}

// Apply applies the SSE bucket configuration on the given HTTP headers and
// sets the specified SSE headers.
//
// Apply does not overwrite any existing SSE headers. Further, it will
// set minimal SSE-KMS headers if autoEncrypt is true and the BucketSSEConfig
// is nil.
func (b *BucketSSEConfig) Apply(headers http.Header, opts ApplyOptions) {
	if crypto.Requested(headers) {
		return
	}
	if b == nil {

            // These methods do not throw and allow interaction checks.
            tc.getConfig();
            tc.getCredentials();

            // Minimal behavior: return a mock SSPContext with lenient stubbing
            SSPContext ctx = mock(SSPContext.class);
            lenient().when(ctx.isEstablished()).thenReturn(false);
            return ctx;
        }

   * the range map, or {@code null} otherwise.
   */
  @Nullable Entry<Range<K>, V> getEntry(K key);

  /**
   * Returns the minimal range {@linkplain Range#encloses(Range) enclosing} the ranges in this
   * {@code RangeMap}.
   *
   * @throws NoSuchElementException if this range map is empty
   */
  Range<K> span();

  /**

            f.setAccessible(true);
            f.set(c, val);
        } catch (Exception e) {
            throw new AssertionError(e);
        }
    }

    // Helper to build a minimal smb URL
    private static URL smbUrl(String spec) throws Exception {
        return new URL(null, spec, new Handler());
    }

    @Test
    @DisplayName("getConfig returns context config")

            return fileModel;
        }

        @Override
        public ModelBuilderRequest getRequest() {
            return null;
        }

        // Other required methods with minimal implementations
        @Override
        public ModelSource getSource() {
            return new ModelSource() {
                @Override
                public Path getPath() {

        // Configuration is not used during decode when no signing digest is set
        Configuration cfg = mock(Configuration.class);
        return new Smb2SessionSetupResponse(cfg);
    }

    /**
     * Build a minimal SMB2 header for a response at the given offset.
     * The header is prepared as a synchronous response with server-to-redirector flag.
     */

class Kerb5AuthenticatorTest {

    @Mock
    CIFSContext tc;

    @Mock
    Configuration config;

    private static byte[] spnegoInitWithMechs(ASN1ObjectIdentifier... mechs) {
        // Build a minimal SPNEGO NegTokenInit containing the provided mechanisms
        NegTokenInit tok = new NegTokenInit(mechs, 0, null, null);
        return tok.toByteArray();
    }

    @Test

        // Valid share URL with trailing slash; constructing does not perform I/O
        return new SmbFile("smb://test-server/share/");
    }

    // Helper to create a minimal FileEntry mock
    private FileEntry entry(String name, int type) {
        FileEntry e = mock(FileEntry.class);
        when(e.getName()).thenReturn(name);
        when(e.getType()).thenReturn(type);
        return e;

            assertSame(rp, Enum.valueOf(RequestParam.class, rp.name()));
        }
    }

    // Interaction: Demonstrate no external interactions occur (no collaborators to call)
    // We use Mockito in a minimal, meaningful way: pass the enum to a mocked consumer and verify interaction.
    interface EnumConsumer {
        void accept(RequestParam rp);
    }

    @Mock
    EnumConsumer consumer;

    @Test

The following minimal permission policy is needed by admin user setting up replication on the `source`:

```
{
 "Version": "2012-10-17",
 "Statement": [
  {
    "Action": [
        "admin:SetBucketTarget",