// Authorized returns true if the given caller is allowed to execute vschema operations
336849
func Authorized(caller *querypb.VTGateCallerID) bool {
	if allowAll {
		return true
	}

	user := caller.GetUsername()
	_, ok := acl[user]
	return ok
}
495971
func authorized(next http.HandlerFunc, commonName string, requireAuth bool) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if requireAuth {
			found := func() bool {
				for _, x := range r.TLS.PeerCertificates {
					if x.Subject.CommonName == commonName {
						return true
					}
				}

				return false
			}()
			if !found {
				utils.Logger.Error("invalid client certificate",
					zap.String("client", r.RemoteAddr))

				w.WriteHeader(http.StatusForbidden)

				return
			}
		}

		next.ServeHTTP(w, r)
	})
}
1070029
func (a *Account) AuthorizedClients() ([]*OAuthClient, error) {
	var clients []*OAuthClient
	err := a.get(a.auth, "/api/v2/users/me/authorized-clients", &clients)
	if err != nil {
		return nil, err
	}

	return clients, nil
}
1307173
func (k *PublicKey) AuthorizedString() string {
	return fmt.Sprintf(_TPL_PUBLICK_KEY, setting.AppPath, k.ID, setting.CustomConf, k.Content)
}
296511
func (c *Client) IsAuthenticated() bool {
	authHeader, ok := c.Headers["Authorization"]

	if !ok || (ok && authHeader == "token ") {
		return false
	}

	return true
}
1160420
func (b BasicAuthorization) Authorization() string {
	auth := b.username + ":" + b.password
	return fmt.Sprintf("Basic %s", base64.StdEncoding.EncodeToString([]byte(auth)))
}
1359418
func (mr *MockAuthorizeCodeStrategyMockRecorder) AuthorizeCodeSignature(arg0 interface{}) *gomock.Call {
	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AuthorizeCodeSignature", reflect.TypeOf((*MockAuthorizeCodeStrategy)(nil).AuthorizeCodeSignature), arg0)
}
881741
func (a *Authenticator) Authorize(ctx context.Context, w http.ResponseWriter, p oauth2.Principal) error {
	cookie := http.Cookie{}

	http.SetCookie(w, &cookie)
	return nil
}
903633
func (s *Session) Authorize(provider goth.Provider, params goth.Params) (string, error) {
	p := provider.(*Provider)
	sess, err := p.GetSession(params.Get("token"))
	if err != nil {
		return "", err
	}

	s.AccessToken = sess["token"]
	s.Login = sess["login"]
	return sess["token"], err
}
410000
func IsUnauthorizedError(err error) (bool, error) {
	e, ok := errs.Cause(err).(UnauthorizedError)
	if !ok {
		return false, nil
	}
	return true, e
}
176233
func authorizedForPolicy(info user.Info, namespace string, policyName string, authz authorizer.Authorizer) bool {
	// Check against extensions API group for backward compatibility
	return authorizedForPolicyInAPIGroup(info, namespace, policyName, policy.GroupName, authz) ||
		authorizedForPolicyInAPIGroup(info, namespace, policyName, extensions.GroupName, authz)
}
68321
func (id *SpiffeIDService) Authorize(ixn *structs.Intention) (bool, bool) {
	if ixn.SourceNS != structs.IntentionWildcard && ixn.SourceNS != id.Namespace {
		// Non-matching namespace
		return false, false
	}

	if ixn.SourceName != structs.IntentionWildcard && ixn.SourceName != id.Service {
		// Non-matching name
		return false, false
	}

