anchor.diff:      terminate/2, code_change/3
   ]).
   
  --type timestamp() :: time:seconds().
  +-type expiration_marker() ::
  +    undefined |
  +    % Used mainly for caching token verification errors like e.g. revoked token
  +    % or lack of connection to oz. Such errors are cached to not overflow oz with
  +    % requests that will probably end with error. However, such errors may be
  +    % temporary and as such those entries should be kept only for some,
  +    % preferably short and independent of time warps, period of time
  +    {interval, countdown_timer:instance()} |
  +    % Used to cache entries for tokens with time caveats (explicit ttl) which
  +    % depend on global clock
  +    {timestamp, time:seconds()}.
   
   -type token_ref() ::
       {named, tokens:id()} |
  
positive.code: 
      token_ref :: undefined | token_ref(),
      token_revoked = false :: boolean(),
      cache_expiration :: undefined | timestamp()
  }).
  
  -record(state, {
      cache_purge_timer = undefined :: undefined | reference()
  
negative.code: -spec get_token_credentials_verification_result(auth_manager:token_credentials()) ->
      {ok, auth_manager:verification_result()} | ?ERROR_NOT_FOUND.
  get_token_credentials_verification_result(TokenCredentials) ->
      try ets:lookup(?CACHE_NAME, TokenCredentials) of
          [#cache_entry{} = Entry] ->
              case has_cache_entry_expired(Entry) of
                  true ->
                      ?ERROR_NOT_FOUND;
                  false ->
                      case Entry#cache_entry.token_revoked of
                          true -> {ok, ?ERROR_TOKEN_REVOKED};
                          false -> {ok, Entry#cache_entry.verification_result}
                      end
              end;
          _ ->
              ?ERROR_NOT_FOUND
  