class ZTSImpl implements KeyStore, ZTSHandler {

    long determineTokenTimeout(DataCache data, Set<String> roles, Integer minExpiryTime,
            Integer maxExpiryTime) {
        
        // we're going to default our return value to the default token
        // timeout configured in the server
        
        long tokenTimeout = roleTokenDefaultTimeout;
        
        if (maxExpiryTime != null && maxExpiryTime > 0) {
            
            // if our max expiry time is given and it's a positive number then
            // we return that value as our result. We're checking and using the
            // max value first since that allows the biggest opportunity on the
            // client side to cache the token and return on subsequent requests
            
            tokenTimeout = maxExpiryTime;
            
        } else if (minExpiryTime != null && minExpiryTime > roleTokenDefaultTimeout) {
            
            // now we return the min value but only if it's bigger than our
            // default value (if the client is looking for a token that's smaller
            // than the default timeout, then they would have specified their 
            // desired smaller value as the max timeout and the first if block
            // would have set accordingly.
            
            tokenTimeout = minExpiryTime;
        }
        
        // however, we're not going to allow the client to ask for unlimited
        // tokens so we'll max it out to the server's configured max timeout
        
        if (tokenTimeout > roleTokenMaxTimeout) {
            tokenTimeout = roleTokenMaxTimeout;
        }

        // fetch the configured max allowed value for all roles in the set
        // if it's configured and is less that what we have determined so
        // far then we'll reduce it to the configured value

        int maxAllowedExpirySecs = getConfiguredTokenExpiryTimeMins(data, roles) * 60;
        if (maxAllowedExpirySecs > 0 && maxAllowedExpirySecs < tokenTimeout) {
            tokenTimeout =  maxAllowedExpirySecs;
        }

        return tokenTimeout;
    }

    public  ZTSImpl();
    public  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore);

}