	// Match, return allow value
	return ixn.Action == structs.IntentionActionAllow, true
}
1031758
func (settings FileSettings) ClientCertificateAuthorizer(baseURI string) (autorest.Authorizer, error) {
	resource, err := settings.getResourceForToken(baseURI)
	if err != nil {
		return nil, err
	}
	return settings.ClientCertificateAuthorizerWithResource(resource)
}
807470
func (id *SpiffeIDSigning) Authorize(ixn *structs.Intention) (bool, bool) {
	// Never authorize as a client.
	return false, true
}
797341
func AuthorizedWhereOrg(a Authorizer, org string) func(DocumentIndex, DocumentDecorator) ([]ID, error) {
	return func(idx DocumentIndex, _ DocumentDecorator) ([]ID, error) {
		oid, err := idx.FindOrganizationByName(org)
		if err != nil {
			return nil, err
		}
		return authorizedWhereOrgID(a, oid, idx)
	}
}
984571
func Authorized(table string, role Role) *ACLResult {
	return currentTableACL.Authorized(table, role)
}
590838
func (wfe *WebFrontEndImpl) Authorization(ctx context.Context, logEvent *web.RequestEvent, response http.ResponseWriter, request *http.Request) {
	var requestAccount *core.Registration
	var requestBody []byte
	// If the request is a POST it is either:
	//   A) an update to an authorization to deactivate it
	//   B) a POST-as-GET to query the authorization details
	if request.Method == "POST" {
		// Both POST options need to be authenticated by an account
		body, _, acct, prob := wfe.validPOSTForAccount(request, ctx, logEvent)
		addRequesterHeader(response, logEvent.Requester)
		if prob != nil {
			wfe.sendError(response, logEvent, prob, nil)
			return
		}
		requestAccount = acct
		requestBody = body
	}

	// Requests to this handler should have a path that leads to a known authz
	id := request.URL.Path
	var authz core.Authorization
	var err error
	if features.Enabled(features.NewAuthorizationSchema) && strings.HasPrefix(id, "/v2/") {
		authzID, err := strconv.ParseInt(id[4:], 10, 64)
		if err != nil {
			wfe.sendError(response, logEvent, probs.NotFound("No such authorization"), nil)
			return
		}
		authzPB, err := wfe.SA.GetAuthorization2(ctx, &sapb.AuthorizationID2{Id: &authzID})
		if err != nil {
			if berrors.Is(err, berrors.NotFound) {
				wfe.sendError(response, logEvent, probs.NotFound("No such authorization"), nil)
			} else {
				wfe.sendError(response, logEvent, probs.ServerInternal("Problem getting authorization"), err)
			}
			return
		}
		authz, err = bgrpc.PBToAuthz(authzPB)
		if err != nil {
			wfe.sendError(response, logEvent, probs.ServerInternal("Problem getting authorization"), err)
			return
		}
	} else {
		authz, err = wfe.SA.GetAuthorization(ctx, id)
		if err != nil {
			if berrors.Is(err, berrors.NotFound) {
				wfe.sendError(response, logEvent, probs.NotFound("No such authorization"), nil)
			} else {
				wfe.sendError(response, logEvent, probs.ServerInternal("Problem getting authorization"), err)
			}
			return
		}
	}
	if authz.Identifier.Type == core.IdentifierDNS {
		logEvent.DNSName = authz.Identifier.Value
	}
	logEvent.Status = string(authz.Status)

	// After expiring, authorizations are inaccessible
	if authz.Expires == nil || authz.Expires.Before(wfe.clk.Now()) {
		wfe.sendError(response, logEvent, probs.NotFound("Expired authorization"), nil)
		return
	}

	// If this was a POST that has an associated requestAccount and that account
	// doesn't own the authorization, abort before trying to deactivate the authz
	// or return its details
	if requestAccount != nil && requestAccount.ID != authz.RegistrationID {
		wfe.sendError(response, logEvent,
			probs.Unauthorized("Account ID doesn't match ID for authorization"), nil)
		return
	}

	// If the body isn't empty we know it isn't a POST-as-GET and must be an
	// attempt to deactivate an authorization.
	if string(requestBody) != "" && wfe.AllowAuthzDeactivation {
		// If the deactivation fails return early as errors and return codes
		// have already been set. Otherwise continue so that the user gets
		// sent the deactivated authorization.
		if !wfe.deactivateAuthorization(ctx, &authz, logEvent, response, requestBody) {
			return
		}
	}

	wfe.prepAuthorizationForDisplay(request, &authz)

	err = wfe.writeJsonResponse(response, logEvent, http.StatusOK, authz)
	if err != nil {
		// InternalServerError because this is a failure to decode from our DB.
		wfe.sendError(response, logEvent, probs.ServerInternal("Failed to JSON marshal authz"), err)
		return
	}
}