public static List<CredentialInfo> check(
      final List<String> tokens,
      final ExternalServiceCredentialsGenerator credentialsGenerator,
      final long maxAgeSeconds) {

    // the credential for the username with the latest timestamp (so far)
    final Map<String, CredentialInfo> bestForUsername = new HashMap<>();
    final List<CredentialInfo> results = new ArrayList<>();
    for (String token : tokens) {
      // each token is supposed to be in a "${username}:${password}" form,
      // (note that password part may also contain ':' characters)
      final String[] parts = token.split(":", 2);
      if (parts.length != 2) {
        results.add(new CredentialInfo(token, false, null, 0L));
        continue;
      }
      final ExternalServiceCredentials credentials = new ExternalServiceCredentials(parts[0], parts[1]);
      final Optional<Long> maybeTimestamp = credentialsGenerator.validateAndGetTimestamp(credentials, maxAgeSeconds);
      if (maybeTimestamp.isEmpty()) {
        results.add(new CredentialInfo(token, false, null, 0L));
        continue;
      }

      // now that we validated signature and token age, we will also find the latest of the tokens
      // for each username
      final long timestamp = maybeTimestamp.get();
      final CredentialInfo best = bestForUsername.get(credentials.username());
      if (best == null) {
        bestForUsername.put(credentials.username(), new CredentialInfo(token, true, credentials, timestamp));
        continue;
      }
      if (best.timestamp() < timestamp) {
        // we found a better credential for the username
        bestForUsername.put(credentials.username(), new CredentialInfo(token, true, credentials, timestamp));
        // mark the previous best as an invalid credential, since we have a better credential now
        results.add(best.invalidate());
      } else {
        // the credential we already had was more recent, this one can be marked invalid
        results.add(new CredentialInfo(token, false, null, 0L));
      }
    }

    // all invalid tokens should be in results, just add the valid ones
    results.addAll(bestForUsername.values());
    return results;
  }
@Test
  void single() {
    final ExternalServiceCredentials cred = GEN1.generateForUuid(UUID1);
    var result = ExternalServiceCredentialsSelector.check(
        List.of(token(cred)), GEN1, TimeUnit.MINUTES.toSeconds(1));
    assertThat(result).singleElement()
        .matches(CredentialInfo::valid)
        .matches(info -> info.credentials().equals(cred));
  }