// CheckAccessActor uses the current security policy to
// verify if an actor has access to the role.
540328
func CheckAccessActor(actor, role string) error {
	once.Do(savePolicy)
	if currentPolicy != nil {
		return currentPolicy.CheckAccessActor(actor, role)
	}
	return nil
}
1110246
func Check(req *http.Request, username, password string) bool {
	auth := parseAuthorizationHeader(req.Header.Get("Authorization"))
	if auth == nil || auth.username != username {
		return false
	}
	expectedResponse := response(auth, password, req.Method, req.RequestURI)
	return compare(auth.response, expectedResponse)
}
833910
func (s *VPCRouterSetting) FindRemoteAccessUser(userName string, password string) (int, *VPCRouterRemoteAccessUsersConfig) {
	for i, c := range s.RemoteAccessUsers.Config {
		if c.UserName == userName && c.Password == password {
			return i, c
		}
	}
	return -1, nil
}
483981
func (r *CheckCertificateRPC) CheckCertificate(c context.Context, req *admin.CheckCertificateRequest) (*admin.CheckCertificateResponse, error) {
	// Deserialize the cert.
	der, err := utils.ParsePEM(req.CertPem, "CERTIFICATE")
	if err != nil {
		return nil, status.Errorf(codes.InvalidArgument, "can't parse 'cert_pem' - %s", err)
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, status.Errorf(codes.InvalidArgument, "can't parse 'cert-pem' - %s", err)
	}

	// Find a checker for the CA that signed the cert, check the certificate.
	checker, err := GetCertChecker(c, cert.Issuer.CommonName)
	if err == nil {
		_, err = checker.CheckCertificate(c, cert)
		if err == nil {
			return &admin.CheckCertificateResponse{
				IsValid: true,
			}, nil
		}
	}

	// Recognize error codes related to CA cert checking. Everything else is
	// transient errors.
	if details, ok := err.(Error); ok {
		return &admin.CheckCertificateResponse{
			IsValid:       false,
			InvalidReason: details.Error(),
		}, nil
	}
	return nil, status.Errorf(codes.Internal, "failed to check the certificate - %s", err)
}
616030
func (r Account_ProofOfConcept) IsCurrentReviewer(requestId *int, accessToken *string) (resp bool, err error) {
	params := []interface{}{
		requestId,
		accessToken,
	}
	err = r.Session.DoRequest("SoftLayer_Account_ProofOfConcept", "isCurrentReviewer", params, &r.Options, &resp)
	return
}
1098425
func (sp *StandardProvider) Check() error {
	if sp.Paths.KeyFile == "" && sp.Paths.CertFile == "" {
		return nil
	}

	if sp.Paths.KeyFile == "" {
		return ErrMissingKeyPath
	}

	if sp.Paths.CertFile == "" {
		return ErrMissingCertPath
	}

	return nil
}
914869
func checkOptions(options map[string]interface{}) (tokenAccessOptions, error) {
	var opts tokenAccessOptions

	keys := []string{"realm", "issuer", "service", "rootcertbundle"}
	vals := make([]string, 0, len(keys))
	for _, key := range keys {
		val, ok := options[key].(string)
		if !ok {
			return opts, fmt.Errorf("token auth requires a valid option string: %q", key)
		}
		vals = append(vals, val)
	}

	opts.realm, opts.issuer, opts.service, opts.rootCertBundle = vals[0], vals[1], vals[2], vals[3]

	autoRedirectVal, ok := options["autoredirect"]
	if ok {
		autoRedirect, ok := autoRedirectVal.(bool)
		if !ok {
			return opts, fmt.Errorf("token auth requires a valid option bool: autoredirect")
		}
		opts.autoRedirect = autoRedirect
	}

	return opts, nil
}
742338
func (c *accountIDOptions) Check() error {
	_, err := strkey.Decode(strkey.VersionByteAccountID, c.AccountID)
	if err != nil {
		return ErrInvalidAccountID
	}
	return nil
}
1335394
func noAccessErr(c context.Context, prefix string) error {
	return status.Errorf(
		codes.PermissionDenied, "prefix %q doesn't exist or %q is not allowed to see it",
		prefix, auth.CurrentIdentity(c))
}
1064897
func (e AuthService) Check() (bool, error) {
	url := "/authentication"

	resp, err := e.client.MakeRequest(
		"GET",
		url,
		0,
		nil,
	)
	if err != nil {
		return false, err
	}
	defer resp.Body.Close()

