// TokenAuthorizedWhereID ensures that the authorization provided has the permission to access the document.
552462
func TokenAuthorizedWhereID(a *Authorization, docID ID) func(DocumentIndex, DocumentDecorator) ([]ID, error) {
	return func(idx DocumentIndex, _ DocumentDecorator) ([]ID, error) {
		if !a.IsActive() {
			return nil, &Error{
				Code: EUnauthorized,
				Msg:  "authorizer cannot access documents",
			}
		}

		oids, err := idx.GetDocumentsAccessors(docID)
		if err != nil {
			return nil, err
		}
		orgs := map[ID]bool{}
		for _, oid := range oids {
			orgs[oid] = true
		}

		for _, p := range a.Permissions {
			// If the authz has a direct permission to access the resource
			if p.Resource.Type == DocumentsResourceType && p.Resource.ID != nil && docID == *p.Resource.ID {
				return []ID{docID}, nil
			}
			// If the authz has a direct permission to access the class of resources
			if p.Resource.Type == DocumentsResourceType && p.Resource.ID == nil && p.Resource.OrgID == nil {
				return []ID{docID}, nil
			}

			if p.Resource.Type == DocumentsResourceType && p.Resource.OrgID != nil && orgs[*p.Resource.OrgID] {
				return []ID{docID}, nil
			}
		}

		return nil, &Error{
			Code: EUnauthorized,
			Msg:  "authorization cannot access document",
		}
	}
}
655446
func (s *Server) WithAuthorization(scheme AuthorizationScheme) *Server {
	s.authorization = scheme
	return s
}
1134168
func (s *Route) SetAuthorizerId(v string) *Route {
	s.AuthorizerId = &v
	return s
}
350499
func AuthorizedWithOrgID(a Authorizer, orgID ID) func(ID, DocumentIndex) error {
	switch t := a.(type) {
	case *Authorization:
		return TokenAuthorizedWithOrgID(t, orgID)
	}

	return func(id ID, idx DocumentIndex) error {
		if err := idx.IsOrgAccessor(a.GetUserID(), orgID); err != nil {
			return err
		}

		return idx.AddDocumentOwner(id, "org", orgID)
	}
}
401668
func (s *AuthorizationData) SetAuthorizationToken(v string) *AuthorizationData {
	s.AuthorizationToken = &v
	return s
}
8502
func (s *service) AuthorizeToken(ctx context.Context, hostname, path, token string) (*sessions.Session, error) {
	resourceCh, resourceErrCh := make(chan *resources.Resource, 1), make(chan error, 1)
	sessionCh, sessionErrCh := make(chan *sessions.Session, 1), make(chan error, 1)
	go func() {
		session, err := s.sessionRepo.FindByToken(ctx, token)
		if err != nil {
			sessionErrCh <- err
			close(sessionCh)
			return
		}
		sessionCh <- session
		close(sessionErrCh)
	}()
	go func() {
		resource, err := s.resourceRepo.FindByHostname(ctx, hostname)
		if err != nil {
			resourceErrCh <- err
			close(resourceCh)
			return
		}
		resourceCh <- resource
		close(resourceErrCh)
	}()
	// If we can't find a resource, we deny the access
	// Otherwise, the access is denied with an error
	if err := <-resourceErrCh; err != nil {
		if isErrNotFound(err) {
			return nil, withErrDeniedAccess(err)
		}
		return nil, err

	}
	resource := <-resourceCh
	// If the found resource is marked as public, we allow the access without condition
	if resource.Public != nil && *resource.Public {
		return nil, nil
	}
	// If no session is found for the token, we initiate a guest session
	// Otherwise, the access is denied with an error
	if err := <-sessionErrCh; err != nil {
		if isErrNotFound(err) {
			return s.authorizeGuestSession(ctx, path, resource.Name)
		}
		return nil, err
	}
	foundSession := <-sessionCh
	// If a session is found, we try to authorize it
	session, err := s.authorizeSession(ctx, path, resource.Name, foundSession)
	if err != nil {
		// If denied, we at least try to authorize as guest
		if isErrDeniedAccess(err) {
			if _, err := s.authorizeGuestSession(ctx, path, resource.Name); err != nil {
				return nil, err
			}
			return foundSession, nil
		}
		return nil, err
	}
	// If found, we return it
	return session, nil
}
385956
func (s *CreatePresignedNotebookInstanceUrlOutput) SetAuthorizedUrl(v string) *CreatePresignedNotebookInstanceUrlOutput {
	s.AuthorizedUrl = &v
	return s
}
38786
func (s *AuthorizationService) FindAuthorizationByID(ctx context.Context, id platform.ID) (*platform.Authorization, error) {
	u, err := newURL(s.Addr, authorizationIDPath(id))
	if err != nil {
		return nil, err
	}

