clear(b)
	return len(b), nil
}

// mustReadFull is like io.ReadFull except it returns
// io.ErrUnexpectedEOF when io.EOF is hit before len(b) bytes are read.
func mustReadFull(r io.Reader, b []byte) (int, error) {
	n, err := tryReadFull(r, b)
	if err == io.EOF {
		err = io.ErrUnexpectedEOF
	}
	return n, err
}

// tryReadFull is like io.ReadFull except it returns

   *
   * Note that transport-layer success (receiving a HTTP response code, headers and body) does not
   * necessarily indicate application-layer success: `response` may still indicate an unhappy HTTP
   * response code like 404 or 500.
   */
  @Throws(IOException::class)
  fun onResponse(
    call: Call,
    response: Response,
  )

 * should not fail a test when it does. (The behavior of a {@code TearDown} that throws an exception
 * varies; see its documentation for details.) Use it just like a {@code TearDown}, except override
 * {@link #sloppyTearDown()} instead.
 *
 * @author Luiz-Otavio Zorzella
 * @since 10.0
 */
@GwtCompatible
@NullMarked
public abstract class SloppyTearDown implements TearDown {

    Java package; see
    https://groups.google.com/g/google-web-toolkit-contributors/c/CqYH59Dt_rQ/m/uVGW1QdUsXUJ
    for details.

    The summary is that it ignores one file in favor of the other.
    util.concurrent, like nearly all our packages, has two .gwt.xml files: one
    for prod and one for tests. However, unlike our other packages, as of this
    writing it has test supersource but no prod supersource.

    Java package; see
    https://groups.google.com/g/google-web-toolkit-contributors/c/CqYH59Dt_rQ/m/uVGW1QdUsXUJ
    for details.

    The summary is that it ignores one file in favor of the other.
    util.concurrent, like nearly all our packages, has two .gwt.xml files: one
    for prod and one for tests. However, unlike our other packages, as of this
    writing it has test supersource but no prod supersource.

import java.util.Iterator;
import java.util.Map.Entry;
import junit.framework.TestCase;
import org.jspecify.annotations.NullUnmarked;

/**
 * Tests for {@code AbstractBiMap}.
 *
 * @author Mike Bostock
 */
@NullUnmarked
public class AbstractBiMapTest extends TestCase {

  // The next two tests verify that map entries are not accessed after they're

     */
    Optional<Boolean> yes();

    /**
     * Returns the list of encryption goals to be executed.
     * These goals can include operations like "init", "add-server", "delete-server", etc.
     *
     * @return an {@link Optional} containing the list of goals, or empty if not specified
     */
    @Nonnull
    Optional<List<String>> goals();

import junit.framework.TestCase;
import org.jspecify.annotations.NullMarked;
import org.jspecify.annotations.Nullable;

/**
 * Tests for {@link Multisets#immutableEntry}.
 *
 * @author Mike Bostock
 */
@GwtCompatible
@NullMarked
public class MultisetsImmutableEntryTest extends TestCase {
  private static final @Nullable String NE = null;

import java.util.List;
import java.util.Set;
import junit.framework.TestSuite;

/**
 * Concrete instantiation of {@link AbstractCollectionTestSuiteBuilder} for testing collections that
 * do not have a more specific tester like {@link ListTestSuiteBuilder} or {@link
 * SetTestSuiteBuilder}.
 *
 * @author Chris Povirk
 * @author Louis Wasserman
 */
@GwtIncompatible
public class CollectionTestSuiteBuilder<E>

OPA is a lightweight general-purpose policy engine that can be co-located with MinIO server, in this document we talk about how to use OPA HTTP API to authorize requests. It can be used with any type of credentials (STS based like OpenID or LDAP, regular IAM users or service accounts).

OPA is enabled through MinIO's Access Management Plugin feature.

## Get started

### 1. Start OPA in a container

```sh
podman run -it \
    --name opa \