protected Optional<GoogleAuthenticatorAccount> getAuthorizedScratchCodeForToken(
        final GoogleAuthenticatorTokenCredential tokenCredential,
        final Authentication authentication,
        final Collection<? extends OneTimeTokenAccount> accounts) {
        val uid = authentication.getPrincipal().getId();
        val otp = Integer.parseInt(tokenCredential.getToken());
        LOGGER.debug("Checking scratch code [{}] for user [{}]", otp, uid);
        return accounts
            .stream()
            .filter(ac -> isCredentialAssignedToAccount(tokenCredential, ac))
            .peek(ac -> LOGGER.debug("Comparing existing scratch codes [{}] for account [{}] against [{}]",
                ac.getScratchCodes(), ac.getId(), otp))
            .filter(ac -> ac.getScratchCodes().stream().map(Number::intValue).toList().contains(otp))
            .map(GoogleAuthenticatorAccount.class::cast)
            .peek(acct -> {
                LOGGER.info("Using scratch code [{}] to authenticate user [{}]. Scratch code will be removed", otp, uid);
                acct.getScratchCodes().removeIf(token -> token.intValue() == otp);
                credentialRepository.update(acct);
            })
            .findFirst();
    }
This is {@link GoogleAuthenticatorOneTimeTokenCredentialValidator}.

@author Misagh Moayyed
@since 6.3.0
support/cas-server-support-gauth-core/src/main/java/org/apereo/cas/gauth/credential/GoogleAuthenticatorOneTimeTokenCredentialValidator.java