anchor.diff:      }
   };
   
  -data_spec(#op_req{operation = create, gri = #gri{aspect = rdf_metadata}}) -> #{
  +data_spec_create(#gri{aspect = rdf_metadata}) -> #{
       required => #{<<"application/rdf+xml">> => {binary, any}}
  -};
  -
  -data_spec(#op_req{operation = get, gri = #gri{aspect = instance}}) ->
  -    undefined;
  -
  -data_spec(#op_req{operation = get, gri = #gri{aspect = list}}) -> #{
  -    optional => #{
  -        <<"limit">> => {integer, {between, 1, 1000}},
  -        <<"offset">> => {integer, {not_lower_than, 0}}
  -    }
  -};
  -
  -data_spec(#op_req{operation = get, gri = #gri{aspect = attrs}}) -> #{
  -    optional => #{<<"attribute">> => {binary, ?ALL_BASIC_ATTRIBUTES}}
  -};
  -
  -data_spec(#op_req{operation = get, gri = #gri{aspect = xattrs}}) -> #{
  -    optional => #{
  -        <<"attribute">> => {binary, any},
  -        <<"inherited">> => {boolean, any}
  -    }
  -};
  -
  -data_spec(#op_req{operation = get, gri = #gri{aspect = json_metadata}}) -> #{
  -    optional => #{
  -        <<"filter_type">> => {binary, any},
  -        <<"filter">> => {binary, any},
  -        <<"inherited">> => {boolean, any}
  -    }
  -};
  -
  -data_spec(#op_req{operation = get, gri = #gri{aspect = rdf_metadata}}) ->
  -    undefined;
  -
  -data_spec(#op_req{operation = get, gri = #gri{aspect = acl}}) ->
  -    undefined;
  -
  -data_spec(#op_req{operation = get, gri = #gri{aspect = transfers}}) -> #{
  -    optional => #{<<"include_ended_list">> => {boolean, any}}
  -};
  -
  -data_spec(#op_req{operation = update, gri = #gri{aspect = instance}}) -> #{
  -    optional => #{
  -        <<"posixPermissions">> => {binary,
  -            fun(Mode) ->
  -                try
  -                    {true, binary_to_integer(Mode, 8)}
  -                catch _:_ ->
  -                    throw(?ERROR_BAD_VALUE_INTEGER(<<"posixPermissions">>))
  -                end
  -            end
  -        }
  -    }
  -};
  -
  -data_spec(#op_req{operation = update, gri = #gri{aspect = acl}}) -> #{
  -    required => #{
  -        <<"list">> => {any,
  -            fun(JsonAcl) ->
  -                try
  -                    {true, acl:from_json(JsonAcl, gui)}
  -                catch throw:{error, Errno} ->
  -                    throw(?ERROR_POSIX(Errno))
  -                end
  -            end
  -        }
  -    }
  -};
  -
  -data_spec(#op_req{operation = delete, gri = #gri{aspect = instance}}) ->
  -    undefined.
  -
  -
  -%%--------------------------------------------------------------------
  -%% @doc
  -%% {@link op_logic_behaviour} callback fetch_entity/1.
  -%% @end
  -%%--------------------------------------------------------------------
  --spec fetch_entity(op_logic:req()) ->
  -    {ok, op_logic:versioned_entity()} | op_logic:error().
  -fetch_entity(_) ->
  -    {ok, {undefined, 1}}.
  -
  -
  -%%--------------------------------------------------------------------
  -%% @doc
  -%% {@link op_logic_behaviour} callback exists/2.
  -%%
  -%% File existence is checked later by fslogic_worker as to not increase
  -%% overhead.
  -%% @end
  -%%--------------------------------------------------------------------
  --spec exists(op_logic:req(), op_logic:entity()) -> boolean().
  -exists(_, _) ->
  -    true.
  -
  -%%--------------------------------------------------------------------
  -%% @doc
  -%% {@link op_logic_behaviour} callback authorize/2.
  -%%
  -%% Checks only if user is in space in which file exists. File permissions
  -%% are checked later by logical_file_manager (lfm).
  -%% @end
  -%%--------------------------------------------------------------------
  --spec authorize(op_logic:req(), op_logic:entity()) -> boolean().
  -authorize(#op_req{auth = ?NOBODY}, _) ->
  -    false;
  -
  -authorize(#op_req{operation = create, gri = #gri{aspect = instance}} = Req, _) ->
  -    SpaceId = file_id:guid_to_space_id(maps:get(<<"parent">>, Req#op_req.data)),
  -    op_logic_utils:is_eff_space_member(Req#op_req.auth, SpaceId);
  -
  -authorize(#op_req{operation = create, gri = #gri{id = Guid, aspect = As}} = Req, _) when
  +}.
  +
  +
  +%% @private
  +-spec authorize_create(op_logic:req(), op_logic:entity()) -> boolean().
  +authorize_create(#op_req{auth = Auth, data = Data, gri = #gri{aspect = instance}}, _) ->
  +    SpaceId = file_id:guid_to_space_id(maps:get(<<"parent">>, Data)),
  +    op_logic_utils:is_eff_space_member(Auth, SpaceId);
  +
  +authorize_create(#op_req{auth = Auth, gri = #gri{id = Guid, aspect = As}}, _) when
       As =:= attrs;
       As =:= xattrs;
       As =:= json_metadata;
       As =:= rdf_metadata
  -->
  -    has_access_to_file(Req#op_req.auth, Guid);
  -
  -authorize(#op_req{operation = get, gri = #gri{id = Guid, aspect = As}} = Req, _) when
  -    As =:= instance;
  -    As =:= list;
  -    As =:= attrs;
  -    As =:= xattrs;
  -    As =:= json_metadata;
  -    As =:= rdf_metadata;
  -    As =:= acl
  -->
  -    has_access_to_file(Req#op_req.auth, Guid);
  -
  -authorize(#op_req{operation = get, gri = #gri{id = Guid, aspect = transfers}} = Req, _) ->
  -    ?USER(UserId) = Req#op_req.auth,
  -    SpaceId = file_id:guid_to_space_id(Guid),
  -    space_logic:has_eff_privilege(SpaceId, UserId, ?SPACE_VIEW_TRANSFERS);
  -
  -authorize(#op_req{operation = update, gri = #gri{id = Guid, aspect = As}} = Req, _) when
  -    As =:= instance;
  -    As =:= acl
  -->
  -    SpaceId = file_id:guid_to_space_id(Guid),
  -    op_logic_utils:is_eff_space_member(Req#op_req.auth, SpaceId);
  -
  -authorize(#op_req{operation = delete, gri = #gri{id = Guid, aspect = instance}} = Req, _) ->
  -    SpaceId = file_id:guid_to_space_id(Guid),
  -    op_logic_utils:is_eff_space_member(Req#op_req.auth, SpaceId).
  -
  -
  -%%--------------------------------------------------------------------
  -%% @doc
  -%% {@link op_logic_behaviour} callback validate/2.
  -%% @end
  -%%--------------------------------------------------------------------
  --spec validate(op_logic:req(), op_logic:entity()) -> ok | no_return().
  -validate(#op_req{operation = create, gri = #gri{aspect = instance}} = Req, _) ->
  -    SpaceId = file_id:guid_to_space_id(maps:get(<<"parent">>, Req#op_req.data)),
  +    ->
  +    has_access_to_file(Auth, Guid).
  +
  +
  +%% @private
  +-spec validate_create(op_logic:req(), op_logic:entity()) -> ok | no_return().
  +validate_create(#op_req{data = Data, gri = #gri{aspect = instance}}, _) ->
  +    SpaceId = file_id:guid_to_space_id(maps:get(<<"parent">>, Data)),
       op_logic_utils:assert_space_supported_locally(SpaceId);
   
