}
	return &KMS{
		Type:       Builtin,
		DefaultKey: keyID,
		conn: secretKey{
			keyID: keyID,
			key:   key,
		},
		latencyBuckets: defaultLatencyBuckets,
		latency:        make([]atomic.Uint64, len(defaultLatencyBuckets)),
	}, nil
}

// secretKey is a KMS implementation that derives new DEKs
// from a single key.
type secretKey struct {
	keyID string
	key   []byte
}

)

func (c *OperatorDNS) addAuthHeader(r *http.Request) error {
	if c.username == "" || c.password == "" {
		return nil
	}

	claims := &jwt.StandardClaims{
		ExpiresAt: int64(15 * time.Minute),
		Issuer:    c.username,
		Subject:   config.EnvDNSWebhook,
	}

	token := jwt.NewWithClaims(jwt.SigningMethodHS512, claims)
	ss, err := token.SignedString([]byte(c.password))
	if err != nil {

	Enable             bool          `json:"enable"`
	Brokers            []xnet.Host   `json:"brokers"`
	Topic              string        `json:"topic"`
	QueueDir           string        `json:"queueDir"`
	QueueLimit         uint64        `json:"queueLimit"`
	Version            string        `json:"version"`
	BatchSize          uint32        `json:"batchSize"`
	BatchCommitTimeout time.Duration `json:"batchCommitTimeout"`
	TLS                struct {

	w.buf = append(w.buf, p...)
	w.writeBytes += len(p)
	return len(p), nil
}

func (w *readFromWriter) ReadFrom(r io.Reader) (int64, error) {
	b, err := io.ReadAll(r)
	w.buf = append(w.buf, b...)
	w.readFromBytes += len(b)
	return int64(len(b)), err
}

// Test that calling (*Writer).ReadFrom with a partially-filled buffer
// fills the buffer before switching over to ReadFrom.

		{name: "long-fail", input: strings.Repeat("a/", 2000) + "../..", want: true},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(b *testing.B) {
			b.SetBytes(int64(len(tt.input)))
			b.ReportAllocs()
			for b.Loop() {
				if got := hasBadPathComponent(tt.input); got != tt.want {
					t.Fatalf("hasBadPathComponent() = %v, want %v", got, tt.want)
				}
			}
		})
	}

	// If the directory does not exist, it will be created.
	Directory string

	// MaximumFileSize defines the maximum size of each log file in bytes.
	MaximumFileSize int64

	// FileNameFunc specifies the name a new file will take.
	// FileNameFunc must ensure collisions in filenames do not occur.
	// Do not rely on timestamps to be unique, high throughput writes

	NoWait            bool        `json:"noWait"`
	AutoDeleted       bool        `json:"autoDeleted"`
	PublisherConfirms bool        `json:"publisherConfirms"`
	QueueDir          string      `json:"queueDir"`
	QueueLimit        uint64      `json:"queueLimit"`
}

// AMQP input constants.
//
// ST1003 We cannot change these exported names.
//
//nolint:staticcheck
const (
	AmqpQueueDir   = "queue_dir"
	AmqpQueueLimit = "queue_limit"

	}

	levelB1 := &LevelB1{Value: "foo"}
	if err := DB.Create(levelB1).Error; err != nil {
		t.Error(err)
	}

	levelB3 := &LevelB3{
		Value:     "bar",
		LevelB1ID: sql.NullInt64{Valid: true, Int64: int64(levelB1.ID)},
		LevelB2s:  []*LevelB2{},
	}
	if err := DB.Create(levelB3).Error; err != nil {
		t.Error(err)
	}
	levelB1.LevelB3s = []*LevelB3{levelB3}

	want := []*LevelB1{levelB1}

	Password           string    `json:"password"` // default: no password
	Database           string    `json:"database"` // default: same as user
	QueueDir           string    `json:"queueDir"`
	QueueLimit         uint64    `json:"queueLimit"`
	MaxOpenConnections int       `json:"maxOpenConnections"`
}

// Validate PostgreSQLArgs fields
func (p PostgreSQLArgs) Validate() error {
	if !p.Enable {
		return nil
	}

		if !stmt.ReflectValue.IsValid() {
			db.AddError(ErrInvalidValue)
		}
	}

	for _, f := range p.fns {
		f(db)
	}

	if stmt.SQL.Len() > 0 {
		db.Logger.Trace(stmt.Context, curTime, func() (string, int64) {
			sql, vars := stmt.SQL.String(), stmt.Vars
			if filter, ok := db.Logger.(ParamsFilter); ok {
				sql, vars = filter.ParamsFilter(stmt.Context, stmt.SQL.String(), stmt.Vars...)
			}