if err != nil {
			writeSTSErrorResponse(ctx, w, ErrSTSInvalidClientCertificate, err)
			return
		}
	} else {
		// Technically, there is no security argument for verifying the key usage
		// when we don't verify that the certificate has been issued by a trusted CA.
		// Any client can create a certificate with arbitrary key usage settings.
		//
		// However, this check ensures that a certificate with an invalid key usage

    @Test
    public void test_constructor() {
        // Verify suffix is set correctly
        assertEquals(PagerCreator.SUFFIX, "Pager");

        // Verify name suffix is set
        assertEquals("Pager", pagerCreator.getNameSuffix());

        // Verify instance def is SESSION
        assertEquals(InstanceDefFactory.SESSION, pagerCreator.getInstanceDef());

        // Verify auto binding def is NONE

        // Verify the decision consulted the configuration
        // getConfig() is called twice: once in Kerb5Authenticator and once in NtlmPasswordAuthenticator
        verify(tc, times(2)).getConfig();
        verify(config, times(1)).isAllowNTLMFallback();
        verify(config, times(1)).isUseRawNTLM();
    }

    @Test

        assertEquals(0, deleted);
        // Verify it used the same search logic (type parameter is ignored)
        verify(mockClient).prepareSearch("test-index");
    }

    /**
     * Test: Verify that OnConnectListener is properly invoked
     */
    @Test
    public void testOnConnectListenerInvoked() {

        Map<String, ?> returned = entries[0].getOptions();

        // Assert: sanity check and verify that no mutating calls were made after construction
        assertEquals("true", returned.get("refreshKrb5Config"));
        verify(spyOpts, never()).put(any(), any());
        verify(spyOpts, never()).remove(any());
        verify(spyOpts, never()).clear();
    }

            // Convert to string to check formatting
            String result = DomUtils.toXml(document);

            // If pluginManagement was added, verify proper formatting
            if (result.contains("<pluginManagement>")) {
                // Verify that the XML formatting is correct - no malformed closing tags
                assertFalse(result.contains("</plugin></plugins>"), "Should not have malformed closing tags");

        // Assert: delegate interactions occur when usage transitions happen
        verify(delegate, times(1)).acquire();
        verify(delegate, times(1)).release();
    }

    @Test
    @DisplayName("finalize() invokes checkRelease exactly once")
    void finalize_invokes_checkRelease() throws Throwable {
        // Arrange: spy to verify internal interaction with checkRelease()
        CIFSContext ctx = mock(CIFSContext.class);

import static org.junit.jupiter.api.Assertions.fail;
import static org.mockito.Mockito.doReturn;
import static org.mockito.Mockito.spy;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;

import java.util.HashMap;

import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.NameCallback;

import static org.junit.jupiter.api.Assertions.assertSame;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;

import java.security.Principal;

import org.junit.jupiter.api.DisplayName;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;

            when(mockConfig.isRequireSecureNegotiate()).thenReturn(true);
            when(mockDigest.verify(buffer, 0, 100, 0, response)).thenReturn(false);

            boolean result = response.verifySignature(buffer, 0, 100);

            assertTrue(result);
            verify(mockDigest).verify(buffer, 0, 100, 0, response);
        }
    }

    @Nested
    @DisplayName("Expiration Tests")