def schedule_expiry(policy, agent_identity)
      if @expiry_timer
        @expiry_timer.cancel
        @expiry_timer = nil
      end

      # Find the next expiry time that is in the future
      now = Time.now
      next_expiry = policy.users.map { |u| u.expires_at }.compact.select { |t| t > now }.min
      return false unless next_expiry
      delay = next_expiry.to_i - Time.now.to_i + 1

      #Clip timer to one day (86,400 sec) to work around EM timer bug involving
      #32-bit integer. This works because update_policy is idempotent and can
      #be safely called at any time. It will "reconverge" if it is called when
      #no permissions have changed.
      delay = [delay, 86_400].min

      return false unless delay > 0
      @expiry_timer = EM::Timer.new(delay) do
        update_policy(policy, agent_identity)
      end

      return true
    end
def schedule_expiry(policy, agent_identity)
      if @expiry_timer
        @expiry_timer.cancel
        @expiry_timer = nil
      end

      # Find the next expiry time that is in the future
      now = Time.now
      next_expiry = policy.users.map { |u| u.expires_at }.compact.select { |t| t > now }.min
      return false unless next_expiry
      delay = next_expiry.to_i - Time.now.to_i + 1

      #Clip timer to one day (86,400 sec) to work around EM timer bug involving
      #32-bit integer. This works because update_policy is idempotent and can
      #be safely called at any time. It will "reconverge" if it is called when
      #no permissions have changed.
      delay = [delay, 86_400].min

      return false unless delay > 0
      @expiry_timer = EM::Timer.new(delay) do
        update_policy(policy, agent_identity)
      end

      return true
    end
Given a LoginPolicy, add an EventMachine timer to handle the
 expiration of LoginUsers whose expiry time occurs in the future.
 This ensures that their login privilege expires on time and in accordance
 with the policy (so long as the agent is running). Expiry is handled by
 taking the policy exactly as it was received and passing it to #update_policy,
 which already knows how to filter out users who are expired at the time the policy
 is applied.

 == Parameters:
 @param [LoginPolicy] Policy for which expiry is to be scheduled
 @param [String] Serialized instance agent identity

 == Returns:
 @return [TrueClass] if expiry was scheduled
 @return [FalseClass] if expiry was not scheduled