Objectify ACL if ES is used or call item.get_acl() if
        db is used.
555981
def item_acl(self, item):
        
        if self.es_based:
            from nefertari_guards.elasticsearch import get_es_item_acl
            return get_es_item_acl(item)
        return super(DatabaseACLMixin, self).item_acl(item)
651734
def user_is(role, get_user=import_user):
    
    def wrapper(func):
        @wraps(func)
        def inner(*args, **kwargs):
            from .models import Role
            current_user = get_user()
            if role in current_user.roles:
                return func(*args, **kwargs)
            raise Forbidden("You do not have access")
        return inner
    return wrapper
1291350
def authorized_for?(obj)
      logger.debug("Checking to see if authorized to access object")
      if @auth_user.nil?
        # :nocov:
        return false
        # :nocov:
      elsif @auth_user.role >= Roles::ADMIN
        return true
      elsif obj.is_a? User
        return obj == @auth_user
      else
        return obj.try(:user) == @auth_user
      end
    end
682297
def meth_set_acl(args):
    
    acl_updates = [{"user": user, "role": args.role} \
                   for user in set(expand_fc_groups(args.users)) \
                   if user != fapi.whoami()]

    id = args.snapshot_id
    if not id:
        # get the latest snapshot_id for this method from the methods repo
        r = fapi.list_repository_methods(namespace=args.namespace,
                                         name=args.method)
        fapi._check_response_code(r, 200)
        versions = r.json()
        if len(versions) == 0:
            if fcconfig.verbosity:
                eprint("method {0}/{1} not found".format(args.namespace,
                                                         args.method))
            return 1
        latest = sorted(versions, key=lambda m: m['snapshotId'])[-1]
        id = latest['snapshotId']

    r = fapi.update_repository_method_acl(args.namespace, args.method, id,
                                          acl_updates)
    fapi._check_response_code(r, 200)
    if fcconfig.verbosity:
        print("Updated ACL for {0}/{1}:{2}".format(args.namespace, args.method,
                                                   id))
    return 0
26569
def _concrete_acl(self, acl_doc):
        
        if not isinstance(acl_doc, dict):
            return None

        # Attempt to instantiate an Acl object with the given dict.
        try:
            return Acl(document=acl_doc, acls=self)

        # If construction fails, log the exception and return None.
        except Exception as ex:
            logger.exception(ex)
            logger.error('Could not instantiate ACL document. You probably need to upgrade to a '
                         'recent version of the client. Document which caused this error: {}'
                         .format(acl_doc))
            return None
1285255
def acls(self):
        """"""
        if self._acls is None:
            self._acls = InstanceAcls(instance=self)
        return self._acls
482494
@SuppressWarnings("checkstyle:rightCurly")
  boolean isAncestor(final ClassLoader cl) {
    ClassLoader acl = this;
    do {
      acl = acl.parent;
      if (Objects.equals(cl, acl)) {
        return true;
      }
    } while (acl != null);
    return false;
  }
1328304
def ApprovalFind(object_id, token=None):
  """"""
  user = getpass.getuser()
  object_id = rdfvalue.RDFURN(object_id)
  try:
    approved_token = security.Approval.GetApprovalForObject(
        object_id, token=token, username=user)
    print("Found token %s" % str(approved_token))
    return approved_token
  except access_control.UnauthorizedAccess:
    print("No token available for access to %s" % object_id)
223128
def _check_acl(self, acl_no, network, netmask):
        
