def verify_token(token)
        logger.debug("Verifying token: #{token}")

        # First get the payload of the token. This will also verify whether
        # or not the token is welformed.
        payload = get_token_payload(token)

        # Next, the payload should define user UUID and session UUID.
        user_uuid = payload["user_uuid"]
        session_uuid = payload["session_uuid"]
        if user_uuid.nil? || session_uuid.nil?
          logger.error("User or session is not specified")
          raise UNAUTHORIZED_ERROR, "Invalid token"
        end
        logger.debug("Token well defined: #{token}")

        # But, the user UUID and session UUID better be valid too. That is,
        # they must be real user and session, and the session must belong to
        # the user.
        auth_user = User.find_by_uuid(user_uuid)
        if auth_user.nil?
          # :nocov:
          logger.error("Specified user doesn't exist #{user_uuid}")
          raise UNAUTHORIZED_ERROR, "Invalid token"
          # :nocov:
        end
        auth_session = Session.find_by_uuid(session_uuid)
        if auth_session.nil? || auth_session.user != auth_user
          logger.error("Specified session doesn't exist #{session_uuid}")
          raise UNAUTHORIZED_ERROR, "Invalid token"
        end

        # Finally, decode the token using the secret. Also check expiration
        # here too.
        JWT.decode token, auth_session.secret, true
        logger.debug("Token well formatted and verified. Set cache.")

        # Return the corresponding session
        return auth_session

      rescue JWT::DecodeError => e
        logger.error(e.message)
        raise UNAUTHORIZED_ERROR, "Invalid token"
      end
def verify_token(token)
        logger.debug("Verifying token: #{token}")

        # First get the payload of the token. This will also verify whether
        # or not the token is welformed.
        payload = get_token_payload(token)

        # Next, the payload should define user UUID and session UUID.
        user_uuid = payload["user_uuid"]
        session_uuid = payload["session_uuid"]
        if user_uuid.nil? || session_uuid.nil?
          logger.error("User or session is not specified")
          raise UNAUTHORIZED_ERROR, "Invalid token"
        end
        logger.debug("Token well defined: #{token}")

        # But, the user UUID and session UUID better be valid too. That is,
        # they must be real user and session, and the session must belong to
        # the user.
        auth_user = User.find_by_uuid(user_uuid)
        if auth_user.nil?
          # :nocov:
          logger.error("Specified user doesn't exist #{user_uuid}")
          raise UNAUTHORIZED_ERROR, "Invalid token"
          # :nocov:
        end
        auth_session = Session.find_by_uuid(session_uuid)
        if auth_session.nil? || auth_session.user != auth_user
          logger.error("Specified session doesn't exist #{session_uuid}")
          raise UNAUTHORIZED_ERROR, "Invalid token"
        end

        # Finally, decode the token using the secret. Also check expiration
        # here too.
        JWT.decode token, auth_session.secret, true
        logger.debug("Token well formatted and verified. Set cache.")

        # Return the corresponding session
        return auth_session

      rescue JWT::DecodeError => e
        logger.error(e.message)
        raise UNAUTHORIZED_ERROR, "Invalid token"
      end
Truly verifies the token and its payload. It ensures the user and
 session specified in the token payload are indeed valid. The
 required role is also checked.

 A UNAUTHORIZED_ERROR is thrown for all cases where token is
 invalid.