

/**
 * Tests for the {@link PacGroup} class.
 */
class PacGroupTest {

    private SID mockSid;
    private PacGroup pacGroup;
    private final int attributes = 42;

    @BeforeEach
    void setUp() {
        // Mock the SID object
        mockSid = mock(SID.class);
        pacGroup = new PacGroup(mockSid, attributes);
    }

    private static final String TEST_DOMAIN = "TESTDOMAIN";
    private static final String TEST_SERVER = "SERVER01";

    private SID domainSid;
    private SID userSid;

    @BeforeEach
    void setUp() throws Exception {
        domainSid = new SID("S-1-5-21-1-2-3");
        userSid = new SID("S-1-5-21-1-2-3-1000");
    }

    private void writeLittleEndianShort(DataOutputStream dos, short value) throws IOException {

 * "The .NET Developer's Guide to Windows Security" (which is also
 * available online).
 * <p>
 * Direct ACEs are evaluated first in order. The SID of the user performing
 * the operation and the desired access bits are compared to the SID
 * and access mask of each ACE. If the SID matches, the allow/deny flags
 * and access mask are considered. If the ACE is a "deny"
 * ACE and <i>any</i> of the desired access bits match bits in the access

    }

    @Nested
    @DisplayName("SID Tests")
    class SidTests {

        @Test
        @DisplayName("Should encode SID correctly")
        void testSidTEncode() throws NdrException {
            // Given: A SID with test values
            rpc.sid_t sid = new rpc.sid_t();
            sid.revision = (byte) 1;
            sid.sub_authority_count = (byte) 2;

package jcifs.smb1.dcerpc.msrpc;

import jcifs.smb1.smb1.SID;

class LsarSidArrayX extends lsarpc.LsarSidArray {

    LsarSidArrayX(final SID[] sids) {
        this.num_sids = sids.length;
        this.sids = new lsarpc.LsarSidPtr[sids.length];
        for (int si = 0; si < sids.length; si++) {
            this.sids[si] = new lsarpc.LsarSidPtr();
            this.sids[si].sid = sids[si];
        }
    }

        // Owner SID offset
        if (includeOwner) {
            SMBUtil.writeInt4(currentOffset, buffer, offset + 4);
            prepareSimpleSid(buffer, offset + currentOffset);
            currentOffset += 20; // Simple SID size
        } else {
            SMBUtil.writeInt4(0, buffer, offset + 4);
        }

        // Group SID offset
        if (includeGroup) {