class ZTSImpl implements KeyStore, ZTSHandler {

    int getConfiguredRoleCertExpiryTimeMins(DataCache data, Set<String> roles) {

        // first we're going to determine the min allowed expiry
        // time for the given set of roles

        int maxAllowedExpiry = 0;
        for (String role: roles) {
            RoleMeta rm = data.getRoleMeta(role);
            if (rm == null) {
                continue;
            }
            Integer certExpiryMins = rm.getCertExpiryMins();
            if (certExpiryMins == null) {
                continue;
            }
            if (certExpiryMins > 0 && (maxAllowedExpiry == 0 || certExpiryMins < maxAllowedExpiry)) {
                maxAllowedExpiry = certExpiryMins;
            }
        }

        // if we don't have a value specified then we're going
        // to look at the domain value if one is configured

        if (maxAllowedExpiry == 0) {
            Integer certExpiryMins = data.getDomainData().getRoleCertExpiryMins();
            if (certExpiryMins != null && certExpiryMins > 0) {
                maxAllowedExpiry = certExpiryMins;
            }
        }

        return maxAllowedExpiry;
    }

    public  ZTSImpl();
    public  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore);

}