anchor.diff:  -type root_auth() :: ?ROOT_AUTH.
   -type auth() :: token_auth() | guest_auth() | root_auth().
   
  +-type timestamp() :: time_utils:seconds().
  +
   -type verification_result() ::
       {ok, aai:auth(), TokenValidUntil :: undefined | timestamp()} |
       errors:error().
   
  --type timestamp() :: time_utils:seconds().
   -type token_ref() ::
       {named, tokens:id()} |
       {temporary, od_user:id(), temporary_token_secret:generation()}.
   
  --record(cache_item, {
  +-record(cache_entry, {
       token_auth :: token_auth(),
       verification_result :: verification_result(),
   
  
positive.code: %% @private
  -spec get_from_cache_or_verify_token_auth(token_auth()) -> verification_result().
  get_from_cache_or_verify_token_auth(TokenAuth) ->
      Now = ?NOW(),
      case get_from_cache(TokenAuth, Now) of
          {ok, Item} ->
              Item#cache_item.verification_result;
          ?ERROR_NOT_FOUND ->
              try
                  {Result, CacheExpiration} = verify_token_auth(Now, TokenAuth),
                  save_in_cache(#cache_item{
                      token_auth = TokenAuth,
                      verification_result = Result,
                      cache_expiration = CacheExpiration
                  }),
                  %% Fetches user doc to trigger user setup if token verification
                  %% succeeded. Otherwise does nothing.
                  %% It must be called after caching verification result as to
                  %% avoid infinite loop (gs_client_worker would try to verify
                  %% given TokenAuth).
                  case Result of
                      {ok, ?USER(UserId), _} ->
                          case user_logic:get(TokenAuth, UserId) of
                              {ok, _} ->
                                  Result;
                              {error, _} = Error ->
                                  Error
                          end;
                      _ ->
                          Result
                  end
              catch Type:Reason ->
                  ?error_stacktrace("Cannot verify user auth due to ~p:~p", [
  
negative.code:     token_revoked = false :: boolean(),
      cache_expiration :: timestamp()
  }).
  
  -record(state, {
      cache_invalidation_timer = undefined :: undefined | reference()
  