// safelyAuthorizeNode checks if the request is permitted
325908
func (n *NodeAuthorizer) safelyAuthorizeNode(ctx context.Context, request *NodeRegistration) error {
	// @step: attempt to authorize the request
	now := time.Now()
	if err := n.authorizer.Authorize(ctx, request); err != nil {
		authorizerErrorMetric.Inc()

		return err
	}
	authorizerLatencyMetric.Observe(time.Since(now).Seconds())

	// @check if the node is registered already
	if n.config.UseFeature(CheckRegistration) {
		if found, err := isNodeRegistered(ctx, n.client, request.Spec.NodeName); err != nil {
			return fmt.Errorf("unable to check node registration status: %s", err)
		} else if found {
			request.Deny(fmt.Sprintf("node %s already registered", request.Spec.NodeName))
		}
	}

	return nil
}
1277033
func (api UsersAPI) DeleteAuthorization(w http.ResponseWriter, r *http.Request) {
	username := mux.Vars(r)["username"]
	grantedTo := mux.Vars(r)["grantedTo"]

	userMgr := user.NewManager(r)

	err := userMgr.DeleteAuthorization(username, grantedTo)
	if handleServerError(w, "Delete authorization", err) {
		return
	}
	w.WriteHeader(http.StatusNoContent)
}
139458
func (s *AuthorizationService) FindAuthorizationByToken(ctx context.Context, token string) (*platform.Authorization, error) {
	return nil, errors.New("not supported in HTTP authorization service")
}
612880
func (s *Authorizer) SetAuthorizerId(v string) *Authorizer {
	s.AuthorizerId = &v
	return s
}
825905
func (s *Storage) LoadAuthorize(code string) (*osin.AuthorizeData, error) {

	// Load Authorize from DB
	var authorize service.Authorize
	if err := dbconn.DB.Where("code = ?", code).Find(&authorize).Error; err != nil {
		return nil, err
	}

	// Copy Authorize in OSIN AuthorizeData
	var data osin.AuthorizeData
	copier.Copy(&data, &authorize)

	c, err := s.GetClient(authorize.Client)
	if err != nil {
		return nil, err
	}

	if data.ExpireAt().Before(time.Now()) {
		return nil, errors.Errorf("Token expired at %s.", data.ExpireAt().String())
	}

	data.Client = c
	return &data, nil
}
1157944
func SAMLUnauthorized(loginURL string) func(error) *ErrorResource {
	return func(reason error) *ErrorResource {
		if reason == nil {
			reason = errors.New("Request not authenticated, API token is missing, invalid or expired")
		}

		return &ErrorResource{
			Status:  http.StatusUnauthorized,
			ID:      "saml_unauthorized",
			Message: fmt.Sprintf("%s. Login at %s", reason, loginURL),
		}
	}
}
858739
func (s *MethodSnapshot) SetAuthorizationType(v string) *MethodSnapshot {
	s.AuthorizationType = &v
	return s
}
749506
func (c *Certificate) CheckAuthority() error {
	if err := c.buildX509Certificate(); err != nil {
		return err
	}
	return c.crt.CheckSignatureFrom(c.crt)
}
548498
func sslVerifyCertificateAuthority(client *tls.Conn, tlsConf *tls.Config) {
	err := client.Handshake()
	if err != nil {
		panic(err)
	}
	certs := client.ConnectionState().PeerCertificates
	opts := x509.VerifyOptions{
		DNSName:       client.ConnectionState().ServerName,
		Intermediates: x509.NewCertPool(),
		Roots:         tlsConf.RootCAs,
	}
	for i, cert := range certs {
		if i == 0 {
			continue
		}
		opts.Intermediates.AddCert(cert)
	}
	_, err = certs[0].Verify(opts)
	if err != nil {
		panic(err)
	}
}
1164367
func (n *NodeRegistration) Deny(reason string) {
	n.Status.Allowed = false
	n.Status.Reason = reason
}
839921
func (n *NodeAuthorizer) safelyProvisionBootstrapToken(ctx context.Context, request *NodeRegistration) error {
	maxInterval := 500 * time.Millisecond
	maxTime := 10 * time.Second
	usages := []string{"authentication", "signing"}
	now := time.Now()

	if err := utils.Retry(ctx, maxInterval, maxTime, func() error {
		token, err := n.createToken(n.config.TokenDuration, usages)
		if err != nil {
			return err
		}
		request.Status.Token = token.String()

		return err
	}); err != nil {
		return err
	}

	tokenLatencyMetric.Observe(time.Since(now).Seconds())

	return nil
}
703636
func (ra *RegistrationAuthorityImpl) authzValidChallengeEnabled(authz *core.Authorization) bool {
	for _, chall := range authz.Challenges {
		if chall.Status == core.StatusValid {
			return ra.PA.ChallengeTypeEnabled(chall.Type)
		}
	}
	return false
}
1332807
func (s *Route) SetAuthorizationType(v string) *Route {
	s.AuthorizationType = &v
	return s
}
1049711
func (r *NodeAuthorizer) authorizeCSINode(nodeName string, attrs authorizer.Attributes) (authorizer.Decision, string, error) {
	// allowed verbs: get, create, update, patch, delete
	verb := attrs.GetVerb()
	if verb != "get" &&
		verb != "create" &&
		verb != "update" &&
		verb != "patch" &&
		verb != "delete" {
		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
		return authorizer.DecisionNoOpinion, "can only get, create, update, patch, or delete a CSINode", nil
	}

	if len(attrs.GetSubresource()) > 0 {
		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
		return authorizer.DecisionNoOpinion, "cannot authorize CSINode subresources", nil
	}

	// the request must come from a node with the same name as the CSINode
	// note we skip this check for create, since the authorizer doesn't know the name on create
	// the noderestriction admission plugin is capable of performing this check at create time
	if verb != "create" && attrs.GetName() != nodeName {
		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
		return authorizer.DecisionNoOpinion, "can only access CSINode with the same name as the requesting node", nil
	}

	return authorizer.DecisionAllow, "", nil
}
667187
func (s *AuthorizationService) CreateAuthorization(ctx context.Context, a *platform.Authorization) (err error) {
	defer func() {
		if err != nil {
			s.Logger.Info("error creating authorization", zap.Error(err))
		}
	}()

	return s.AuthorizationService.CreateAuthorization(ctx, a)
}
486721
func (s *Storage) LoadAuthorize(code string) (*osin.AuthorizeData, error) {
	var data osin.AuthorizeData
	var extra string
	var cid string
	if err := s.db.QueryRow("SELECT client, code, expires_in, scope, redirect_uri, state, created_at, extra FROM authorize WHERE code=$1 LIMIT 1", code).Scan(&cid, &data.Code, &data.ExpiresIn, &data.Scope, &data.RedirectUri, &data.State, &data.CreatedAt, &extra); err == sql.ErrNoRows {
		return nil, pkg.ErrNotFound
	} else if err != nil {
		return nil, errors.New(err)
	}
	data.UserData = extra

	c, err := s.GetClient(cid)
	if err != nil {
		return nil, err
	}

	if data.ExpireAt().Before(time.Now()) {
		return nil, errors.Errorf("Token expired at %s.", data.ExpireAt().String())
	}

	data.Client = c
	return &data, nil
}
933884
func IsAuthorisationFailure(err error) bool {
	if err == nil {
		return false
	} else if strings.Contains(errors.Cause(err).Error(), "not authorized") {
		return true
	}
	return false
}