Check if group has the permission for the given object
554188
def has_group_perms(self, perm, obj, approved):
        
        if not self.group:
            return False

        if self.use_smart_cache:
            content_type_pk = Permission.objects.get_content_type(obj).pk

            def _group_has_perms(cached_perms):
                # Check to see if the permission is in the cache.
                return cached_perms.get((
                    obj.pk,
                    content_type_pk,
                    perm,
                    approved,
                ))

            # Check to see if the permission is in the cache.
            return _group_has_perms(self._group_perm_cache)

        # Actually hit the DB, no smart cache used.
        return Permission.objects.group_permissions(
            self.group,
            perm, obj,
            approved,
        ).filter(
            object_id=obj.pk,
        ).exists()
425733
public function userCan($permission, $object, $user = null)
	{
		// if no user is specified, default to the Auth one
		if(is_null($user))
		{
			$user = app('auth')->user();
		}
		
		$adminGroups = $this->groupProvider()->findAdminGroups();
		
		if($adminGroups->count() > 0 && $user->inGroup($adminGroups))
			return true;
		
		// find the exact permission for the object
		$permObject = $this->permission->findByPermissionAndObject($permission, $object);
		
		// if the permission object doesn't exist, then they don't have access
		if(!$permObject)
			return false;
		
		// if the user has direct permission, allow
		$uop = $this->userObjectPermission->findPermission($user, $object, $permObject);
		
		if($uop)
			return true;
		
		// get all the groups that have that specific permission on the object
		$gop = $this->groupObjectPermission->findPermissions($object, $permObject);
		
		// if there are no groups, deny
		if(count($gop) == 0)
			return false;
		
		// get all the relevant groups
		$groups = array();
		foreach($gop as $onePermission)
		{
			$groups[] = $onePermission->getGroup();
		}
		
		// allow or deny based on whether the user is in those groups
		return $user->inGroup($groups);
	}
1209190
def check_permissions(self, request):
        """"""

        if not self.predicates:
            return True

        # All registered authentication predicates must return True
        return all(
            predicate(request, *self.predicates_params[i])
            for i, predicate in enumerate(self.predicates)
        )
1205608
def has_permission(self, request, view):
        
        if not self.global_permissions:
            return True

        serializer_class = view.get_serializer_class()

        assert serializer_class.Meta.model is not None, (
            "global_permissions set to true without a model "
            "set on the serializer for '%s'" % view.__class__.__name__
        )

        model_class = serializer_class.Meta.model

        action_method_name = None
        if hasattr(view, 'action'):
            action = self._get_action(view.action)
            action_method_name = "has_{action}_permission".format(action=action)
            # If the specific action permission exists then use it, otherwise use general.
            if hasattr(model_class, action_method_name):
                return getattr(model_class, action_method_name)(request)

        if request.method in permissions.SAFE_METHODS:
            assert hasattr(model_class, 'has_read_permission'), \
                self._get_error_message(model_class, 'has_read_permission', action_method_name)
            return model_class.has_read_permission(request)
        else:
            assert hasattr(model_class, 'has_write_permission'), \
                self._get_error_message(model_class, 'has_write_permission', action_method_name)
            return model_class.has_write_permission(request)
1007956
def object_permission_set(self):
        '''
        
        '''
        return Or(
            AllowAdmin,
            AllowObjectPermission('team:admin'),
            AllowObjectPermission('org:admin', lambda t: t.organization_id),
            And(
                AllowOnlySafeHttpMethod,
                Or(
                    ObjAttrTrue(
                        lambda r, t: t.users.filter(pk=r.user.pk).exists()),
                    ObjAttrTrue(
                        lambda r, t: t.organization.users.filter(
                            pk=r.user.pk).exists())
                )
            )
        )
5479
def has_permission(self, request, view):
        """"""
        if view.suffix == 'Instance':
            return True

        filter_and_actions = self._get_filter_and_actions(
            request.query_params.get('sign'),
            view.action,
            '{}.{}'.format(
                view.queryset.model._meta.app_label,
                view.queryset.model._meta.model_name
            )
        )
        if not filter_and_actions:
            return False
        if request.method == 'POST':
            for key, value in request.data.iteritems():
                # Do unicode conversion because value will always be a
                # string
                if (key in filter_and_actions['filters'] and not
                        unicode(filter_and_actions['filters'][key]) == unicode(value)):
                    return False
        return True
87337
def group_permissions(self, group, perm, obj, approved=True):
        
        return self.get_for_model(obj).select_related(
            'user', 'group', 'creator').filter(group=group, codename=perm,
                                               approved=approved)
1250289
def get_permissions(self, user, obj=_nothing):
        
