if (handleInfo == null) {
            return CompletableFuture.failedFuture(new IOException("Handle info cannot be null"));
        }

        if (handleInfo.isExpired()) {
            return CompletableFuture.failedFuture(new IOException("Handle has expired and cannot be reconnected: " + handleInfo.getPath()));
        }

            final TimeoutTask task = e.getElement();
            if (task.isCanceled()) {
                e.remove();
            } else if (!task.isStopped() && task.isExpired()) {
                expiredTask.add(task);
                if (!task.isPermanent()) {
                    e.remove();
                }
            }
        }
        return expiredTask;
    }

    private void checkHeartbeats() {
        long timeout = context.getConfig().getWitnessHeartbeatTimeout();

        for (WitnessRegistration registration : registrations.values()) {
            if (registration.isExpired(timeout)) {
                log.warn("Witness registration expired: {}", registration.getRegistrationId());

                registration.setState(WitnessRegistrationState.EXPIRED);

        assertTrue(entry.isComplete());
        assertFalse(entry.needsRefresh());

        // Wait for expiration
        Thread.sleep(100);

        assertTrue(entry.isExpired());
        assertTrue(entry.needsRefresh());

        // After expiration, cache should be treated as invalid by manager
        // (In real implementation, expired entries might be cleaned up automatically)
    }

	return ies.addUser(ctx, user, userType, u, m)
}

func (ies *IAMEtcdStore) addUser(ctx context.Context, user string, userType IAMUserType, u UserIdentity, m map[string]UserIdentity) error {
	if u.Credentials.IsExpired() {
		// Delete expired identity.
		deleteKeyEtcd(ctx, ies.client, getUserIdentityPath(user, userType))
		deleteKeyEtcd(ctx, ies.client, getMappedPolicyPath(user, userType, false))
		return nil
	}

		// validate token for temporary credentials only.
		return nil, ErrInvalidToken
	}

	// Expired credentials must return error right away.
	if cred.IsTemp() && cred.IsExpired() {
		return nil, toAPIErrorCode(r.Context(), errInvalidAccessKeyID)
	}
	secret := globalActiveCred.SecretKey
	if globalSiteReplicationSys.isEnabled() && cred.AccessKey != siteReplicatorSvcAcc {

	err := iamOS.loadIAMConfig(ctx, &u, getUserIdentityPath(user, userType))
	if err != nil {
		if err == errConfigNotFound {
			return u, errNoSuchUser
		}
		return u, err
	}

	if u.Credentials.IsExpired() {
		// Delete expired identity - ignoring errors here.
		iamOS.deleteIAMConfig(ctx, getUserIdentityPath(user, userType))
		iamOS.deleteIAMConfig(ctx, getMappedPolicyPath(user, userType, false))
		return u, errNoSuchUser

	// External (actual) LDAP DN to internal normalized representation
	actualDNToParentUserMap := make(map[string]string)
	for _, cred := range allCreds {
		// Expired credentials don't need parent user updates.
		if cred.IsExpired() {
			continue
		}

		if !sys.LDAPConfig.IsLDAPUserDN(cred.ParentUser) {
			continue
		}

		// Check if this is the first time we are
		// encountering this LDAP user.

// credential.
func (store *IAMStoreSys) SetTempUser(ctx context.Context, accessKey string, cred auth.Credentials, policyName string) (time.Time, error) {
	if accessKey == "" || !cred.IsTemp() || cred.IsExpired() || cred.ParentUser == "" {
		return time.Time{}, errInvalidArgument
	}

	ttl := int64(cred.Expiration.Sub(UTCNow()).Seconds())

	cache := store.lock()
	defer store.unlock()

					fmt.Errorf("Unable to heal service account from peer site %s -> %s : %w", latestPeerName, peerName, err),
					fmt.Sprintf("heal-user-%s", user))
			}
			continue
		}
		if creds.IsTemp() && !creds.IsExpired() {
			var parentPolicy string
			u, err := globalIAMSys.GetUserInfo(ctx, creds.ParentUser)
			if err != nil {
				// Parent may be "virtual" (for ldap, oidc, client tls auth,