class ZTSImpl implements KeyStore, ZTSHandler {

    boolean isPrincipalRoleCertificateAccessValid(Principal principal, String domainName, Set<String> roles) {

        // if the principal has no roles or an empty set then
        // we have nothing to check

        final List<String> princRoles = principal.getRoles();
        if (princRoles == null || princRoles.isEmpty()) {
            return true;
        }

        // verify that every role we're returning in the response
        // matches to a role from the principal object. the role
        // list from the principal object (typically from a role
        // certificate) expected to have full role resource names.

        for (String role : roles) {
            final String roleName = domainName + AuthorityConsts.ROLE_SEP + role;
            if (!princRoles.contains(roleName)) {
                LOGGER.error("Principal Role list does not include '{}'", roleName);
                return false;
            }
        }
        return true;
    }

    public  ZTSImpl();
    public  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore);

}