)

	certExpirySeconds = monitoring.NewDerivedGauge(
		"cert_expiry_seconds",
		"The time remaining, in seconds, before the certificate chain will expire. "+
			"A negative value indicates the cert is expired.",
	)

	// testHookStepTime sleeps until time has moved forward by a nonzero amount.
	// This helps to avoid flakes in timeout tests by ensuring that an implausibly
	// short deadline (such as 1ns in the future) is always expired by the time
	// a relevant system call occurs.
	testHookStepTime = func() {}

		Description:    "The web identity token that was passed is expired or is not valid. Get a new identity token from the identity provider and then retry the request.",
		HTTPStatusCode: http.StatusBadRequest,
	},
	ErrSTSClientGrantsExpiredToken: {
		Code:           "ExpiredToken",

        try {
            searchEngineClient.deleteByQuery(fessConfig.getIndexDocumentUpdateIndex(), queryBuilder);

        } catch (final Exception e) {
            logger.error("Could not delete expired documents: {}", queryBuilder, e);
            resultBuf.append(e.getMessage()).append("\n");
        }

        return resultBuf.toString();
    }

                if (expiry.isMustCheck()) {
                    LOGGER.debug("Version listing in dynamic revision cache is expired: will perform fresh resolve of '{}' in '{}'", requested, delegate.getName());
                } else {
                    // When age == 0, verified since the start of this build, assume listing hasn't changed

type realClock struct{}

func (realClock) Now() time.Time { return time.Now() }

// LRUExpireCache is a cache that ensures the mostly recently accessed keys are returned with
// a ttl beyond which keys are forcibly expired.
type LRUExpireCache struct {
	// clock is used to obtain the current time
	clock Clock

	lock sync.Mutex

	maxSize      int
	evictionList list.List
	entries      map[interface{}]*list.Element
}

	if certErr != nil {
		return time.Duration(0), certErr
	}
	timeToExpire := cert.NotAfter.Sub(now)
	if timeToExpire < 0 {
		return time.Duration(0), fmt.Errorf("certificate already expired at %s, but now is %s",
			cert.NotAfter, now)
	}
	// Note: multiply time.Duration(int64) by an int (gracePeriodPercentage) will cause overflow (e.g.,
	// when duration is time.Hour * 90000). So float64 is used instead.

		},
		{
			execClientConfig: cannedResponseMap,
			args:             strings.Split("--generation=1 --timeout 20ms VirtualService foo.default --proxy not-proxy", " "),
			wantException:    true,
			expectedOutput:   "timeout expired before resource",
		},
		{
			execClientConfig: cannedResponseMap,
			args:             strings.Split("--generation=1 not-service foo.default", " "),
			wantException:    true,

	purgeStart := time.Now()

	// Purge expired STS credentials.

	// Scan STS users on disk and purge expired ones.
	stsAccountsFromStore := map[string]UserIdentity{}
	stsAccPoliciesFromStore := xsync.NewMapOf[string, MappedPolicy]()
	for _, item := range listedConfigItems[stsListKey] {
		userName := path.Dir(item)
		// loadUser() will delete expired user during the load.

	ID      string `json:"id"`
	Enabled bool   `json:"enabled"`
}

// Standard errors.
var (
	ErrNotImplemented     = errors.New("function not implemented")
	ErrAccessTokenExpired = errors.New("access_token expired or unauthorized")
)

// Provider implements identity provider specific admin operations, such as
// looking up users, fetching additional attributes etc.
type Provider interface {