Message:    "Remote tier bucket not found",
		StatusCode: http.StatusBadRequest,
	}
	// error returned when remote tier credentials are invalid.
	errTierInvalidCredentials = AdminError{
		Code:       "XMinioAdminTierInvalidCredentials",
		Message:    "Invalid remote tier credentials",
		StatusCode: http.StatusBadRequest,
	}
	// error returned when reserved internal names are used.
	errTierReservedName = AdminError{

	key, err := hex.DecodeString(keyHex[8:])
	if err != nil {
		return err
	}
	// Verify that CRC is ok.
	want := binary.LittleEndian.Uint32(id)
	got := crc32.ChecksumIEEE(key)
	if want != got {
		return fmt.Errorf("Invalid key checksum, want %x, got %x", want, got)
	}

	stream, err := sio.AES_256_GCM.Stream(key)
	if err != nil {
		return err
	}
	// Zero nonce, we only use each key once, and 32 bytes is plenty.

 */
package jcifs.pac;

import jcifs.CIFSException;

/**
 * Exception thrown when PAC (Privilege Attribute Certificate) data cannot be decoded.
 * Indicates malformed or invalid PAC structures in Kerberos tickets.
 */
public class PACDecodingException extends CIFSException {

    private static final long serialVersionUID = 1L;

    /**

            throw new PACDecodingException("Non-empty string");
        }

        final int expected = this.length / 2;
        if (string.length() != expected) {
            throw new PACDecodingException("Invalid string length, expected " + expected + ", have " + string.length());
        }

        return string;
    }

        assertNotNull(securityDescriptor.getOwnerGroupSid());
    }

    @Test
    @DisplayName("Test decode throws exception for invalid ACE count")
    void testDecodeThrowsExceptionForInvalidAceCount() {
        // Prepare buffer with invalid ACE count (> 4096)
        prepareSecurityDescriptorBufferWithInvalidAceCount(testBuffer, 0);

  }

  /**
   * Ensures that valid flag combinations appear visually correct, and invalid show in hex.  This
   * also demonstrates how sparse the lookup table is.
   */
  @Test
  fun allFormattedFlagsWithValidBits() {
    val formattedFlags = mutableListOf<String>() // Highest valid flag is 0x20.
    for (i in 0..0x3f) formattedFlags.add(formatFlags(TYPE_HEADERS, i))

                    return negotiate2(r);
                } else if (r.getDialectRevision() != Smb2Constants.SMB2_DIALECT_0202) {
                    throw new CIFSException("Server returned invalid dialect verison in multi protocol negotiation");
                }

                final int permits = r.getInitialCredits();
                if (permits > 0) {
                    this.credits.release(permits);

            if (logger.isDebugEnabled()) {
                logger.debug("Invalid query: {}", body.q, e);
            }
            throwValidationErrorApi(e.getMessageCode());
        } catch (final ResultOffsetExceededException e) {
            if (logger.isDebugEnabled()) {
                logger.debug("Invalid offset: {}", body.offset, e);
            }

        assertNotNull(order);
        assertEquals(BucketOrder.key(true), order);
    }

    // Test getBucketOrder with invalid sort value
    public void test_getBucketOrder_invalidSort() {
        facetInfo.sort = "invalid.desc";
        BucketOrder order = facetInfo.getBucketOrder();
        assertNotNull(order);
        assertEquals(BucketOrder.count(false), order); // default
    }

    /**
     * Reads a 32-bit RID and constructs a SID from it.
     * @return the constructed SID object
     * @throws IOException if an I/O error occurs
     * @throws PACDecodingException if the SID data is invalid
     */
    public SID readId() throws IOException, PACDecodingException {
        final byte[] bytes = new byte[4];
        readFully(bytes);

        final byte[] sidBytes = new byte[8 + bytes.length];