code: func (r *MintOAuthTokenViaGrantRPC) validateRequest(c context.Context, req *minter.MintOAuthTokenViaGrantRequest, caller identity.Identity) (*tokenserver.OAuthTokenGrantBody, *Rule, error) {
  	// Grab the token body, if it is valid.
  	grantBody, err := r.decodeAndValidateToken(c, req.GrantToken)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	// The token is usable only by whoever requested it in the first place.
  	if grantBody.Proxy != string(caller) {
  		// Note: grantBody.Proxy is part of the token already, caller knows it, so
  		// we aren't exposing any new information by returning it in the message.
  		logging.Errorf(c, "Unauthorized caller (expecting %q)", grantBody.Proxy)
  		return nil, nil, status.Errorf(codes.PermissionDenied, "unauthorized caller (expecting %s)", grantBody.Proxy)
  	}
  
  	// Check that rules still allow this token (rules could have changed since
  	// the grant was generated).
  	rule, err := r.recheckRules(c, grantBody)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	// OAuth scopes check is specific to this RPC, it's not done by recheckRules.
  	if err := rule.CheckScopes(req.OauthScope); err != nil {
  		logging.WithError(err).Errorf(c, "Bad scopes")
  		return nil, nil, status.Errorf(codes.PermissionDenied, "bad scopes - %s", err)
  	}
  
  	return grantBody, rule, nil
  }
docs: // validateRequest decodes the request and checks that it is allowed.
  //
  // Logs and returns verified deserialized token body and corresponding rule on
  // success or a grpc error on error.