// enforce is a helper to additionally check a default role and invoke a custom claims enforcement function
438171
func enforce(enf *casbin.Enforcer, defaultRole string, claimsEnforcerFunc ClaimsEnforcerFunc, rvals ...interface{}) bool {
	// check the default role
	if defaultRole != "" && len(rvals) >= 2 {
		if enf.Enforce(append([]interface{}{defaultRole}, rvals[1:]...)...) {
			return true
		}
	}
	if len(rvals) == 0 {
		return false
	}
	// check if subject is jwt.Claims vs. a normal subject string and run custom claims
	// enforcement func (if set)
	sub := rvals[0]
	switch s := sub.(type) {
	case string:
		// noop
	case jwt.Claims:
		if claimsEnforcerFunc != nil && claimsEnforcerFunc(s, rvals...) {
			return true
		}
		rvals = append([]interface{}{""}, rvals[1:]...)
	default:
		rvals = append([]interface{}{""}, rvals[1:]...)
	}
	return enf.Enforce(rvals...)
}
377964
func (e *SyncedEnforcer) GetPolicy() [][]string {
	e.m.RLock()
	defer e.m.RUnlock()
	return e.Enforcer.GetPolicy()
}
897503
func (s *SecretsProxy) Enforce(puInfo *policy.PUInfo) error {
	return s.updateService(puInfo)
}
80619
func (e *SyncedEnforcer) Enforce(rvals ...interface{}) bool {
	e.m.RLock()
	defer e.m.RUnlock()
	return e.Enforcer.Enforce(rvals...)
}
126033
func (r *RoleV2) Equals(other Role) bool {
	return r.V3().Equals(other)
}
816548
func checkRole(bitmask int, role Role) bool {
	return (bitmask & role.getValue()) == role.getValue()
}
418152
func (m *MockTriremeController) Enforce(ctx context.Context, puID string, policy *policy.PUPolicy, runtime *policy.PURuntime) error {
	ret := m.ctrl.Call(m, "Enforce", ctx, puID, policy, runtime)
	ret0, _ := ret[0].(error)
	return ret0
}
153008
func validateRoleConstraints(role *roleStorageEntry) error {
	if role == nil {
		return fmt.Errorf("nil role")
	}

	// At least one constraint should be enabled on the role
	switch {
	case role.BindSecretID:
	case len(role.BoundCIDRList) != 0:
	case len(role.SecretIDBoundCIDRs) != 0:
	case len(role.TokenBoundCIDRs) != 0:
	default:
		return fmt.Errorf("at least one constraint should be enabled on the role")
	}

	return nil
}
366729
func (e *SyncedEnforcer) GetRolesForUserInDomain(name string, domain string) []string {
	e.m.Lock()
	defer e.m.Unlock()
	return e.Enforcer.GetRolesForUserInDomain(name, domain)
}
679035
func (e *CachedEnforcer) Enforce(rvals ...interface{}) bool {
	if !e.enableCache {
		return e.Enforcer.Enforce(rvals...)
	}

	key := ""
	for _, rval := range rvals {
		if val, ok := rval.(string); ok {
			key += val + "$$"
		} else {
			return e.Enforcer.Enforce(rvals...)
		}
	}

	e.locker.Lock()
	defer e.locker.Unlock()
	if _, ok := e.m[key]; ok {
		return e.m[key]
	} else {
		res := e.Enforcer.Enforce(rvals...)
		e.m[key] = res
		return res
	}
}
12672
func (e *Enforcer) SavePolicy() error {
	if e.IsFiltered() {
		return errors.New("cannot save a filtered policy")
	}
	if err := e.adapter.SavePolicy(e.model); err != nil {
		return err
	}
	if e.watcher != nil {
		return e.watcher.Update()
	}
	return nil
}
220846
func checkConstraint(ctx Context, operand string, lVal, rVal interface{}, lFound, rFound bool) bool {
	// Check for constraints not handled by this checker.
	switch operand {
	case structs.ConstraintDistinctHosts, structs.ConstraintDistinctProperty:
		return true
	default:
		break
	}

	switch operand {
	case "=", "==", "is":
		return lFound && rFound && reflect.DeepEqual(lVal, rVal)
	case "!=", "not":
		return !reflect.DeepEqual(lVal, rVal)
	case "<", "<=", ">", ">=":
		return lFound && rFound && checkLexicalOrder(operand, lVal, rVal)
	case structs.ConstraintAttributeIsSet:
		return lFound
	case structs.ConstraintAttributeIsNotSet:
		return !lFound
	case structs.ConstraintVersion:
		return lFound && rFound && checkVersionMatch(ctx, lVal, rVal)
	case structs.ConstraintRegex:
		return lFound && rFound && checkRegexpMatch(ctx, lVal, rVal)
	case structs.ConstraintSetContains, structs.ConstraintSetContainsAll:
		return lFound && rFound && checkSetContainsAll(ctx, lVal, rVal)
	case structs.ConstraintSetContainsAny:
		return lFound && rFound && checkSetContainsAny(lVal, rVal)
	default:
		return false
	}
}
1077314
func enforcePodContainerConstraints(container *corev1.Container, requiredSet, missingSet sets.String) {
	requests := container.Resources.Requests
	limits := container.Resources.Limits
	containerUsage := podComputeUsageHelper(requests, limits)
	containerSet := quota.ToSet(quota.ResourceNames(containerUsage))
	if !containerSet.Equal(requiredSet) {
		difference := requiredSet.Difference(containerSet)
		missingSet.Insert(difference.List()...)
	}
}
675136
func (e *Enforcer) DeleteRole(role string) {
	e.RemoveFilteredGroupingPolicy(1, role)
	e.RemoveFilteredPolicy(0, role)
}
33768
func (p *PreReceiveHook) GetEnforcement() string {
	if p == nil || p.Enforcement == nil {
		return ""
	}
	return *p.Enforcement
}
1276459
func (mr *MockTriremeControllerMockRecorder) Enforce(ctx, puID, policy, runtime interface{}) *gomock.Call {
	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Enforce", reflect.TypeOf((*MockTriremeController)(nil).Enforce), ctx, puID, policy, runtime)
}
134453
func (m *MockEnforcer) Enforce(contextID string, puInfo *policy.PUInfo) error {
	ret := m.ctrl.Call(m, "Enforce", contextID, puInfo)
	ret0, _ := ret[0].(error)
	return ret0
}