// Check tests if a given Authority can access the named config set.
557340
func Check(c context.Context, a backend.Authority, configSet config.Set) error {
	if a == backend.AsService {
		return nil
	}

	project := configSet.Project()
	if project == "" {
		// Not a project config set, so neither remaining Authority can access.
		return ErrNoAccess
	}

	// Root project config set, contains project.cfg file that has project ACL
	// definitions.
	projectConfigSet := config.ProjectSet(project)

	// Load the project config. We execute this RPC as the service, not the user,
	// so while this will recurse (and hopefully take advantage of the cache), it
	// will not trigger an infinite access check loop.
	var pcfg configPB.ProjectCfg
	if err := cfgclient.Get(c, cfgclient.AsService, projectConfigSet, cfgclient.ProjectConfigPath,
		textproto.Message(&pcfg), nil); err != nil {
		return errors.Annotate(err, "failed to load %q in %q",
			cfgclient.ProjectConfigPath, projectConfigSet).Err()
	}

	id := identity.AnonymousIdentity
	if a == backend.AsUser {
		id = auth.CurrentIdentity(c)
	}
	checkGroups := make([]string, 0, len(pcfg.Access))
	for _, access := range pcfg.Access {
		if group, ok := trimPrefix(access, "group:"); ok {
			// Check group membership.
			checkGroups = append(checkGroups, group)
		} else {
			// If there is no ":" in the access string, this is a user ACL.
			if strings.IndexRune(access, ':') < 0 {
				access = "user:" + access
			}
			if identity.Identity(access) == id {
				return nil
			}
		}
	}

	// No individual accesses, check groups.
	if len(checkGroups) > 0 {
		switch canAccess, err := auth.IsMember(c, checkGroups...); {
		case err != nil:
			return errors.Annotate(err, "failed to check group membership").Err()
		case canAccess:
			return nil
		}
	}
	return ErrNoAccess
}
118731
func CheckConfig(ctx *context.Context, put *config.Put, kind string) error {

	if put.Target == "" {
		return misconfigured(kind, put, "missing target")
	}

	if put.Name == "" {
		return misconfigured(kind, put, "missing name")
	}

	if put.Mode != ModeArchive && put.Mode != ModeBinary {
		return misconfigured(kind, put, "mode must be 'binary' or 'archive'")
	}

	envName := fmt.Sprintf("%s_%s_SECRET", strings.ToUpper(kind), strings.ToUpper(put.Name))
	if _, ok := ctx.Env[envName]; !ok {
		return misconfigured(kind, put, fmt.Sprintf("missing %s environment variable", envName))
	}

	if put.TrustedCerts != "" && !x509.NewCertPool().AppendCertsFromPEM([]byte(put.TrustedCerts)) {
		return misconfigured(kind, put, "no certificate could be added from the specified trusted_certificates configuration")
	}

	return nil

}
1064897
func (e AuthService) Check() (bool, error) {
	url := "/authentication"

	resp, err := e.client.MakeRequest(
		"GET",
		url,
		0,
		nil,
	)
	if err != nil {
		return false, err
	}
	defer resp.Body.Close()

	switch resp.StatusCode {
	case http.StatusOK:
		return true, nil
	case http.StatusUnauthorized:
		fallthrough
	case http.StatusForbidden:
		return false, nil
	default:
		return false, e.client.handleUnexpectedResponse(resp)
	}
}
448988
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	switch d.Type {
	case "DV", "OV", "EV":
		if d.Cert.IsCA {
			e.Err("Certificate has set CA true")
		}
		if d.Cert.MaxPathLen == 0 && d.Cert.MaxPathLenZero {
			//e.Err("Certificate has set CA true")
		}
		if d.Cert.BasicConstraintsValid {
			//e.Err("Certificate has set CA true")
		}
	}

	return e
}
1030877
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	if len(d.Cert.Subject.CommonName) > 0 {
		suffix, icann := psl.PublicSuffix(strings.ToLower(d.Cert.Subject.CommonName))
		if fmt.Sprintf("*.%s", suffix) == d.Cert.Subject.CommonName || suffix == d.Cert.Subject.CommonName {
			// if there is a dot on the suffix, it must be on the psl
			if icann || strings.Count(suffix, ".") > 0 {
				e.Err("Certificate CommonName %q equals %q from the public suffix list", d.Cert.Subject.CommonName, suffix)
			}
		}
	}

	for _, n := range d.Cert.DNSNames {
		suffix, icann := psl.PublicSuffix(strings.ToLower(n))
		if fmt.Sprintf("*.%s", suffix) == n || suffix == n {
			// if there is a dot on the suffix, it must be on the psl
			if icann || strings.Count(suffix, ".") > 0 {
				e.Err("Certificate subjectAltName %q equals %q from the public suffix list", n, suffix)
			}
		}
	}

