// OrganizationRoles returns list of roles for specified organization of the logged-in user.
//
// API reference: https://api.cloudflare.com/#organization-roles-list-roles
185412
func (api *API) OrganizationRoles(organizationID string) ([]OrganizationRole, ResultInfo, error) {
	var r organizationRolesResponse
	uri := "/organizations/" + organizationID + "/roles"
	res, err := api.makeRequest("GET", uri, nil)
	if err != nil {
		return []OrganizationRole{}, ResultInfo{}, errors.Wrap(err, errMakeRequestError)
	}

	err = json.Unmarshal(res, &r)
	if err != nil {
		return []OrganizationRole{}, ResultInfo{}, errors.Wrap(err, errUnmarshalError)
	}

	return r.Result, r.ResultInfo, nil
}
1281667
func RoleScopeFilterByRole(id uuid.UUID) func(db *gorm.DB) *gorm.DB {
	return func(db *gorm.DB) *gorm.DB {
		return db.Where("role_id = ?", id)
	}
}
301614
func (s *stateEP) AddOrgs(role RoleType, neworgs ...string) error {
	var mspRole mb.MSPRole_MSPRoleType
	switch role {
	case RoleTypeMember:
		mspRole = mb.MSPRole_MEMBER
	case RoleTypePeer:
		mspRole = mb.MSPRole_PEER
	default:
		return &RoleTypeDoesNotExistError{RoleType: role}
	}

	// add new orgs
	for _, addorg := range neworgs {
		s.orgs[addorg] = mspRole
	}

	return nil
}
1095245
func (api OrganizationsAPI) AddOrganizationMember(w http.ResponseWriter, r *http.Request) {
	api.inviteUser(w, r, invitations.RoleMember)
}
626330
func ClusterRoleBindings() []rbacv1.ClusterRoleBinding {
	rolebindings := []rbacv1.ClusterRoleBinding{
		rbacv1helpers.NewClusterBinding("cluster-admin").Groups(user.SystemPrivilegedGroup).BindingOrDie(),
		rbacv1helpers.NewClusterBinding("system:discovery").Groups(user.AllAuthenticated).BindingOrDie(),
		rbacv1helpers.NewClusterBinding("system:basic-user").Groups(user.AllAuthenticated).BindingOrDie(),
		rbacv1helpers.NewClusterBinding("system:public-info-viewer").Groups(user.AllAuthenticated, user.AllUnauthenticated).BindingOrDie(),
		rbacv1helpers.NewClusterBinding("system:node-proxier").Users(user.KubeProxy).BindingOrDie(),
		rbacv1helpers.NewClusterBinding("system:kube-controller-manager").Users(user.KubeControllerManager).BindingOrDie(),
		rbacv1helpers.NewClusterBinding("system:kube-dns").SAs("kube-system", "kube-dns").BindingOrDie(),
		rbacv1helpers.NewClusterBinding("system:kube-scheduler").Users(user.KubeScheduler).BindingOrDie(),
		rbacv1helpers.NewClusterBinding("system:volume-scheduler").Users(user.KubeScheduler).BindingOrDie(),

		// This default binding of the system:node role to the system:nodes group is deprecated in 1.7 with the availability of the Node authorizer.
		// This leaves the binding, but with an empty set of subjects, so that tightening reconciliation can remove the subject.
		{
			ObjectMeta: metav1.ObjectMeta{Name: systemNodeRoleName},
			RoleRef:    rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "ClusterRole", Name: systemNodeRoleName},
		},
	}

	addClusterRoleBindingLabel(rolebindings)

