// authorizeCharmStoreEntity acquires and return the charm store delegatable macaroon to be
// used to add the charm corresponding to the given URL.
// The macaroon is properly attenuated so that it can only be used to deploy
// the given charm URL.
556548
func authorizeCharmStoreEntity(csClient charmstoreForDeploy, curl *charm.URL) (*macaroon.Macaroon, error) {
	endpoint := "/delegatable-macaroon?id=" + url.QueryEscape(curl.String())
	var m *macaroon.Macaroon
	if err := csClient.Get(endpoint, &m); err != nil {
		return nil, errors.Trace(err)
	}
	return m, nil
}
1053498
func ReadCharmFromStorage(store storage.Storage, dataDir, storagePath string) (string, error) {
	// Ensure the working directory exists.
	tmpDir := filepath.Join(dataDir, "charm-get-tmp")
	if err := os.MkdirAll(tmpDir, 0755); err != nil {
		return "", errors.Annotate(err, "cannot create charms tmp directory")
	}

	// Use the storage to retrieve and save the charm archive.
	reader, _, err := store.Get(storagePath)
	if err != nil {
		return "", errors.Annotate(err, "cannot get charm from model storage")
	}
	defer reader.Close()

	charmFile, err := ioutil.TempFile(tmpDir, "charm")
	if err != nil {
		return "", errors.Annotate(err, "cannot create charm archive file")
	}
	if _, err = io.Copy(charmFile, reader); err != nil {
		cleanupFile(charmFile)
		return "", errors.Annotate(err, "error processing charm archive download")
	}
	charmFile.Close()
	return charmFile.Name(), nil
}
1338347
func (a *Application) storageConstraintsKey() string {
	return applicationStorageConstraintsKey(a.doc.Name, a.doc.CharmURL)
}
1370918
func ReadCharmURL(path string) (*charm.URL, error) {
	surl := ""
	if err := utils.ReadYaml(path, &surl); err != nil {
		return nil, err
	}
	return charm.ParseURL(surl)
}
1147254
func newCharmStoreResourceDoc(res charmStoreResource) *resourceDoc {
	fullID := charmStoreResourceID(res.id)
	return charmStoreResource2Doc(fullID, res)
}
914310
func (m *MockState) PrepareStoreCharmUpload(arg0 *charm_v6.URL) (application.StateCharm, error) {
	ret := m.ctrl.Call(m, "PrepareStoreCharmUpload", arg0)
	ret0, _ := ret[0].(application.StateCharm)
	ret1, _ := ret[1].(error)
	return ret0, ret1
}
674101
func (a *Core) GetKeyAuthorization(token string) (string, error) {
	return a.jws.GetKeyAuthorization(token)
}
608460
func (s *AuthzRoleService) Authorize(ctx context.Context, spaceID string) (bool, error) {
	jwttoken := goajwt.ContextJWT(ctx)
	if jwttoken == nil {
		return false, errors.NewUnauthorizedError("missing token")
	}
	return s.checkRole(ctx, *jwttoken, spaceID)
}
19880
func (r *contextAuthorizer) Authorize(ctx context.Context) (*AuthContext, error) {
	return &r.authContext, nil
}
1057568
func (ac *accessController) Authorized(ctx context.Context, accessItems ...auth.Access) (context.Context, error) {
	challenge := &authChallenge{
		realm:        ac.realm,
		autoRedirect: ac.autoRedirect,
		service:      ac.service,
		accessSet:    newAccessSet(accessItems...),
	}

	req, err := dcontext.GetRequest(ctx)
	if err != nil {
		return nil, err
	}

	parts := strings.Split(req.Header.Get("Authorization"), " ")

	if len(parts) != 2 || strings.ToLower(parts[0]) != "bearer" {
		challenge.err = ErrTokenRequired
		return nil, challenge
	}

	rawToken := parts[1]

	token, err := NewToken(rawToken)
	if err != nil {
		challenge.err = err
		return nil, challenge
	}

