Function verify_approval 

pub fn verify_approval(
    hub_public_hex: &str,
    signed: &SignedApproval,
    node_id: &str,
    target: &str,
    sha256: &str,
    now_secs: i64,
) -> Result<ApprovalToken, String>

Checks a token the way a node does before it writes: the signature is the hub’s, it names this node, this target and exactly this hash, and it has not expired. Returns the token so the caller can remember its nonce.