	switch resp.StatusCode {
	case http.StatusOK:
		return true, nil
	case http.StatusUnauthorized:
		fallthrough
	case http.StatusForbidden:
		return false, nil
	default:
		return false, e.client.handleUnexpectedResponse(resp)
	}
}
435190
func CheckPermission(e *casbin.Enforcer, r *revel.Request) bool {
	user := GetUserName(r)
	method := r.Method
	path := r.URL.Path
	return e.Enforce(user, path, method)
}
681317
func checkKeyValid(accessKey string) (auth.Credentials, bool, APIErrorCode) {
	var owner = true
	var cred = globalServerConfig.GetCredential()
	if cred.AccessKey != accessKey {
		if globalIAMSys == nil {
			return cred, false, ErrInvalidAccessKeyID
		}
		// Check if the access key is part of users credentials.
		var ok bool
		if cred, ok = globalIAMSys.GetUser(accessKey); !ok {
			return cred, false, ErrInvalidAccessKeyID
		}
		owner = false
	}
	return cred, owner, ErrNone
}
557340
func Check(c context.Context, a backend.Authority, configSet config.Set) error {
	if a == backend.AsService {
		return nil
	}

	project := configSet.Project()
	if project == "" {
		// Not a project config set, so neither remaining Authority can access.
		return ErrNoAccess
	}

	// Root project config set, contains project.cfg file that has project ACL
	// definitions.
	projectConfigSet := config.ProjectSet(project)

	// Load the project config. We execute this RPC as the service, not the user,
	// so while this will recurse (and hopefully take advantage of the cache), it
	// will not trigger an infinite access check loop.
	var pcfg configPB.ProjectCfg
	if err := cfgclient.Get(c, cfgclient.AsService, projectConfigSet, cfgclient.ProjectConfigPath,
		textproto.Message(&pcfg), nil); err != nil {
		return errors.Annotate(err, "failed to load %q in %q",
			cfgclient.ProjectConfigPath, projectConfigSet).Err()
	}

	id := identity.AnonymousIdentity
	if a == backend.AsUser {
		id = auth.CurrentIdentity(c)
	}
	checkGroups := make([]string, 0, len(pcfg.Access))
	for _, access := range pcfg.Access {
		if group, ok := trimPrefix(access, "group:"); ok {
			// Check group membership.
			checkGroups = append(checkGroups, group)
		} else {
			// If there is no ":" in the access string, this is a user ACL.
			if strings.IndexRune(access, ':') < 0 {
				access = "user:" + access
			}
			if identity.Identity(access) == id {
				return nil
			}
		}
	}

	// No individual accesses, check groups.
	if len(checkGroups) > 0 {
		switch canAccess, err := auth.IsMember(c, checkGroups...); {
		case err != nil:
			return errors.Annotate(err, "failed to check group membership").Err()
		case canAccess:
			return nil
		}
	}
	return ErrNoAccess
}
240117
func (v *VPCRouter) HasRemoteAccessUsers() bool {
	return v.HasSetting() && v.Settings.Router.HasRemoteAccessUsers()
}
1218291
func (a *Config) CheckPermission(c echo.Context) bool {
	user := a.GetUserName(c)
	method := c.Request().Method
	path := c.Request().URL.Path
	return a.Enforcer.Enforce(user, path, method)
}
738420
func HasAccess(userID int64, repo *Repository, testMode AccessMode) (bool, error) {
	return hasAccess(x, userID, repo, testMode)
}
1338743
func (c *s3Client) GetAccess() (string, string, *probe.Error) {
	bucket, object := c.url2BucketAndObject()
	if bucket == "" {
		return "", "", probe.NewError(BucketNameEmpty{})
	}
	policyStr, e := c.api.GetBucketPolicy(bucket)
	if e != nil {
		return "", "", probe.NewError(e)
	}
	if policyStr == "" {
		return string(policy.BucketPolicyNone), policyStr, nil
	}
	var p policy.BucketAccessPolicy
	if e = json.Unmarshal([]byte(policyStr), &p); e != nil {
		return "", "", probe.NewError(e)
	}
	pType := string(policy.GetPolicy(p.Statements, bucket, object))
	if pType == string(policy.BucketPolicyNone) && policyStr != "" {
		pType = "custom"
	}
	return pType, policyStr, nil
}