anchor.diff:      case oauth1_storage:get(?STORAGE_BUCKET_NAME, Key)
       of  {error, _}=Error ->
               Error
  -    ;   {ok, ResourcesJson} ->
  -            ResourcesProps = jsx:decode(ResourcesJson),
  -            Resources      = lists:map( fun oauth1_resource:of_props/1
  -                                      , ResourcesProps
  -                                      ),
  +    ;   {ok, RealmsJson} ->
               T = #t
                   { token     = Token
  -                , resources = Resources
  +                , realms = jsx:decode(RealmsJson)
                   },
               {ok, T}
       end.
  
positive.code: cons({token, <<_/binary>>}=Token) ->
      #t
      { token     = Token
      , resources = ordsets:new()
      }.
  
  -spec add(t(), resource()) ->
      t().
  add(#t{resources=Resources}=T, Resource) ->
      T#t
      { resources = ordsets:add_element(Resource, Resources)
      }.
  
  -spec remove(t(), resource()) ->
      t().
  remove(#t{resources=Resources}=T, Resource) ->
      T#t
      { resources = ordsets:del_element(Resource, Resources)
      }.
  
  -spec is_authorized(t(), resource()) ->
      boolean().
  is_authorized(#t{resources=Resources}, Resource) ->
      ordsets:is_element(Resource, Resources).
  
  -spec store(t()) ->
      hope_result:t(ok, oauth1_storage:error()).
  store(#t
      { token     = {token, <<Token/binary>>}
      , resources = Resources
      }
  ) ->
      ResourcesProps = lists:map(fun oauth1_resource:to_props/1, Resources),
      ResourcesJson  = jsx:encode(ResourcesProps),
      Key   = Token,
      Value = ResourcesJson,
      oauth1_storage:put(?STORAGE_BUCKET_NAME, Key, Value).
  
  -spec fetch(token()) ->
  
negative.code: -type token() ::
      oauth1_credentials:id(token).
  
  -type realm() ::
      oauth1_realm:t().
  
  -record(t,
      { token     :: token()
      , realms :: [realm()]
      }).
  
  -opaque t() ::
  