	req, err := http.NewRequest("GET", u.String(), nil)
	if err != nil {
		return nil, err
	}
	SetToken(s.Token, req)

	hc := newClient(u.Scheme, s.InsecureSkipVerify)
	resp, err := hc.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()

	if err := CheckError(resp); err != nil {
		return nil, err
	}

	var b platform.Authorization
	if err := json.NewDecoder(resp.Body).Decode(&b); err != nil {
		return nil, err
	}

	return &b, nil
}
301668
func (s *GetAuthorizerInput) SetAuthorizerId(v string) *GetAuthorizerInput {
	s.AuthorizerId = &v
	return s
}
1003992
func (s *Service) FindAuthorizationByToken(ctx context.Context, t string) (*platform.Authorization, error) {
	var err error
	op := OpPrefix + platform.OpFindAuthorizationByToken
	var n int
	var as []*platform.Authorization
	as, n, err = s.FindAuthorizations(ctx, platform.AuthorizationFilter{Token: &t})
	if err != nil {
		return nil, &platform.Error{
			Err: err,
			Op:  op,
		}
	}
	if n < 1 {
		return nil, &platform.Error{
			Code: platform.ENotFound,
			Msg:  "authorization not found",
			Op:   op,
		}
	}
	return as[0], nil
}
1161121
func (o *OIDCAuthenticator) AuthenticateToken(ctx context.Context, rawtoken string) (*Claims, error) {
	idToken, err := o.verifier.Verify(ctx, rawtoken)
	if err != nil {
		return nil, fmt.Errorf("Token failed validation: %v", err)
	}

	// Check for required claims
	var claims map[string]interface{}
	if err := idToken.Claims(&claims); err != nil {
		return nil, fmt.Errorf("Unable to get claim map from token: %v", err)
	}
	for _, requiredClaim := range requiredClaims {
		if _, ok := claims[requiredClaim]; !ok {
			// Claim missing
			return nil, fmt.Errorf("Required claim %v missing from token", requiredClaim)
		}
	}

	return o.parseClaims(claims)
}
1267066
func (s *TestInvokeAuthorizerOutput) SetAuthorization(v map[string][]*string) *TestInvokeAuthorizerOutput {
	s.Authorization = v
	return s
}
1370795
func BearerToken(token string) runtime.ClientAuthInfoWriter {
	return runtime.ClientAuthInfoWriterFunc(func(r runtime.ClientRequest, _ strfmt.Registry) error {
		return r.SetHeaderParam("Authorization", "Bearer "+token)
	})
}
714547
func (s *CreateRouteOutput) SetAuthorizerId(v string) *CreateRouteOutput {
	s.AuthorizerId = &v
	return s
}
1197003
func Token(ctx context.Context) *AuthorizationToken {
	v := ctx.Value(tokenIndex)
	if v == nil {
		return nil
	}
	return v.(*AuthorizationToken)
}
126515
func (c *VaultClient) TokenAuth(token string) error {
	c.token = token
	c.client.SetToken(token)
	ta := c.client.Auth().Token()
	var err error
	for i := 0; i < authretries; i++ {
		_, err = ta.LookupSelf()
		if err == nil {
			break
		}
		log.Printf("Token auth failed: %v, retrying (%v/%v)", err, i+1, authretries)
		time.Sleep(retrydelayseconds * time.Second)
	}
	if err != nil {
		return fmt.Errorf("error performing auth call to Vault (retries exceeded): %v", err)
	}
	return nil
}
797341
func AuthorizedWhereOrg(a Authorizer, org string) func(DocumentIndex, DocumentDecorator) ([]ID, error) {
	return func(idx DocumentIndex, _ DocumentDecorator) ([]ID, error) {
		oid, err := idx.FindOrganizationByName(org)
		if err != nil {
			return nil, err
		}
		return authorizedWhereOrgID(a, oid, idx)
	}
}