  -validate(#op_req{operation = create, gri = #gri{id = Guid, aspect = As}} = Req, _) when
  +validate_create(#op_req{auth = Auth, gri = #gri{id = Guid, aspect = As}}, _) when
       As =:= attrs;
       As =:= xattrs;
       As =:= json_metadata;
       As =:= rdf_metadata
  -->
  -    assert_file_managed_locally(Req#op_req.auth, Guid);
  -
  -validate(#op_req{operation = get, gri = #gri{id = Guid, aspect = As}} = Req, _) when
  -    As =:= instance;
  -    As =:= list;
  -    As =:= attrs;
  -    As =:= xattrs;
  -    As =:= json_metadata;
  -    As =:= rdf_metadata;
  -    As =:= acl;
  -    As =:= transfers
  -->
  -    assert_file_managed_locally(Req#op_req.auth, Guid);
  -
  -validate(#op_req{operation = update, gri = #gri{id = Guid, aspect = As}}, _) when
  -    As =:= instance;
  -    As =:= acl
  -->
  -    SpaceId = file_id:guid_to_space_id(Guid),
  -    op_logic_utils:assert_space_supported_locally(SpaceId);
  -
  -validate(#op_req{operation = delete, gri = #gri{id = Guid, aspect = instance}}, _) ->
  -    SpaceId = file_id:guid_to_space_id(Guid),
  -    op_logic_utils:assert_space_supported_locally(SpaceId).
  +    ->
  +    assert_file_managed_locally(Auth, Guid).
   
   
   %%--------------------------------------------------------------------
  
positive.code:             throw(?ERROR_MISSING_REQUIRED_VALUE(<<"filter">>));
          {<<"keypath">>, _} ->
              binary:split(Filter, <<".">>, [global])
       end,
      ?check(lfm:set_metadata(Auth#auth.session_id, {guid, Guid}, json, JSON, FilterList));
  
  create(#op_req{auth = Auth, data = Data, gri = #gri{id = Guid, aspect = rdf_metadata}}) ->
      Rdf = maps:get(<<"application/rdf+xml">>, Data),
      ?check(lfm:set_metadata(Auth#auth.session_id, {guid, Guid}, rdf, Rdf, [])).
  
  
  %%--------------------------------------------------------------------
  
negative.code:             {ok, [#{<<"id">> => ObjectId, <<"path">> => Path}]};
          {error, Errno} ->
              ?ERROR_POSIX(Errno)
      end;
  
  get(#op_req{auth = Auth, data = Data, gri = #gri{id = FileGuid, aspect = attrs}}, _) ->
      RequestedAttributes = case maps:get(<<"attribute">>, Data, undefined) of
          undefined -> ?ALL_BASIC_ATTRIBUTES;
          Attr -> [Attr]
      end,
      {ok, FileAttrs} = ?check(lfm:stat(Auth#auth.session_id, {guid, FileGuid})),
  
      {ok, lists:foldl(fun(RequestedAttr, Acc) ->
          Acc#{RequestedAttr => get_attr(RequestedAttr, FileAttrs)}
      end, #{}, RequestedAttributes)};
  
  get(#op_req{auth = Auth, data = Data, gri = #gri{id = FileGuid, aspect = xattrs}}, _) ->
      SessionId = Auth#auth.session_id,
  