code: func (s *AuthServer) ValidateToken(token string) (roles teleport.Roles, e error) {
  	tkns, err := s.GetCache().GetStaticTokens()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// First check if the token is a static token. If it is, return right away.
  	// Static tokens have no expiration.
  	for _, st := range tkns.GetStaticTokens() {
  		if st.GetName() == token {
  			return st.GetRoles(), nil
  		}
  	}
  
  	// If it's not a static token, check if it's a ephemeral token in the backend.
  	// If a ephemeral token is found, make sure it's still valid.
  	tok, err := s.GetCache().GetToken(token)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	if !s.checkTokenTTL(tok) {
  		return nil, trace.AccessDenied("token expired")
  	}
  
  	return tok.GetRoles(), nil
  }
docs: // ValidateToken takes a provisioning token value and finds if it's valid. Returns
  // a list of roles this token allows its owner to assume, or an error if the token
  // cannot be found.