    def list_tokens(self, user_id):
        session = self.get_session()
        tokens = []
        now = datetime.datetime.utcnow()
        for token_ref in session.query(TokenModel)\
                                      .filter(TokenModel.expires > now):
            token_ref_dict = token_ref.to_dict()
            if 'user' not in token_ref_dict:
                continue
            if token_ref_dict['user'].get('id') != user_id:
                continue
            tokens.append(token_ref['id'])
        return tokens
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.