code: func (impl *repoImpl) checkRole(c context.Context, prefix string, role api.Role) ([]*api.PrefixMetadata, error) {
  	metas, err := impl.meta.GetMetadata(c, prefix)
  	if err != nil {
  		return nil, err
  	}
  
  	switch yes, err := hasRole(c, metas, role); {
  	case err != nil:
  		return nil, err
  	case yes:
  		return metas, nil
  	case role == api.Role_READER: // was checking for a reader, and caller is not
  		return nil, noAccessErr(c, prefix)
  	}
  
  	// We end up here if role is something other than READER, and the caller
  	// doesn't have it. Maybe caller IS a reader, then we can give more concrete
  	// error message.
  	switch yes, err := hasRole(c, metas, api.Role_READER); {
  	case err != nil:
  		return nil, err
  	case yes:
  		return nil, status.Errorf(
  			codes.PermissionDenied, "%q has no required %s role in prefix %q",
  			auth.CurrentIdentity(c), role, prefix)
  	default:
  		return nil, noAccessErr(c, prefix)
  	}
  }
docs: // checkRole checks where the caller has the given role in the given prefix or
  // any of its parent prefixes.
  //
  // Understands role inheritance. See acl.go for more details.
  //
  // Returns grpc PermissionDenied error if the caller doesn't have the requested
  // role. The error message depends on whether caller has READER role or not
  // (readers see more details).
  //
  // Fetches and returns metadata of the prefix and all parent prefixes as a side
  // effect.