logger.Info("bucketMetacache.findCache: bucket %s does not match this bucket %s", o.Bucket, b.bucket)
		debug.PrintStack()
		return metacache{}
	}

	// Grab a write lock, since we create one if we cannot find one.
	b.mu.Lock()
	defer b.mu.Unlock()

	// Check if exists already.
	if c, ok := b.caches[o.ID]; ok {
		c.lastHandout = time.Now()
		b.caches[o.ID] = c
		b.debugf("returning existing %v", o.ID)
		return c

type IAMStorageAPI interface {
	// The role of the read-write lock is to prevent go routines from
	// concurrently reading and writing the IAM storage. The (r)lock()
	// functions return the iamCache. The cache can be safely written to
	// only when returned by `lock()`.
	lock() *iamCache
	unlock()
	rlock() *iamCache
	runlock()
	getUsersSysType() UsersSysType

	if err == nil {
		return
	}

	nerr := unwrapErrs(err)
	l.Lock()
	shouldLog := true
	prev, ok := l.IDMap[id]
	if !ok {
		l.IDMap[id] = onceErr{
			Err:   nerr,
			Count: 1,
		}
	} else if prev.Err.Error() == nerr.Error() {
		// if errors are equal do not log.
		prev.Count++
		l.IDMap[id] = prev
		shouldLog = false
	}
	l.Unlock()

	if shouldLog {
		consoleLogIf(ctx, subsystem, err, errKind...)
	}

	return &targetsList{}
}

func (tl *targetsList) get() []Target {
	tl.mu.RLock()
	defer tl.mu.RUnlock()

	return tl.list
}

func (tl *targetsList) add(t Target) {
	tl.mu.Lock()
	defer tl.mu.Unlock()

	tl.list = append(tl.list, t)
}

func (tl *targetsList) set(tgts []Target) {
	tl.mu.Lock()
	defer tl.mu.Unlock()

	tl.list = tgts
}

var (

	globalAuthPluginMutex.Lock()
	defer globalAuthPluginMutex.Unlock()
	return globalAuthNPlugin
}

func newGlobalAuthZPluginFn() *polplugin.AuthZPlugin {
	globalAuthPluginMutex.Lock()
	defer globalAuthPluginMutex.Unlock()
	return globalAuthZPlugin
}

func setGlobalAuthNPlugin(authn *idplugin.AuthNPlugin) {
	globalAuthPluginMutex.Lock()
	globalAuthNPlugin = authn

		t.Fatalf("unexpected error: %v", err)
	}
	if err := ps.Subscribe(MaskAll, ch2, doneCh, nil); err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	ps.Lock()
	defer ps.Unlock()

	if len(ps.subs) != 2 || ps.NumSubscribers(MaskAll) != 2 || ps.Subscribers() != 2 {
		t.Fatalf("expected 2 subscribers")
	}
}

func TestNumSubscribersMask(t *testing.T) {
	ps := New[Maskable, Mask](2)

func (m *bucketMeasurement) updateExponentialMovingAverage(endTime time.Time) {
	// Calculate aggregate avg bandwidth and exp window avg
	m.lock.Lock()
	defer func() {
		m.startTime = endTime
		m.lock.Unlock()
	}()

	if m.startTime.IsZero() {
		return
	}

	if endTime.Before(m.startTime) {
		return
	}

	duration := endTime.Sub(m.startTime)

  }

  @Benchmark
  void unorderedCycleDetectingLocks(int reps) {
    lockAndUnlock(factory.newReentrantLock("foo"), reps);
  }

  private static void lockAndUnlock(Lock lock, int reps) {
    for (int i = 0; i < reps; i++) {
      lock.lock();
      lock.unlock();
    }
  }

  @Benchmark
  void orderedPlainLocks(int reps) {
    lockAndUnlockNested(plainLocks, reps);
  }

  @Benchmark

}

func (c *connMgr) addConn(conn *ZtunnelConnection) {
	log.Debug("ztunnel connected")
	c.mu.Lock()
	defer c.mu.Unlock()
	c.connectionSet[conn] = struct{}{}
	c.latestConn = conn
	ztunnelConnected.RecordInt(int64(len(c.connectionSet)))
}

func (c *connMgr) LatestConn() *ZtunnelConnection {
	c.mu.Lock()
	defer c.mu.Unlock()
	return c.latestConn
}

func (c *connMgr) deleteConn(conn *ZtunnelConnection) {

	// This ensures that Close will block until Read has completed.
	// This allows another goroutine to close the reader.
	pr.mu.Lock()
	defer pr.mu.Unlock()
	if pr.rc == nil {
		return 0, io.EOF
	}
	return pr.rc.Read(p)
}

func (pr *syncReadCloser) Close() error {
	pr.mu.Lock()
	defer pr.mu.Unlock()
	if pr.rc != nil {
		err := pr.rc.Close()
		pr.rc = nil