	return e
}
1330966
func (s *Server) Check(ctx context.Context, in *healthpb.HealthCheckRequest) (*healthpb.HealthCheckResponse, error) {
	s.mu.Lock()
	defer s.mu.Unlock()
	if servingStatus, ok := s.statusMap[in.Service]; ok {
		return &healthpb.HealthCheckResponse{
			Status: servingStatus,
		}, nil
	}
	return nil, status.Error(codes.NotFound, "unknown service")
}
564704
func checkAdminConfigGetSyntax(ctx *cli.Context) {
	if len(ctx.Args()) == 0 || len(ctx.Args()) > 2 {
		cli.ShowCommandHelpAndExit(ctx, "get", 1) // last argument is exit code
	}
}
1110246
func Check(req *http.Request, username, password string) bool {
	auth := parseAuthorizationHeader(req.Header.Get("Authorization"))
	if auth == nil || auth.username != username {
		return false
	}
	expectedResponse := response(auth, password, req.Method, req.RequestURI)
	return compare(auth.response, expectedResponse)
}
139933
func (ca *CertAuthorityV2) Check() error {
	err := ca.ID().Check()
	if err != nil {
		return trace.Wrap(err)
	}
	_, err = ca.Checkers()
	if err != nil {
		return trace.Wrap(err)
	}
	_, err = ca.Signers()
	if err != nil {
		return trace.Wrap(err)
	}
	// This is to force users to migrate
	if len(ca.Spec.Roles) != 0 && len(ca.Spec.RoleMap) != 0 {
		return trace.BadParameter("should set either 'roles' or 'role_map', not both")
	}
	if err := RoleMap(ca.Spec.RoleMap).Check(); err != nil {
		return trace.Wrap(err)
	}
	return nil
}
513175
func (cd service) Check() error {
	writableErr := neoutils.CheckWritable(cd.conn)
	if writableErr != nil {
		return writableErr
	}

	return neoutils.Check(cd.conn)
}
704749
func (s *SecureConfig) Check(filePath string) (bool, error) {
	if len(s.Checksum) == 0 {
		return false, ErrSecureConfigNoChecksum
	}

	if s.Hash == nil {
		return false, ErrSecureConfigNoHash
	}

	file, err := os.Open(filePath)
	if err != nil {
		return false, err
	}
	defer file.Close()

	_, err = io.Copy(s.Hash, file)
	if err != nil {
		return false, err
	}

	sum := s.Hash.Sum(nil)

	return subtle.ConstantTimeCompare(sum, s.Checksum) == 1, nil
}
501567
func (cg configGroup) checkLimitsForObtainingNewCerts(name string, cfg *Config) error {
	// User can set hard limit for number of certs for the process to issue
	if cfg.OnDemandState.MaxObtain > 0 &&
		atomic.LoadInt32(&cfg.OnDemandState.ObtainedCount) >= cfg.OnDemandState.MaxObtain {
		return fmt.Errorf("%s: maximum certificates issued (%d)", name, cfg.OnDemandState.MaxObtain)
	}

	// Make sure name hasn't failed a challenge recently
	failedIssuanceMu.RLock()
	when, ok := failedIssuance[name]
	failedIssuanceMu.RUnlock()
	if ok {
		return fmt.Errorf("%s: throttled; refusing to issue cert since last attempt on %s failed", name, when.String())
	}

	// Make sure, if we've issued a few certificates already, that we haven't
	// issued any recently
	lastIssueTimeMu.Lock()
	since := time.Since(lastIssueTime)
	lastIssueTimeMu.Unlock()
	if atomic.LoadInt32(&cfg.OnDemandState.ObtainedCount) >= 10 && since < 10*time.Minute {
		return fmt.Errorf("%s: throttled; last certificate was obtained %v ago", name, since)
	}

	// 👍Good to go
	return nil
}
507622
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	if len(d.Cert.ExtKeyUsage) == 0 && len(d.Cert.UnknownExtKeyUsage) == 0 {
		e.Err("Certificate contains no extended key usage")
		return e
	}

	for _, ku := range d.Cert.ExtKeyUsage {
		switch d.Type {
		case "DV", "OV", "EV":
			if ku != x509.ExtKeyUsageServerAuth && ku != x509.ExtKeyUsageClientAuth && ku != x509.ExtKeyUsageMicrosoftServerGatedCrypto {
				e.Err("Certificate contains an extended key usage different from ServerAuth, ClientAuth or ServerGatedCrypto")
				return e
			}
		case "PS":
			if ku != x509.ExtKeyUsageClientAuth && ku != x509.ExtKeyUsageEmailProtection {
				e.Err("Certificate contains an extended key usage different from ClientAuth or EmailProtection")
				return e
			}
		case "CS":
			if ku != x509.ExtKeyUsageCodeSigning {
				e.Err("Certificate contains an extended key usage different from ClientAuth or EmailProtection")
				return e
			}
		}
	}

	if len(d.Cert.UnknownExtKeyUsage) > 0 {
		// encryptedFileSystem 1.3.6.1.4.1.311.10.3.4
		//return fmt.Errorf("%s Certificate contains an unknown extented key usage", d.Type)
	}

	return e
}
1189758
func (u *UpdateRequest) Check() error {
	if err := u.ID.Check(); err != nil {
		return trace.Wrap(err)
	}
	if u.Namespace == "" {
		return trace.BadParameter("missing parameter Namespace")
	}
	if u.TerminalParams != nil {
		_, err := NewTerminalParamsFromInt(u.TerminalParams.W, u.TerminalParams.H)
		if err != nil {
			return trace.Wrap(err)
		}
	}
	return nil
}
359815
func (u *UserV2) Check() error {
	if u.Kind == "" {
		return trace.BadParameter("user kind is not set")
	}
	if u.Version == "" {
		return trace.BadParameter("user version is not set")
	}
	if u.Metadata.Name == "" {
		return trace.BadParameter("user name cannot be empty")
	}
	for _, id := range u.Spec.OIDCIdentities {
		if err := id.Check(); err != nil {
			return trace.Wrap(err)
		}
	}
	return nil
}
688877
func (c *CredentialsStore) Check(username, password string) bool {
	pw, ok := c.store[username]
	if !ok {
		return false
	}
	return password == pw ||
		bcrypt.CompareHashAndPassword([]byte(pw), []byte(password)) == nil
}
585649
func (c *ServiceConfigs) Has(name string) bool {
	c.mu.RLock()
	defer c.mu.RUnlock()
	_, ok := c.m[name]
	return ok
}