if not record or record.expires_at < now() or record.uses_left <= 0: return "Invalid or expired key" if record.user_id != user_id: return "Key does not belong to this user" if record.action != action: return "Key not intended for this action"