     as        : { $in: roles }
   }
 
-createExistenceCallback = (callback)-> (err, count)->
+createExistenceCallback = (callback) -> (err, count) ->
   if err then callback err, no
   else if count > 0 then callback null, yes
   else callback null, no
 
 module.exports =
 
-  own:(client, group, permission, permissionSet, _, callback)->
-    {delegate} = client.connection
+  own:(client, group, permission, permissionSet, _, callback) ->
+    { delegate } = client.connection
 
     return callback null, yes  if delegate.equals this
 
     roleSelector = getRoleSelector delegate, group, permission, permissionSet
     # if we get -1 as the role selector, it means guest (i.e. anyone) is allowed
     return callback null, yes  if roleSelector is -1
-    Relationship.count roleSelector, (err, count)=>
+    Relationship.count roleSelector, (err, count) =>
       if err then callback err, no
       else if count is 0 then callback null, no
       else

          }
          Relationship.count ownerSelector, createExistenceCallback callback

  any:(client, group, permission, permissionSet, _, callback)->
    {delegate} = client.connection
    unless delegate
      console.warn "Delegate cannot be null for checking permissions, request is denied"
      return callback null, no
    roleSelector = getRoleSelector delegate, group, permission, permissionSet
    return callback null, yes  if roleSelector is -1
    Relationship.count roleSelector, createExistenceCallback callback

{ Relationship } = require 'jraphical'

getRoles = (permission, permissionSet) ->
  return []  unless permissionSet
  roles = (perm.role for perm in permissionSet.permissions\
          when permission in perm.permissions)
  roles.push 'admin' # admin can do anything!
  return roles

getRoleSelector = (delegate, group, permission, permissionSet) ->
  roles       = getRoles permission, permissionSet
  return -1   if 'guest' in roles # everyone is (at least) guest!
  return {
