public boolean useCode(String username, String code)
            throws GuacamoleException {

        // Repeatedly attempt to use the given code until an explicit success
        // or failure has occurred
        UsedCode usedCode = new UsedCode(username, code);
        for (;;) {

            // Explicitly invalidate each used code for two periods after its
            // first successful use
            long current = System.currentTimeMillis();
            long invalidUntil = current + confService.getPeriod() * 1000 * INVALID_INTERVAL;

            // Try to use the given code, marking it as used within the map of
            // now-invalidated codes
            Long expires = invalidCodes.putIfAbsent(usedCode, invalidUntil);
            if (expires == null)
                return true;

            // If the code was already used, fail to use the code if
            // insufficient time has elapsed since it was last used
            // successfully
            if (expires > current)
                return false;


            // Otherwise, the code is actually valid - remove the invalidated
            // code only if it still has the expected expiration time, and
            // retry using the code
            invalidCodes.remove(usedCode, expires);

        }

    }
Attempts to mark the given code as used. The code MUST have already been
validated against the user's secret key, as this function only verifies
whether the code has been previously used, not whether it is actually
valid. If the code has not previously been used, the code is stored as
having been used by the given user at the current time.

@param username
    The username of the user who has attempted to use the given valid
    code.

@param code
    The otherwise-valid code given by the user.

@return
    true if the code has not previously been used by the given user and
    has now been marked as previously used, false otherwise.

@throws GuacamoleException
    If configuration information necessary to determine the length of
    time a code should be marked as invalid cannot be read from
    guacamole.properties.
extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/CodeUsageTrackingService.java