* @param apOptions AP options flags
     * @param keys array of Kerberos keys for decryption
     * @throws PACDecodingException if ticket decoding fails
     */
    public KerberosTicket(byte[] token, byte apOptions, KerberosKey[] keys) throws PACDecodingException {
        if (token.length <= 0) {
            throw new PACDecodingException("Empty kerberos ticket");
        }

        ASN1Sequence sequence;
        try {

     * @param object the object to cast
     * @return object cast to type
     * @throws PACDecodingException if types are incompatible
     */
    public static <T> T as(final Class<T> type, final Object object) throws PACDecodingException {
        if (!type.isInstance(object)) {
            throw new PACDecodingException("Incompatible object types " + type + " " + object.getClass());
        }

        return type.cast(object);

     * @param data the raw PAC data bytes
     * @param keys map of Kerberos keys for signature validation
     * @throws PACDecodingException if the PAC data is malformed or signature validation fails
     */
    public Pac(byte[] data, Map<Integer, KerberosKey> keys) throws PACDecodingException {
        byte[] checksumData = data.clone();
        try {

import org.junit.jupiter.api.Test;

import jcifs.pac.PACDecodingException;

/**
 * Test class for {@link KerberosToken}.
 */
class KerberosTokenTest {

    /**
     * Test constructor with an empty token.
     */
    @Test
    void testConstructorWithEmptyToken() {
        byte[] emptyToken = new byte[0];
        assertThrows(PACDecodingException.class, () -> new KerberosToken(emptyToken));
    }

    /**

     */
    @Test
    void testConstructorWithNullData() {
        // A null byte array should cause a PACDecodingException.
        PACDecodingException exception = assertThrows(PACDecodingException.class, () -> new PacCredentialType(null));
        assertEquals("Invalid PAC credential type", exception.getMessage());
    }

    /**

    }

    @Test
    @DisplayName("byte[] ctor: empty token throws PACDecodingException with clear message")
    void byteArrayConstructor_emptyToken_throws() {
        // Arrange
        byte[] empty = new byte[0];

        // Act + Assert
        PACDecodingException ex = assertThrows(PACDecodingException.class, () -> new KerberosApRequest(empty, new KerberosKey[0]));

    }

    /**
     * Test constructor with KERB_CHECKSUM_HMAC_MD5 type.
     *
     * @throws IOException if an I/O error occurs
     * @throws PACDecodingException if the PAC is malformed
     */
    @Test
    void testConstructorKerbChecksumHmacMd5() throws IOException, PACDecodingException {
        // Prepare data
        ByteArrayOutputStream baos = new ByteArrayOutputStream();

    }

    @Test
    void testConstructorWithEmptyToken() {
        // Test that PACDecodingException is thrown for an empty token
        byte[] emptyToken = new byte[0];
        PACDecodingException e = assertThrows(PACDecodingException.class, () -> new KerberosTicket(emptyToken, (byte) 0, keys));
        assertEquals("Empty kerberos ticket", e.getMessage());
    }

    @Test

     * @param data the data to calculate the MAC for
     * @return the calculated mac bytes
     * @throws PACDecodingException if the MAC calculation fails or required keys are missing
     */
    public static byte[] calculateMac(int type, Map<Integer, KerberosKey> keys, byte[] data) throws PACDecodingException {
        try {
            int usage = 17;
            if (type == PacSignature.KERB_CHECKSUM_HMAC_MD5) {

     *
     * @param token the PAC token bytes
     * @param keys map of Kerberos keys indexed by key type
     * @throws PACDecodingException if PAC decoding fails
     */
    public KerberosPacAuthData(byte[] token, Map<Integer, KerberosKey> keys) throws PACDecodingException {
        this.pac = new Pac(token, keys);
    }

    /**
     * Returns the PAC object.
     *