	return rolebindings
}
473323
func (v *version) Roles() RoleInformer {
	return &roleInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
}
1302647
func (m *Membership) GetRole() string {
	if m == nil || m.Role == nil {
		return ""
	}
	return *m.Role
}
598104
func (api OrganizationsAPI) AddOrganizationOwner(w http.ResponseWriter, r *http.Request) {
	api.inviteUser(w, r, invitations.RoleOwner)
}
409302
func (s *SetIdentityPoolRolesInput) SetRoles(v map[string]*string) *SetIdentityPoolRolesInput {
	s.Roles = v
	return s
}
1371136
func (e *Enforcer) GetRolesForUserInDomain(name string, domain string) []string {
	res, _ := e.model["g"]["g"].RM.GetRoles(name, domain)
	return res
}
276144
func (a *AuthWithRoles) filterNodes(nodes []services.Server) ([]services.Server, error) {
	// For certain built-in roles, continue to allow full access and return
	// the full set of nodes to not break existing clusters during migration.
	//
	// In addition, allow proxy (and remote proxy) to access all nodes for it's
	// smart resolution address resolution. Once the smart resolution logic is
	// moved to the auth server, this logic can be removed.
	if a.hasBuiltinRole(string(teleport.RoleAdmin)) ||
		a.hasBuiltinRole(string(teleport.RoleProxy)) ||
		a.hasRemoteBuiltinRole(string(teleport.RoleRemoteProxy)) {
		return nodes, nil
	}

	// Fetch services.RoleSet for the identity of the logged in user.
	roles, err := services.FetchRoles(a.user.GetRoles(), a.authServer, a.user.GetTraits())
	if err != nil {
		return nil, trace.Wrap(err)
	}

	// Extract all unique allowed logins across all roles.
	allowedLogins := make(map[string]bool)
	for _, role := range roles {
		for _, login := range role.GetLogins(services.Allow) {
			allowedLogins[login] = true
		}
	}

	// Loop over all nodes and check if the caller has access.
	filteredNodes := make([]services.Server, 0, len(nodes))
NextNode:
	for _, node := range nodes {
		for login, _ := range allowedLogins {
			err := roles.CheckAccessToServer(login, node)
			if err == nil {
				filteredNodes = append(filteredNodes, node)
				continue NextNode
			}
		}
	}

	return filteredNodes, nil
}
55786
func newRoleBindings(c *RbacV1alpha1Client, namespace string) *roleBindings {
	return &roleBindings{
		client: c.RESTClient(),
		ns:     namespace,
	}
}
610693
func FormatRole(role string) (api.NodeRole, error) {
	switch strings.ToLower(role) {
	case strings.ToLower(ManagerRole):
		return api.NodeRoleManager, nil
	case strings.ToLower(WorkerRole):
		return api.NodeRoleWorker, nil
	default:
		return 0, errors.Errorf("failed to parse role: %s", role)
	}
}
611979
func (s *InstanceProfile) SetRoles(v []*Role) *InstanceProfile {
	s.Roles = v
	return s
}
799805
func (rm *RoleManager) GetRoles(name string, domain ...string) ([]string, error) {
	if len(domain) == 1 {
		name = domain[0] + "::" + name
	} else if len(domain) > 1 {
		return nil, errors.New("error: domain should be 1 parameter")
	}

	if !rm.hasRole(name) {
		return []string{}, nil
	}

	roles := rm.createRole(name).getRoles()
	if len(domain) == 1 {
		for i := range roles {
			roles[i] = roles[i][len(domain[0])+2:]
		}
	}
	return roles, nil
}
1017316
func (m *MetaClient) Role(ctx context.Context, name string) (*Role, error) {
	roles, err := m.Roles(ctx, &name)
	if err != nil {
		return nil, err
	}
	for _, role := range roles.Roles {
		return &role, nil
	}
	return nil, fmt.Errorf("no role found")
}
1196365
func (conn *Connection) GrantRole(username string, role string,
	auth Auth) (string, error) {
	userDb := conn.SelectDB("_users", auth)
	namestring := "org.couchdb.user:" + username
	var userData interface{}

	rev, err := userDb.Read(namestring, &userData, nil)
	if err != nil {
		return "", err
	}
	if reflect.ValueOf(userData).Kind() != reflect.Map {
		return "", errors.New("Type Error")
	}
	userMap := userData.(map[string]interface{})
	if reflect.ValueOf(userMap["roles"]).Kind() != reflect.Slice {
		return "", errors.New("Type Error")
	}
	userRoles := userMap["roles"].([]interface{})
	//Check if our role is already in the array, so we don't add it twice
	for _, r := range userRoles {
		if r == role {
			return rev, nil
		}
	}
	userMap["roles"] = append(userRoles, role)
	return userDb.Save(&userMap, namestring, rev)
}