anchor.diff:  %%
   %% Controlled by the config variable {oc_chef_wm, custom_acls_always_for_modification}
   customize_for_modification_maybe(Endpoint, Method, Auth) ->
  +    %% If the current request is modifying the system, and we are configured to always use
  +    %% customized ACLs when servicing modification requests, defer to the authorization
  +    %% system to determine if this request should be authorized (i.e., allow the original
  +    %% `Auth' value to be used).  Otherwise, short-circuit and declare unilaterally that the
  +    %% request is authorized.
       case is_modification(Endpoint, Method) of
           true ->
               case auth_for_modification() of
  
positive.code:                       Req :: wrq:req(),
                        State :: #base_state{})
      -> {_, _, #base_state{}}.
  %% Check if we should use contact opscode-authz and chef requestor-specific acls for an endpoint.
  %% If the config variable is false, then we don't check the object/container ACLs and instead
  %% use the fact that a client has passed authn as allowing them to access a resource
  use_custom_acls(_Endpoint, Auth, Req, #base_state{requestor = #chef_user{} } = State) ->
      {Auth, Req, State};
  use_custom_acls(Endpoint, Auth, Req, #base_state{requestor = #chef_client{} } = State) ->
      case application:get_env(oc_chef_wm, config_for(Endpoint)) of
          {ok, false} ->
              {customize_for_modification_maybe(Endpoint, wrq:method(Req), Auth), Req, State};
          _Else -> %% use standard behaviour
              {Auth, Req, State}
      end.
  
  
negative.code:                     authorized
              end;
          false ->
              %% It's not a modification request; allow it.
              authorized
      end.
  
  %% @doc Determine the configuration parmeter that corresponds to the given endpoint.
  config_for(cookbooks) -> custom_acls_cookbooks;
  config_for(roles)     -> custom_acls_roles;
  config_for(data)      -> custom_acls_data;
  config_for(depsolver) -> custom_acls_depsolver.
  
  %% @doc Is the current request one that modifies the system, as determined by the endpoint
  %% and HTTP verb being used?
  is_modification(depsolver, 'POST')  -> false;
  is_modification(_Endpoint, 'GET')   -> false;
  is_modification(_Endpoint, 'HEAD')  -> false;
  is_modification(_Endpoint, _Method) -> true.
  
  %% @doc Determine if we should use the authorization system for modification requests, or if
  %% we should just follow the default ACL rules.  We only skip the check if [oc_chef_wm
  %% custom_acls_always_for_modification] is explicitly set to false; undefined is the same as
  %% true.
  auth_for_modification() ->
      case application:get_env(oc_chef_wm, custom_acls_always_for_modification) of
          {ok, Value} ->
              Value =:= true;
          _Else ->
             true
      end.
  