def check_build_token(self, build_token, provider_spec):
        """Validate that a build token is valid for the current request

        Sets `_have_build_token` boolean property to:
        - True if a token is present and valid
        - False if not present
        Raises 403 if a token is present but not valid
        """
        if not build_token:
            app_log.debug(f"No build token for {provider_spec}")
            self._have_build_token = False
            return
        try:
            decoded = jwt.decode(
                build_token,
                key=self.settings["build_token_secret"],
                audience=provider_spec,
                algorithms=["HS256"],
            )
        except jwt.PyJWTError as e:
            app_log.error(f"Failure to validate build token for {provider_spec}: {e}")
            raise web.HTTPError(403, "Invalid build token")

        origin = self.token_origin()
        if decoded["origin"] != origin:
            app_log.error(
                f"Build token from mismatched origin != {origin}: {decoded};"
                f" Host={self.request.headers.get('host')}, Origin={self.request.headers.get('origin')}"
            )
            if self.settings["build_token_check_origin"]:
                raise web.HTTPError(403, "Invalid build token")
        app_log.debug(f"Accepting build token for {provider_spec}")
        self._have_build_token = True
        return decoded
Validate that a build token is valid for the current request

        Sets `_have_build_token` boolean property to:
        - True if a token is present and valid
        - False if not present
        Raises 403 if a token is present but not valid
        
binderhub/base.py