verify(ace, times(2)).getAccessMask();
            verify(ace, times(1)).isAllow();
            verify(ace, times(1)).getFlags();
        }
    }

    @Nested
    @DisplayName("Real-world Usage Scenarios")
    class RealWorldUsageTests {

        @Test
        @DisplayName("Should handle typical file system permission scenarios")
        void shouldHandleFileSystemPermissions() {

 * except that they are always enabled. These methods should be used instead of Java assertions
 * whenever there is a chance the check may fail "in real life". Example:
 *
 * {@snippet :
 * Bill bill = remoteService.getLastUnpaidBill();
 *
 * // In case bug 12345 happens again we'd rather just die
 * Verify.verify(bill.status() == Status.UNPAID,

            unicodeString.length = (short) 6;
            unicodeString.maximum_length = (short) 10;
            unicodeString.buffer = new short[] { 100, 200, 300 };

            // Create a real NdrBuffer mock that can handle the deferred field access
            // But only test the non-deferred parts to avoid field mocking issues

            // When: Trying to encode (may throw exception due to deferred buffer)

        // We have metadata retrieval problems, or there are cycles that have been detected
        // so we give this back to the calling code and let them deal with this information
        // appropriately.

        if (result.hasMetadataResolutionExceptions()
                || result.hasVersionRangeViolations()
                || result.hasCircularDependencyExceptions()) {

      return "futures=" + localFutures;
    }
    return super.pendingToString();
  }

  /**
   * Must be called at the end of each subclass's constructor. This method performs the "real"
   * initialization; we can't put this in the constructor because, in the case where futures are
   * already complete, we would not initialize the subclass before calling {@link

        checkNotClosed();

        // Simple KDF implementation (should be replaced with proper KDF like HKDF)
        // This is a placeholder - real implementation should use proper KDF
        byte[] derived = new byte[length];

        // Combine inputs
        byte[] labelBytes = label.getBytes(java.nio.charset.StandardCharsets.UTF_8);

    @Mock
    private Configuration mockConfig;

    private NetServerEnum2Response response;

    @BeforeEach
    void setUp() throws Exception {
        MockitoAnnotations.openMocks(this);
        // Use real configuration for most tests
        mockConfig = new BaseConfiguration(false);
        response = new NetServerEnum2Response(mockConfig);
    }

    @Test
    @DisplayName("Test constructor with configuration")

     * fit comfortably within a single ethernet packet (1500 bytes) even with framing overhead.
     *
     * For tests this must be big enough to realize real compression on test messages like
     * 'aaaaaaaaaa...'. Our tests check if compression was applied just by looking at the size if
     * the inbound buffer.
     */
    const val DEFAULT_MINIMUM_DEFLATE_SIZE = 1024L
  }

		recV2 := httptest.NewRecorder()
		// construct HTTP request for Head Object endpoint.
		reqV2, err := newTestSignedRequestV2(http.MethodHead, getHeadObjectURL("", testCase.bucketName, testCase.objectName),
			0, nil, testCase.accessKey, testCase.secretKey, nil)
		if err != nil {
			t.Fatalf("Test %d: %s: Failed to create HTTP request for Head Object: <ERROR> %v", i+1, instanceType, err)
		}

		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
		return
	}

	api.getObjectAttributesHandler(ctx, objectAPI, bucket, object, w, r)
}

// HeadObjectHandler - HEAD Object
// -----------
// The HEAD operation retrieves metadata from an object without returning the object itself.
func (api objectAPIHandlers) HeadObjectHandler(w http.ResponseWriter, r *http.Request) {
	ctx := newContext(r, w, "HeadObject")