anchor.diff:  -type token() ::
       oauth1_credentials:id(token).
   
  --type resource() ::
  -    oauth1_resource:t().
  +-type realm() ::
  +    oauth1_realm:t().
   
   -record(t,
       { token     :: token()
  -    % TODO: Are we authorizing resources or realms?
  -    , resources :: [resource()]
  +    , realms :: [realm()]
       }).
   
   -opaque t() ::
  
positive.code:     case oauth1_storage:get(?STORAGE_BUCKET_NAME, Key)
      of  {error, _}=Error ->
              Error
      ;   {ok, ResourcesJson} ->
              ResourcesProps = jsx:decode(ResourcesJson),
              Resources      = lists:map( fun oauth1_resource:of_props/1
                                        , ResourcesProps
                                        ),
              T = #t
                  { token     = Token
                  , resources = Resources
                  },
              {ok, T}
      end.
  
negative.code: cons({token, <<_/binary>>}=Token) ->
      #t
      { token     = Token
      , realms = ordsets:new()
      }.
  
  -spec add(t(), realm()) ->
      t().
  add(#t{realms=Realms}=T, Realm) ->
      T#t
      { realms = ordsets:add_element(Realm, Realms)
      }.
  
  -spec remove(t(), realm()) ->
      t().
  remove(#t{realms=Realms}=T, Realm) ->
      T#t
      { realms = ordsets:del_element(Realm, Realms)
      }.
  
  -spec is_authorized(t(), realm()) ->
      boolean().
  is_authorized(#t{realms=Realms}, Realm) ->
      ordsets:is_element(Realm, Realms).
  
  -spec store(t()) ->
      hope_result:t(ok, oauth1_storage:error()).
  store(#t
      { token     = {token, <<Token/binary>>}
      , realms = Realms
      }
  ) ->
      Key   = Token,
      Value = jsx:encode(Realms),
      oauth1_storage:put(?STORAGE_BUCKET_NAME, Key, Value).
  
  -spec fetch(token()) ->
  