This method is triggered whenever a subsystem requests the privileges
that are supported on a particular node.

We need to add a number of privileges for scheduling purposes.

@param INode $node
@param array $supportedPrivilegeSet
437853
public function getSupportedPrivilegeSet(INode $node, array &$supportedPrivilegeSet)
    {
        $ns = '{'.self::NS_CALDAV.'}';
        if ($node instanceof IOutbox) {
            $supportedPrivilegeSet[$ns.'schedule-send'] = [
                'abstract' => false,
                'aggregates' => [
                    $ns.'schedule-send-invite' => [
                        'abstract' => false,
                        'aggregates' => [],
                    ],
                    $ns.'schedule-send-reply' => [
                        'abstract' => false,
                        'aggregates' => [],
                    ],
                    $ns.'schedule-send-freebusy' => [
                        'abstract' => false,
                        'aggregates' => [],
                    ],
                    // Privilege from an earlier scheduling draft, but still
                    // used by some clients.
                    $ns.'schedule-post-vevent' => [
                        'abstract' => false,
                        'aggregates' => [],
                    ],
                ],
            ];
        }
        if ($node instanceof IInbox) {
            $supportedPrivilegeSet[$ns.'schedule-deliver'] = [
                'abstract' => false,
                'aggregates' => [
                    $ns.'schedule-deliver-invite' => [
                        'abstract' => false,
                        'aggregates' => [],
                    ],
                    $ns.'schedule-deliver-reply' => [
                        'abstract' => false,
                        'aggregates' => [],
                    ],
                    $ns.'schedule-query-freebusy' => [
                        'abstract' => false,
                        'aggregates' => [],
                    ],
                ],
            ];
        }
    }
1350238
public function disablePermissionManager(AbstractEditableSecurityEvent $event): void
    {
        $event->setPermissionEnabled($this->permManager->isEnabled());
        $this->permManager->setEnabled(false);
    }
320217
public function getCurrentPermissionArray(ResourceNode $resourceNode)
    {
        $currentRoles = $this->tokenStorage->getToken()->getRoles();

        $roleNames = array_map(function (RoleInterface $roleName) {
            return $roleName->getRole();
        }, $currentRoles);

        $creatable = [];
        if ($this->isManager($resourceNode)) {
            /** @var ResourceType[] $resourceTypes */
            $resourceTypes = $this->om->getRepository('ClarolineCoreBundle:Resource\ResourceType')->findAll();

            foreach ($resourceTypes as $resourceType) {
                $creatable[] = $resourceType->getName();
            }

            $perms = array_fill_keys(array_values($this->maskManager->getPermissionMap($resourceNode->getResourceType())), true);
        } else {
            $creatable = $this->getCreatableTypes($roleNames, $resourceNode);

            $perms = $this->maskManager->decodeMask(
                $this->rightsRepo->findMaximumRights($roleNames, $resourceNode),
                $resourceNode->getResourceType()
            );
        }

        return array_merge($perms, ['create' => $creatable]);
    }
505256
private void handleRevokedGrants(
      String nodeName, Set<ClusterNode.GrantId> grantsToRevoke) {
    for (ClusterNode.GrantId grantId: grantsToRevoke) {
      String sessionHandle = grantId.getSessionId();

      try {
        sessionManager.revokeResource(sessionHandle,
            Collections.singletonList(grantId.getRequestId()));
      } catch (InvalidSessionHandle e) {
        // ignore
        LOG.warn("Found invalid session: " + sessionHandle +
                 " while timing out node: " + nodeName);
      }
    }
  }
1075436
protected function isGrantedNode(ReadNodeInterface $node)
    {
        return empty($node->getFrontRoles()) ||
               (null !== $this->tokenStorage->getToken() && $this->authorizationChecker->isGranted(ContributionActionInterface::READ, $node));
    }
146328
public function invoke($node, NodeInterface $parent): void
    {
        if (! $node instanceof Node\Stmt\GroupUse || ! $parent instanceof PhpFileModelInterface) {
            throw new Exception('GroupUseNodeParser is made to parse a use group node');
        }

        if ($this->validateType($node->type)) {
            $prefix = $node->prefix->toString();
            foreach ($node->uses as $use) {
                if ($this->validateType($node->type)) {
                    $parent->addUse($use->getAlias()->name, $prefix . '\\' . $use->name->toString());
                }
            }
        }
    }
424408
public function invoke($node, NodeInterface $parent): void
    {
        if (! $node instanceof Node\Stmt\Property || ! $parent instanceof TraitModelInterface) {
            throw new Exception('AttributeNodeParser is made to parse a property node');
        }
        $isStatic   = $node->isStatic();
        $visibility = AttributeVisibilityHelper::getVisibility($node);

        foreach ($node->props as $property) {
            $attribute = new AttributeModel();
            $attribute->setParentNode($parent);
            $attribute->setName($property->name);
            $attribute->setIsStatic($isStatic);
            $attribute->setVisibility($visibility);

            if ($property->default !== null) {
                $this->valueNodeParser->invoke($property->default, $attribute);
            }

            $parent->addAttribute($attribute);
        }
    }
727784
private function serializePriv(Writer $writer, $privName, $privilege)
    {
        $writer->startElement('{DAV:}supported-privilege');

