'Verify the specified JWT access token is valid, and belongs to the specified user.
Args:
access_token (str): JWT
user (User): User whose information is contained in the JWT payload.
(optional) should_be_expired: indicates if the passed in JWT token is expected to be expired
Returns:
dict: Decoded JWT payload'

def assert_valid_jwt_access_token(self, access_token, user, scopes=None, should_be_expired=False):

    scopes = (scopes or [])
    audience = settings.JWT_AUTH['JWT_AUDIENCE']
    issuer = settings.JWT_AUTH['JWT_ISSUER']
    def _decode_jwt(verify_expiration):
        '\n                                                Helper    method    to    decode    a    JWT    with    the    ability    to\n                                                verify    the    expiration    of    said    token\n                                                '
        return jwt.decode(access_token, settings.JWT_AUTH['JWT_SECRET_KEY'], algorithms=[settings.JWT_AUTH['JWT_ALGORITHM']], audience=audience, issuer=issuer, verify_expiration=verify_expiration)
    payload = _decode_jwt(verify_expiration=(not should_be_expired))
    expected = {'aud': audience, 'iss': issuer, 'preferred_username': user.username, 'scopes': scopes, 'sub': anonymous_id_for_user(user, None)}
    if ('email' in scopes):
        expected['email'] = user.email
    if ('profile' in scopes):
        try:
            name = UserProfile.objects.get(user=user).name
        except UserProfile.DoesNotExist:
            name = None
        expected.update({'name': name, 'administrator': user.is_staff, 'family_name': user.last_name, 'given_name': user.first_name})
    self.assertDictContainsSubset(expected, payload)
    if should_be_expired:
        with self.assertRaises(ExpiredSignatureError):
            _decode_jwt(verify_expiration=True)
    return payload
