anchor.diff:  -export([validate_config/2]).
   
   
  -is_authorized(ServiceId, UserInfo, #{allow := Allow0, forbid := Forbid0}) ->
  -    {ok, Issuer} = tts_userinfo:return(issuer, UserInfo),
  +is_authorized(ServiceId, UserInfo, #{allow := Allow0, forbid := Forbid0} = A) ->
  +    {ok, Issuer, Subject} = tts_userinfo:return(issuer_subject, UserInfo),
  +    lager:debug("checking authorization of ~p ~p at service ~p [~p]",
  +                [Issuer, Subject, ServiceId, A]),
  +
  +    Slash = <<"/">>,
  +
       FilterByIssuer = fun({Iss, _, _, _}) ->
  -                             Iss == Issuer
  +                             IssSlash = << Iss/binary, Slash/binary >>,
  +                             (Iss == Issuer) or (IssSlash == Issuer)
                        end,
       Allow = lists:filter(FilterByIssuer, Allow0),
       Forbid = lists:filter(FilterByIssuer, Forbid0),
  +    lager:debug("running through allow ~p and forbid ~p", [Allow, Forbid]),
       Allowed = apply_rules(ServiceId, UserInfo, Allow, false),
       Forbidden = apply_rules(ServiceId, UserInfo, Forbid, true),
       Allowed and (not Forbidden).
  
positive.code:                    [ServiceId, Rule, Default]),
      Default.
  
  perform_operation(any = Op, KeyValue, Value, _) ->
      Res = true,
      lager:debug("performing ~p(~p, ~p) -> ~p",[Op, KeyValue, Value, Res]),
      Res;
  perform_operation(equals = Op, KeyValue, Value, _) ->
      Res = (KeyValue == Value),
      lager:debug("performing ~p(~p, ~p) -> ~p",[Op, KeyValue, Value, Res]),
      Res;
  perform_operation(contains = Op, KeyValue, Value, _)
    when is_list(KeyValue), is_binary(Value) ->
      Res = lists:member(Value, KeyValue),
      lager:debug("performing ~p(~p, ~p) -> ~p",[Op, KeyValue, Value, Res]),
      Res;
  perform_operation(contains = Op, KeyValue, Value, _)
    when is_binary(KeyValue), is_binary(Value) ->
      Res = case binary:match(KeyValue, [Value]) of
                {_, _} ->
                    true;
                _ ->
                    false
            end,
      lager:debug("performing ~p(~p, ~p) -> ~p",[Op, KeyValue, Value, Res]),
      Res;
  perform_operation(regexp = Op, KeyValue, Value, _) ->
      Res = case re:run(KeyValue, Value, []) of
                {match, _} ->
                    true;
                _ ->
                    false
            end,
      lager:debug("performing ~p(~p, ~p) -> ~p",[Op, KeyValue, Value, Res]),
      Res;
  perform_operation(Op, KeyValue, Value, Default) ->
      lager:critical("unknwon operation/value combination: ~p(~p, ~p), using ~p",
                     [Op, KeyValue, Value, Default]),
  
negative.code: apply_rule(_ServiceId, {_Iss, Key, Op, Value}, UserInfo, Default) ->
      case tts_userinfo:return({key, Key}, UserInfo) of
          {ok, KeyValue} ->
              Res = perform_operation(Op, KeyValue, Value, Default),
              lager:debug("performed ~p(~p, ~p) -> ~p",
                          [Op, KeyValue, Value, Res]),
              Res;
          _ ->
              Default
      end;
  