        rule = self._get_rule(obj)

        all_permissions = (
            attr[len('can_'):] for attr in dir(rule)
            if attr.startswith('can_')
        )

        return set(
            permission for permission in all_permissions
            if self.allows(user, permission, obj)
        )
944968
def object_permission_set(self):
        ''''''
        return Or(
            AllowOnlySafeHttpMethod,
            AllowAdmin,
            And(
                AllowPermission('org:admin'),
                ObjAttrTrue(lambda _, u: not u.is_superuser),
                ObjAttrTrue(
                    lambda r, _: r.data.get('admin') is not True)
            ),
            And(
                AllowModify,
                ObjAttrTrue(
                    lambda req, user: user == req.user),
                ObjAttrTrue(
                    lambda r, _: r.data.get('admin') is not True)
            ),
        )
803131
def _checkPermissions(self, user, event):
        """"""

        for role in user.account.roles:
            if role in event.roles:
                self.log('Access granted', lvl=verbose)
                return True

        self.log('Access denied', lvl=verbose)
        return False
683091
def check(self, user, permission, obj=_nothing):
        
        if not self.allows(user, permission, obj):
            raise AuthorizationError(
                'Can\'t {} object of class {}'.format(
                    permission, type(obj)))
690957
public boolean hasPermission(Authentication authentication,
                                 Object resource,
                                 Object privilege) {
        boolean logPermission = isLogPermission(resource);
        return checkRole(authentication, privilege, logPermission)
            || checkPermission(authentication, resource, privilege, true, logPermission);
    }
910724
def has_object_permission(self, request, view, obj):
        """"""
        # admins can do anything
        if request.user.is_superuser:
            return True

        # `share` permission is required for editing permissions
        if 'permissions' in view.action:
            self.perms_map['POST'] = ['%(app_label)s.share_%(model_name)s']

        if view.action in ['add_data', 'remove_data']:
            self.perms_map['POST'] = ['%(app_label)s.add_%(model_name)s']

        if hasattr(view, 'get_queryset'):
            queryset = view.get_queryset()
        else:
            queryset = getattr(view, 'queryset', None)

        assert queryset is not None, (
            'Cannot apply DjangoObjectPermissions on a view that '
            'does not set `.queryset` or have a `.get_queryset()` method.'
        )

        model_cls = queryset.model
        user = request.user

        perms = self.get_required_object_permissions(request.method, model_cls)

        if not user.has_perms(perms, obj) and not AnonymousUser().has_perms(perms, obj):
            # If the user does not have permissions we need to determine if
            # they have read permissions to see 403, or not, and simply see
            # a 404 response.

            if request.method in permissions.SAFE_METHODS:
                # Read permissions already checked and failed, no need
                # to make another lookup.
                raise Http404

            read_perms = self.get_required_object_permissions('GET', model_cls)
            if not user.has_perms(read_perms, obj):
                raise Http404

            # Has read permissions.
            return False

        return True
185917
public function check(Permission $permission, TokenInterface $token, $objectLanguage = null)
    {
        $user = $token->getUser();

        $masks = $this->getEffectiveMasks();
        if (isset($masks[$this->userClass][$user->getId()])) {
            if ($masks[$this->userClass][$user->getId()] & $permission->getBit()) {
                return true;
            }
        }
        foreach ($user->getGroups() as $group) {
            if (isset($masks[$this->groupClass][$group->getId()])) {
                if ($masks[$this->groupClass][$group->getId()] & $permission->getBit()) {
                    return true;
                }
            }
        }

        return false;
    }
1080840
function checkGroup(query, group) {
    if (group instanceof Array) {
      // check each condition from group
      for ( var c in group) {
        check(query, group[c]);
      }
    }
  }
479913
def has_permission(self, permission, obj=None):
        
        if not permission:
            logger.warn("None permission is not allowed")
            return False
        if obj is None:
            return check_permission(permission, self.context)
        return check_permission(permission, api.get_object(obj))
430831
private function checkPermission($permission, $object, $options = [], $throwException = false)
    {
        if ('cli' === php_sapi_name()) {
            return true;
        }

        switch ($object) {
            //@todo Remove that line once we can
            case $object instanceof ResourceNode:
              $collection = new ResourceCollection([$object]);
              break;
            case is_array($object):
              $collection = new ObjectCollection($object, $options);
              break;
            default:
              $collection = new ObjectCollection([$object], $options);
        }

        $granted = $this->authorization->isGranted($permission, $collection);

        if (!$granted && $throwException) {
            throw new AccessDeniedException(
                sprintf('Operation "%s" cannot be done on object %s', $permission, get_class($object))
            );
        }

        return $granted;
    }