        $writer->startElement('{DAV:}privilege');
        $writer->writeElement($privName);
        $writer->endElement(); // privilege

        if (!empty($privilege['abstract'])) {
            $writer->writeElement('{DAV:}abstract');
        }
        if (!empty($privilege['description'])) {
            $writer->writeElement('{DAV:}description', $privilege['description']);
        }
        if (isset($privilege['aggregates'])) {
            foreach ($privilege['aggregates'] as $subPrivName => $subPrivilege) {
                $this->serializePriv($writer, $subPrivName, $subPrivilege);
            }
        }

        $writer->endElement(); // supported-privilege
    }
1127645
public function allowed($providedPermission, Model $entity, $owner = true, $ownerColumn = 'user_id')
    {
        if ($this->isPretendEnabled()) {
            return $this->pretend('allowed');
        }

        if ($owner === true && $entity->{$ownerColumn} == $this->id) {
            return true;
        }

        return $this->isAllowed($providedPermission, $entity);
    }
214852
private function hasMethodsChainAllowedPrefixes(AbstractNode $memberPrimaryPrefix, array $allowedPrefixes)
    {
        $methodPostfixes = $memberPrimaryPrefix->findChildrenOfType('MethodPostfix');

        foreach ($methodPostfixes as $methodPostfix) {
            foreach ($allowedPrefixes as $allowedPrefix) {
                if ($allowedPrefix === substr($methodPostfix->getName(), 0, strlen($allowedPrefix))) {
                    continue 2;
                }
            }

            return false;
        }

        return true;
    }
213242
public function removeAuthority(DataObject $node, DataObject $authority)
    {
        if (!$this->checkPerm($node, 'DeletePermissions')) {
            throw new PermissionDeniedException("You do not have permission to do that");
        }

        if ($authority) {
            $authority->delete();
        }
        
        return $node;
    }
275041
public function addPagePrivileges(Page $page)
    {
        if ($this->addPagePrivilegeStatement == null) {
            $this->addPagePrivilegeStatement = $this->connection->prepare("
              INSERT INTO UserPrivileges (username, rootPrivileges, sitePrivileges, pageId) VALUES (?,0,0,?)");
        }
        $success = true;
        try {
            $this->addPagePrivilegeStatement->execute(array($this->user->getUsername(), $page->getID()));
        } catch (PDOException $e) {
            $success = false;
        }
        if ($success) {
            $this->pagePrivilege[$page->getID()] = 1;
        }
    }
548620
private function addUserInterfaceNode(ArrayNodeDefinition $rootNode)
    {
        $validate = function (string $interface) {

            $class = new \ReflectionClass(\str_replace(':', '\\Entity\\', $interface));

            return !$class->implementsInterface(UserInterface::class);
        };

        $rootNode->children()->variableNode('user_provider')
            ->info('The user provider entity')
            ->isRequired()
            ->validate()
            ->ifTrue($validate)
            ->thenInvalid('%s isn\'t a valid user provider.')
            ->end()
            ->end();

        return $rootNode;
    }
477689
private function checkPermission(Node $node, $permission)
    {
        if (false === $this->authorizationChecker->isGranted($permission, $node)) {
            throw new AccessDeniedException();
        }
    }
100250
protected function addPermissions(Node $node, &$doc)
    {
        if (!is_null($this->aclProvider)) {
            $roles = $this->getAclPermissions($node);
        } else {
            // Fallback when no ACL available / assume everything is accessible...
            $roles = array('IS_AUTHENTICATED_ANONYMOUSLY');
        }
        $doc['view_roles'] = $roles;
    }
748683
public function getNodeTypeNamesDeniedForCreation(NodeInterface $referenceNode)
    {
        $privilegeSubject = new CreateNodePrivilegeSubject($referenceNode);

        $allNodeTypes = $this->nodeTypeManager->getNodeTypes();

        $deniedCreationNodeTypes = [];
        $grantedCreationNodeTypes = [];
        $abstainedCreationNodeTypes = [];
        foreach ($this->securityContext->getRoles() as $role) {
            /** @var CreateNodePrivilege $createNodePrivilege */
            foreach ($role->getPrivilegesByType(CreateNodePrivilege::class) as $createNodePrivilege) {
                if (!$createNodePrivilege->matchesSubject($privilegeSubject)) {
                    continue;
                }

                $affectedNodeTypes = ($createNodePrivilege->getCreationNodeTypes() !== [] ? $createNodePrivilege->getCreationNodeTypes() : $allNodeTypes);

                if ($createNodePrivilege->isGranted()) {
                    $grantedCreationNodeTypes = array_merge($grantedCreationNodeTypes, $affectedNodeTypes);
                } elseif ($createNodePrivilege->isDenied()) {
                    $deniedCreationNodeTypes = array_merge($deniedCreationNodeTypes, $affectedNodeTypes);
                } else {
                    $abstainedCreationNodeTypes = array_merge($abstainedCreationNodeTypes, $affectedNodeTypes);
                }
            }
        }
        $implicitlyDeniedNodeTypes = array_diff($abstainedCreationNodeTypes, $grantedCreationNodeTypes);
        return array_merge($implicitlyDeniedNodeTypes, $deniedCreationNodeTypes);
    }
924971
public function handlePersist(PersistEvent $event)
    {
        /** @var SecurityBehavior $document */
        $document = $event->getDocument();

        if (!$this->supports($document) || !$document->getPermissions()) {
            return;
        }

        $node = $event->getNode();

        foreach ($document->getPermissions() as $roleId => $permission) {
            // TODO use PropertyEncoder, once it is refactored
            $node->setProperty('sec:role-' . $roleId, $this->getAllowedPermissions($permission));
        }
    }