        exp_cfg_lines = ['ip access-list standard ' + str(acl_no),
                         ' permit ' + str(network) + ' ' + str(netmask)]
        ios_cfg = self._get_running_config()
        parse = HTParser(ios_cfg)
        acls_raw = parse.find_children(exp_cfg_lines[0])
        if acls_raw:
            if exp_cfg_lines[1] in acls_raw:
                return True
            LOG.error("Mismatch in ACL configuration for %s", acl_no)
            return False
        LOG.debug("%s is not present in config", acl_no)
        return False
380223
def check_authorized
      if state == :expired
        raise Exceptions::RetryableError, "Authorization expired"
      elsif state != :authorized
        raise Exceptions::Unauthorized, "Not authorized with RightScale" if state != :authorized
      end
      true
    end
877140
private void validateAccessPermissions(ItemState changedItem) throws RepositoryException, AccessDeniedException
   {
      if (changedItem.isAddedAutoCreatedNodes())
      {
         validateAddNodePermission(changedItem);
      }
      else if (changedItem.isDeleted())
      {
         validateRemoveAccessPermission(changedItem);
      }
      else if (changedItem.isMixinChanged())
      {
         validateMixinChangedPermission(changedItem);
      }
      else
      {
         NodeData parent = (NodeData)getItemData(changedItem.getData().getParentIdentifier());
         if (parent != null)
         {
            if (changedItem.getData().isNode())
            {
               // add node
               if (changedItem.isAdded())
               {
                  if (!accessManager.hasPermission(parent.getACL(), new String[]{PermissionType.ADD_NODE}, session
                     .getUserState().getIdentity()))
                  {
                     throw new AccessDeniedException("Access denied: ADD_NODE "
                        + changedItem.getData().getQPath().getAsString() + " for: " + session.getUserID()
                        + " item owner " + parent.getACL().getOwner());
                  }
               }
            }
            else if (changedItem.isAdded() || changedItem.isUpdated())
            {
               // add or update property
               if (!accessManager.hasPermission(parent.getACL(), new String[]{PermissionType.SET_PROPERTY}, session
                  .getUserState().getIdentity()))
               {
                  throw new AccessDeniedException("Access denied: SET_PROPERTY "
                     + changedItem.getData().getQPath().getAsString() + " for: " + session.getUserID() + " item owner "
                     + parent.getACL().getOwner());
               }
            }
         } // else - parent not found, deleted in this session or from another
      }
   }
995670
def _getitem(self, index):
        """"""
        row = self._records[index]
        if row is not None:
            pass
        elif self.is_attached():
            # need to handle negative indices manually
            if index < 0:
                index = len(self._records) + index
            row = next((decode_row(line)
                        for i, line in self._enum_lines()
                        if i == index),
                       None)
            if row is None:
                raise ItsdbError('could not retrieve row in attached table')
        else:
            raise ItsdbError('invalid row in detached table: {}'.format(index))

        return Record._make(self.fields, row, self, index)
60239
def _HasAccessToClient(self, subject, token):
    """"""
    client_id, _ = rdfvalue.RDFURN(subject).Split(2)
    client_urn = rdf_client.ClientURN(client_id)

    return self.CheckClientAccess(token, client_urn)
918318
def check_generic_request(self, item_session: ItemSession) -> Tuple[bool, str]:
        '''
        '''
        verdict, reason, test_info = self.consult_filters(
            item_session.request.url_info,
            item_session.url_record)

        verdict, reason = self.consult_hook(item_session, verdict,
                                            reason, test_info)

        return verdict, reason
683091
def check(self, user, permission, obj=_nothing):
        
        if not self.allows(user, permission, obj):
            raise AuthorizationError(
                'Can\'t {} object of class {}'.format(
                    permission, type(obj)))
1234673
function _(obj, prop, options) {
    if (obj == null) {
      return obj;
    }

    return getAccessorData(obj[prop], options.context);
  }
1248659
public AccessControlList getACL(QPath path) throws RepositoryException
   {
      long start = 0;
      if (LOG.isDebugEnabled())
      {
         start = System.currentTimeMillis();
         LOG.debug("getACL(" + path.getAsString() + " ) >>>>>");
      }

      try
      {
         NodeData parent = (NodeData)getItemData(Constants.ROOT_UUID);
         if (path.equals(Constants.ROOT_PATH))
         {
            return parent.getACL();
         }

         ItemData item = null;
         QPathEntry[] relPathEntries = path.getRelPath(path.getDepth());
         for (int i = 0; i < relPathEntries.length; i++)
         {
            if (i == relPathEntries.length - 1)
            {
               item = getItemData(parent, relPathEntries[i], ItemType.NODE);
            }
            else
            {
               item = getItemData(parent, relPathEntries[i], ItemType.UNKNOWN);
            }

            if (item == null)
            {
               break;
            }

            if (item.isNode())
            {
               parent = (NodeData)item;
            }
            else if (i < relPathEntries.length - 1)
            {
               throw new IllegalPathException("Get ACL. Path can not contains a property as the intermediate element");
            }
         }

         if (item != null && item.isNode())
         {
            // node ACL
            return ((NodeData)item).getACL();
         }
         else
         {
            // item not found or it's a property - return parent ACL
            return parent.getACL();
         }
      }
      finally
      {
         if (LOG.isDebugEnabled())
         {
            LOG.debug("getACL(" + path.getAsString() + ") <<<<< " + ((System.currentTimeMillis() - start) / 1000d)
               + "sec");
         }
      }
   }