anchor.diff:      % TODO: implement; this is different than all the others
       error(not_implemented).
   
  -% TODO: Don't like this, either, bespoke code
  -fetch_group_id(DbContext, Name, OrgId, RequestorId) ->
  -    % TODO: either pass the requestor, or do this somewhere else
  -    % nothing else will work until this does: needed for setting up the tests in pedant
  -    % I think this will fail for some cases, pretty sure superuser can be removed
  -    % from group ACL, but doing this for the moment until decision made
  -    case chef_db:fetch(#oc_chef_group{org_id = OrgId, name = Name,
  -                                      for_requestor_id = RequestorId}, DbContext) of
  -        not_found ->
  -            throw({not_found, Name});
  -        forbidden ->
  -            throw({forbidden, Name});
  -        #oc_chef_group{authz_id = AuthzId} ->
  -            AuthzId
  -    end.
  -
  -% TODO: and more bespoke code; cookbooks retrieval is by orgname instead of ID
  +% TODO: bespoke code; cookbooks retrieval is by orgname instead of ID
   fetch_cookbook_id(DbContext, Name, OrgName) ->
       % cookbook endpoint pattern is utterly different from the others, generic
  -    % doen not handle cookbooks (and, well, versioning)
  +    % fetch does not handle cookbooks (and, well, versioning)
       case chef_db:fetch_latest_cookbook_version(DbContext, OrgName, Name) of
           not_found ->
               throw({not_found, Name});
           {cookbook_exists, AuthzId} ->
  -            % unclear when this can happen; I assume for wrong version but won't
  -            % happen with 'latest' version?   But still checking for it here.
  +            % unclear when this can happen; I assume for wrong version but
  +            % won't happen with 'latest' version?  But still checking for it
  +            % here.
               AuthzId;
           #chef_cookbook_version{authz_id = AuthzId} ->
               AuthzId
  
positive.code:          to_json/2
          ]).
  
  init(Config) ->
      chef_wm_base:init(?MODULE, Config).
  
  
negative.code:                   end,
          io:format("---val got authzId: ~p~n", [AuthzId]),
          AclState1 = AclState#acl_state{authz_id = AuthzId},
          % TODO: check on this: I'm not sure this is what we really want; IIRC,
          % access is controlled by the ACLs so that (1) superuser will not
          % always have access and (2) I think access for ordinary users is not
          % limited to orgs.  This might work in practice, though, if ReqId is
          % passed through?
          {Req, State#base_state{resource_state = AclState1,
                                 superuser_bypasses_checks = true}}
      catch
          throw:{not_found, Name} ->
              Message = chef_wm_util:not_found_message(Type, Name),
              Req1 = chef_wm_util:set_json_body(Req, Message),
              {{halt, 404}, Req1, State#base_state{log_msg = acl_not_found}}
      end.
  
  % TODO: don't like this; we only need the authz id, so grabbing complete
  % objects is wasteful.  Also, this might be more suited to be moved to
  % oc_chef_wm_util or something
  fetch_id(user, DbContext, Name, _OrgId) ->
      case chef_db:fetch(#chef_user{username = Name}, DbContext) of
          not_found ->
  