	verifyOpts := VerifyOptions{
		TrustedIssuers:    []string{ac.issuer},
		AcceptedAudiences: []string{ac.service},
		Roots:             ac.rootCerts,
		TrustedKeys:       ac.trustedKeys,
	}

	if err = token.Verify(verifyOpts); err != nil {
		challenge.err = err
		return nil, challenge
	}

	accessSet := token.accessSet()
	for _, access := range accessItems {
		if !accessSet.contains(access) {
			challenge.err = ErrInsufficientScope
			return nil, challenge
		}
	}

	ctx = auth.WithResources(ctx, token.resources())

	return auth.WithUser(ctx, auth.UserInfo{Name: token.Claims.Subject}), nil
}
1079446
func (c ChannelAwareFakeClient) UploadCharmWithRevision(id *charm.URL, ch charm.Charm, promulgatedRevision int) error {
	return c.charmstore.UploadCharmWithRevision(id, ch, promulgatedRevision)
}
417738
func (c FakeClient) UploadCharmWithRevision(id *charm.URL, charmData charm.Charm, promulgatedRevision int) error {
	return c.repo.UploadCharmWithRevision(id, charmData, promulgatedRevision)
}
927513
func (a *applicationShim) DefaultCharmConfig() (charm.Settings, error) {
	ch, _, err := a.Charm()
	if err != nil {
		return nil, errors.Trace(err)
	}
	return ch.Config().DefaultSettings(), nil
}
339146
func (c *Charm) UpdateMacaroon(m macaroon.Slice) error {
	info := CharmInfo{
		Charm:       c,
		ID:          c.URL(),
		StoragePath: c.StoragePath(),
		SHA256:      c.BundleSha256(),
		Macaroon:    m,
	}
	ops, err := updateCharmOps(c.st, info, nil)
	if err != nil {
		return errors.Trace(err)
	}
	if err := c.st.db().RunTransaction(ops); err != nil {
		return errors.Trace(err)
	}
	return nil
}
252829
func (r Network_Storage) AllowAccessToReplicantFromHardware(hardwareObjectTemplate *datatypes.Hardware) (resp bool, err error) {
	params := []interface{}{
		hardwareObjectTemplate,
	}
	err = r.Session.DoRequest("SoftLayer_Network_Storage", "allowAccessToReplicantFromHardware", params, &r.Options, &resp)
	return
}
108973
func (n *NodeAuthorizer) authorizeHandler(w http.ResponseWriter, r *http.Request) {
	err := func() error {
		// @check we have a body to read in
		if r.Body == nil {
			w.WriteHeader(http.StatusBadRequest)
			return nil
		}

		// @step: read in the request body
		content, err := ioutil.ReadAll(r.Body)
		defer r.Body.Close()
		if err != nil {
			return err
		}

		address, err := getClientAddress(r.RemoteAddr)
		if err != nil {
			return err
		}

		// @step: construct the node registration request
		req := &NodeRegistration{
			Spec: NodeRegistrationSpec{
				NodeName:   mux.Vars(r)["name"],
				RemoteAddr: address,
				Request:    content,
			},
		}

		// @step: attempt to authorise the request
		if err := n.authorizeNodeRequest(r.Context(), req); err != nil {
			return err
		}

		// @check if the node was denied and if so, 403 it
		if !req.Status.Allowed {
			w.WriteHeader(http.StatusForbidden)
			return nil
		}

		return json.NewEncoder(w).Encode(req)
	}()
	if err != nil {
		utils.Logger.Info("failed to handle node request", zap.Error(err))

		w.WriteHeader(http.StatusInternalServerError)
	}
}
1204931
func (controllerAuthorizer) Authorize(authInfo httpcontext.AuthInfo) error {
	if authInfo.Controller {
		return nil
	}
	return errors.Errorf("%s is not a controller", names.ReadableString(authInfo.Entity.Tag()))
}