Access Control 

 Reader capabilities (user can be nil or false)
329779
def can_be_read_by?(user)
      return true if can_be_edited_by?(user)
      !commontable.nil? &&\
      config.thread_read_proc.call(self, user)
    end
490147
def single_permission_reader(method_name)
      for permission in joinable_type.constantize.permissions
        if method_name.to_s == "#{permission}_permission"
          return has_permission?(permission)
        end
      end
    
      raise "Unknown single_permission_reader #{method_name.inspect}"
    end
1261189
def do_access_control(self):
        """"""
        from abilian.services import get_service

        if current_app.testing and current_app.config.get("NO_LOGIN"):
            # Special case for tests
            user = User.query.get(0)
            login_user(user, force=True)
            return

        state = self.app_state
        user = unwrap(current_user)

        # Another special case for tests
        if current_app.testing and getattr(user, "is_admin", False):
            return

        security = get_service("security")
        user_roles = frozenset(security.get_roles(user))
        endpoint = request.endpoint
        blueprint = request.blueprint

        access_controllers = []
        access_controllers.extend(state.bp_access_controllers.get(None, []))

        if blueprint and blueprint in state.bp_access_controllers:
            access_controllers.extend(state.bp_access_controllers[blueprint])

        if endpoint and endpoint in state.endpoint_access_controllers:
            access_controllers.extend(state.endpoint_access_controllers[endpoint])

        for access_controller in reversed(access_controllers):
            verdict = access_controller(user=user, roles=user_roles)
            if verdict is None:
                continue
            elif verdict is True:
                return
            else:
                if user.is_anonymous:
                    return self.redirect_to_login()
                raise Forbidden()

        # default policy
        if current_app.config.get("PRIVATE_SITE") and user.is_anonymous:
            return self.redirect_to_login()
369059
def can_view(self, user):
        """"""
        return user.is_admin or user in self.users \
            or self.project.class_ in user.admin_for
781538
def uid
      return nil unless user
      user.kind_of?(Integer) ? user : Etc.getpwnam(user.to_s).uid
    end
1360593
def can_view(self, user):
        """"""
        return user in self.group.users or self.project.can_view(user)
1019612
private Set<Permission> checkPermissions(AAFAuthenticatedUser aau, LocalPermission perm) {
    	if(localLur.fish(aau.getFullName(), perm)) {
//        	aau.setSuper(true);
        	return Permission.ALL;
    	} else {
    		return Permission.NONE;
    	}
    }
922339
function canVersionRead( )
    {
        if ( !isset( $this->Permissions["can_versionread"] ) )
        {
            $this->Permissions["can_versionread"] = $this->checkAccess( 'versionread' );
        }
        return ( $this->Permissions["can_versionread"] == 1 );
    }
172126
def can_access(self, user):
        
        return self.class_.is_admin(user) or \
            self.is_ready and self.class_ in user.classes
721031
function checkAccess({ accessToken, id, model, method, options, ctx }) {

     return new Promise((resolve, reject) => {
         // ignore checking if does not enable auth
         if (model.app.isAuthEnabled) {
             if (!model.app.models.ACL) {
                 console.log('ACL has not been setup, skipping access check.')
                 resolve(true);
             } else {
                 model.checkAccess(accessToken, id, method, ctx,
                     ((err, allowed) => {
                         if (err)
                             reject(err);
                         else if (allowed)
                             resolve(allowed);
                         else
                             reject(`ACCESS_DENIED`);
                     }));
             }
         } else {
             resolve(true);
         }
     })

 }
911220
public function canRead()
    {
        $c = Page::getByPath('/dashboard', 'ACTIVE');
        if ($c && !$c->isError()) {
            $cp = new Permissions($c);

            return $cp->canViewPage();
        }
    }
843305
def setacl(mailbox, user, rights)
      if rights.nil?
        send_command("SETACL", mailbox, user, "")
      else
        send_command("SETACL", mailbox, user, rights)
      end
    end
1212688
def rights(self, form, load):
        '''
        
        '''

        adata = self.auth_data
        good = False
        if load.get('token', False):
            for sub_auth in self.token(self.auth_data, load):
                if sub_auth:
                    if self.rights_check(
                            form,
                            self.auth_data[sub_auth['token']['eauth']],
                            sub_auth['token']['name'],
                            load,
                            sub_auth['token']['eauth']):
                        return True
            log.warning(
                'Authentication failure of type "token" occurred.'
            )
        elif load.get('eauth'):
            for sub_auth in self.eauth(self.auth_data, load):
                if sub_auth:
                    if self.rights_check(
                            form,
                            sub_auth['sub_auth'],
                            sub_auth['name'],
                            load,
                            load['eauth']):
                        return True
            log.warning(
                'Authentication failure of type "eauth" occurred.'
            )
        return False
109234
private static List<AccessControlEntry> readACLPermisions(List<String> exoPermissions)
   {
      List<AccessControlEntry> naPermissions = new ArrayList<AccessControlEntry>();

      for (String perm : exoPermissions)
      {
         naPermissions.add(AccessControlEntry.parse(perm));
      }

      return naPermissions;
   }
877140
private void validateAccessPermissions(ItemState changedItem) throws RepositoryException, AccessDeniedException
   {
      if (changedItem.isAddedAutoCreatedNodes())
      {
         validateAddNodePermission(changedItem);
      }
      else if (changedItem.isDeleted())
      {
         validateRemoveAccessPermission(changedItem);
      }
      else if (changedItem.isMixinChanged())
      {
         validateMixinChangedPermission(changedItem);
      }
      else
      {
         NodeData parent = (NodeData)getItemData(changedItem.getData().getParentIdentifier());
         if (parent != null)
         {
            if (changedItem.getData().isNode())
            {
               // add node
               if (changedItem.isAdded())
               {
                  if (!accessManager.hasPermission(parent.getACL(), new String[]{PermissionType.ADD_NODE}, session
                     .getUserState().getIdentity()))
                  {
                     throw new AccessDeniedException("Access denied: ADD_NODE "
                        + changedItem.getData().getQPath().getAsString() + " for: " + session.getUserID()
                        + " item owner " + parent.getACL().getOwner());
                  }
               }
            }
            else if (changedItem.isAdded() || changedItem.isUpdated())
            {
               // add or update property
               if (!accessManager.hasPermission(parent.getACL(), new String[]{PermissionType.SET_PROPERTY}, session
                  .getUserState().getIdentity()))
               {
                  throw new AccessDeniedException("Access denied: SET_PROPERTY "
                     + changedItem.getData().getQPath().getAsString() + " for: " + session.getUserID() + " item owner "
                     + parent.getACL().getOwner());
               }
            }
         } // else - parent not found, deleted in this session or from another
      }
   }
336936
def unauthenticated_url(obj = nil)
      obj = obj.url_for(:read).to_s.split("?")[0] if !obj.nil?
      obj
    end
1204963
def index
      raise CanCan::AccessDenied.new unless current_user
      @scratches = ImageScratch.where(ownable: current_user).all
      (authorize! :read, @scratches[0]) unless @scratches.empty?
    end