def validate_recovery_token!(token, context = {})
      errors = []

      # 1. Authenticate the User. The exact nature of how the Recovery Provider authenticates the User is beyond the scope of this specification.
      # handled in before_filter

      # 4. Retrieve the Account Provider configuration as described in Section 2 using the issuer field of the token as the subject.
      begin
        account_provider = RecoveryToken.account_provider_issuer(token)
      rescue RecoveryTokenSerializationError, UnknownProviderError, TokenFormatError => e
        raise RecoveryTokenError, "Could not determine provider: #{e.message}"
      end

      # 2. Parse the token.
      # 3. Validate that the version value is 0.
      # 5. Validate the signature over the token according to processing rules for the algorithm implied by the version.
      begin
        recovery_token = account_provider.unseal(token, context)
      rescue CryptoError => e
        raise RecoveryTokenError.new("Unable to verify signature of token")
      rescue TokenFormatError => e
        raise RecoveryTokenError.new(e.message)
      end

      # 6. Validate that the audience field of the token identifies an origin which the provider considers itself authoritative for. (Often the audience will be same-origin with the Recovery Provider, but other values may be acceptable, e.g. "https://mail.example.com" and "https://social.example.com" may be acceptable audiences for "https://recovery.example.com".)
      unless self.origin == recovery_token.audience
        raise RecoveryTokenError.new("Unnacceptable audience")
      end

      if DateTime.parse(recovery_token.issued_time).utc < (Time.now - CLOCK_SKEW).utc
        raise RecoveryTokenError.new("Issued at time is too far in the past")
      end

      recovery_token
    end
def validate_recovery_token!(token, context = {})
      errors = []

      # 1. Authenticate the User. The exact nature of how the Recovery Provider authenticates the User is beyond the scope of this specification.
      # handled in before_filter

      # 4. Retrieve the Account Provider configuration as described in Section 2 using the issuer field of the token as the subject.
      begin
        account_provider = RecoveryToken.account_provider_issuer(token)
      rescue RecoveryTokenSerializationError, UnknownProviderError, TokenFormatError => e
        raise RecoveryTokenError, "Could not determine provider: #{e.message}"
      end

      # 2. Parse the token.
      # 3. Validate that the version value is 0.
      # 5. Validate the signature over the token according to processing rules for the algorithm implied by the version.
      begin
        recovery_token = account_provider.unseal(token, context)
      rescue CryptoError => e
        raise RecoveryTokenError.new("Unable to verify signature of token")
      rescue TokenFormatError => e
        raise RecoveryTokenError.new(e.message)
      end

      # 6. Validate that the audience field of the token identifies an origin which the provider considers itself authoritative for. (Often the audience will be same-origin with the Recovery Provider, but other values may be acceptable, e.g. "https://mail.example.com" and "https://social.example.com" may be acceptable audiences for "https://recovery.example.com".)
      unless self.origin == recovery_token.audience
        raise RecoveryTokenError.new("Unnacceptable audience")
      end

      if DateTime.parse(recovery_token.issued_time).utc < (Time.now - CLOCK_SKEW).utc
        raise RecoveryTokenError.new("Issued at time is too far in the past")
      end

      recovery_token
    end
Validate the token according to the processing instructions for the
 save-token endpoint.

 Returns a validated token