anchor.diff:      end.
   
   
  +convert_value_if_needed(any, <<"true">>) ->
  +    {ok, true};
   convert_value_if_needed(any, _) ->
  -    {ok, undefined};
  +    {ok, false};
  +convert_value_if_needed(is_member_of, Csv) ->
  +    {ok, binary:split(Csv, [<<",">>], [global])};
   convert_value_if_needed(regexp, Value) ->
       case re:compile(Value) of
           {ok, MP} ->
               {ok, MP};
           {error, Reason} ->
  -            Msg = io_lib:format("compilation of regexp failed: ~p",[Reason]),
  +            Msg = io_lib:format("compilation of regexp failed: ~p", [Reason]),
               {error, Msg}
       end;
   convert_value_if_needed(_, Value) ->
  
positive.code:                    [ServiceId, Rule, Default]),
      Default.
  
  perform_operation(any = Op, KeyValue, Value, _) ->
      Res = true,
      lager:debug("performing ~p(~p, ~p) -> ~p",[Op, KeyValue, Value, Res]),
      Res;
  perform_operation(equals = Op, KeyValue, Value, _) ->
      Res = (KeyValue == Value),
      lager:debug("performing ~p(~p, ~p) -> ~p",[Op, KeyValue, Value, Res]),
      Res;
  perform_operation(contains = Op, KeyValue, Value, _)
    when is_list(KeyValue), is_binary(Value) ->
      Res = lists:member(Value, KeyValue),
      lager:debug("performing ~p(~p, ~p) -> ~p",[Op, KeyValue, Value, Res]),
      Res;
  perform_operation(contains = Op, KeyValue, Value, _)
    when is_binary(KeyValue), is_binary(Value) ->
      Res = case binary:match(KeyValue, [Value]) of
                {_, _} ->
                    true;
                _ ->
                    false
            end,
      lager:debug("performing ~p(~p, ~p) -> ~p",[Op, KeyValue, Value, Res]),
      Res;
  perform_operation(regexp = Op, KeyValue, Value, _) ->
      Res = case re:run(KeyValue, Value, []) of
                {match, _} ->
                    true;
                _ ->
                    false
            end,
      lager:debug("performing ~p(~p, ~p) -> ~p",[Op, KeyValue, Value, Res]),
      Res;
  perform_operation(Op, KeyValue, Value, Default) ->
      lager:critical("unknwon operation/value combination: ~p(~p, ~p), using ~p",
                     [Op, KeyValue, Value, Default]),
  
negative.code: -export([validate_config/2]).
  
  
  is_authorized(ServiceId, UserInfo, #{allow := Allow0, forbid := Forbid0} = A) ->
      {ok, Issuer, Subject} = tts_userinfo:return(issuer_subject, UserInfo),
      lager:debug("checking authorization of ~p ~p at service ~p [~p]",
                  [Issuer, Subject, ServiceId, A]),
  
      Slash = <<"/">>,
  
      FilterByIssuer = fun({Iss, _, _, _}) ->
                               IssSlash = << Iss/binary, Slash/binary >>,
                               (Iss == Issuer) or (IssSlash == Issuer)
                       end,
      Allow = lists:filter(FilterByIssuer, Allow0),
      Forbid = lists:filter(FilterByIssuer, Forbid0),
      lager:debug("running through allow ~p and forbid ~p", [Allow, Forbid]),
      Allowed = apply_rules(ServiceId, UserInfo, Allow, false),
      Forbidden = apply_rules(ServiceId, UserInfo, Forbid, true),
      Allowed and (not Forbidden).
  