* certificates are base64-encoded and appear each on their own line. The next line contains the
     * length of the local certificate chain. These certificates are also base64-encoded and appear
     * each on their own line. A length of -1 is used to encode a null array. The last line is
     * optional. If present, it contains the TLS version.
     */

	"fmt"
	"log"
	"net/http"
	"net/url"
	"strings"
	"time"

	"golang.org/x/oauth2"

	"github.com/minio/minio-go/v7"
	"github.com/minio/minio-go/v7/pkg/credentials"
)

// Returns a base64 encoded random 32 byte string.
func randomState() string {
	b := make([]byte, 32)
	rand.Read(b)
	return base64.RawURLEncoding.EncodeToString(b)
}

var (
	stsEndpoint    string
	configEndpoint string

            contextHandle = new byte[20];
        }
        buf.readOctetArray(contextHandle, 0, 20);
    }

    /**
     * Encodes a wide string pointer in NDR format.
     *
     * @param buf the NDR buffer
     * @param str the string to encode (can be null)
     * @throws NdrException if encoding fails
     */
    private void encodeWideStringPointer(NdrBuffer buf, String str) throws NdrException {

    val decoded = CertificateAdapters.time.fromDer(generalizedTimeDer)
    val encoded = CertificateAdapters.time.toDer(decoded)

    assertThat(decoded).isEqualTo(date("2050-01-01T00:00:00.000+0000").time)
    assertThat(encoded).isEqualTo(generalizedTimeDer)
  }

  /**
   * Conforming applications MUST be able to process validity dates that are encoded in either
   * UTCTime or GeneralizedTime.
   */

        final byte[] mechanismListMIC = this.mechContext.calculateMIC(ml);
        if (log.isDebugEnabled()) {
            log.debug("Out Mech list " + Arrays.toString(lm));
            log.debug("Out Mech list encoded " + Hexdump.toHexString(ml));
            log.debug("Out Mech list MIC " + Hexdump.toHexString(mechanismListMIC));
        }
        return mechanismListMIC;
    }

This is because by default, FastAPI will inspect every item inside and make sure it is serializable as JSON, using the same [JSON Compatible Encoder](../tutorial/encoder.md){.internal-link target=_blank} explained in the tutorial. This is what allows you to return **arbitrary objects**, for example database models.

    }

    @Test
    @DisplayName("byte[] ctor: top-level non-SEQUENCE triggers PACDecodingException (type mismatch)")
    void byteArrayConstructor_topLevelNotSequence_throws() throws Exception {
        // Arrange: Encoded INTEGER instead of SEQUENCE
        byte[] notASequence = new ASN1Integer(42).getEncoded();

        // Act + Assert
        assertThrows(PACDecodingException.class, () -> new KerberosApRequest(notASequence, null));
    }

            encodeSet = FORM_ENCODE_SET,
            // Plus is encoded as `%2B`, space is encoded as plus.
            plusIsSpace = false,
            charset = charset,
          )
        values +=
          value.canonicalizeWithCharset(
            encodeSet = FORM_ENCODE_SET,
            // Plus is encoded as `%2B`, space is encoded as plus.
            plusIsSpace = false,
            charset = charset,

  @Test
  fun testGoogleDotComEncoding() {
    val encoded = encodeQuery("google.com", TYPE_A)
    assertThat(encoded).isEqualTo("AAABAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ")
  }

  private fun encodeQuery(
    host: String,
    type: Int,
  ): String = DnsRecordCodec.encodeQuery(host, type).base64Url().replace("=", "")

  @Test
  fun testGoogleDotComEncodingWithIPv6() {
    val encoded = encodeQuery("google.com", TYPE_AAAA)

        // The actual implementation reassigns _dst = _dst.deferred inside encode(), so we can't verify the exact buffer
        verify(objAttr.root_directory).encode(any(NdrBuffer.class));
        verify(objAttr.object_name).encode(any(NdrBuffer.class));
        verify(objAttr.security_quality_of_service).encode(any(NdrBuffer.class));
    }

    @Test