Check permissions as we move between object instances.
967397
def cross_boundary(prev_obj, obj):
    
    if prev_obj is None:
        return

    if isinstance(obj, _SecuredAttribute):
        # a secure attribute can live in unsecure class so we have to set
        # while we walk the route
        obj.parent = prev_obj

    if hasattr(prev_obj, '_pecan'):
        if obj not in prev_obj._pecan.get('unlocked', []):
            handle_security(prev_obj)
1047192
def perform_permissions_check(self, user, obj, perms):
        
        return self.request.forum_permission_handler.can_update_topics_to_sticky_topics(obj, user)
1099184
def verify_and_sort_permissions
      # DefaultPermissionSet is allowed to have blank permissions (private joinable), the other models need at least find and view
      self.permissions += [:find, :view] unless is_a?(DefaultPermissionSet)
    
      raise "Invalid permissions: #{(permissions - allowed_permissions).inspect}. Must be one of #{allowed_permissions.inspect}" unless permissions.all? {|permission| allowed_permissions.include? permission}
    
      self.permissions = permissions.uniq.sort_by { |permission| allowed_permissions.index(permission) }
    end
559084
def get_all_permissions(self):
        """"""
        perms = set()
        for role in self.get_user_roles():
            for perm_view in role.permissions:
                t = (perm_view.permission.name, perm_view.view_menu.name)
                perms.add(t)
        return perms
475743
def get_user_permissions(self, user_id):
        """"""
        permissions = self.user_service.getPermissions(id=user_id)
        return sorted(permissions, key=itemgetter('keyName'))
246678
def has_perm(self, user, perm, obj=None):
        """"""
        if not user.is_active:
            return False
        return perm in self.get_all_permissions(user, obj)
753229
def has_object_permission(self, request, view, obj):
        
        # Give permission if we're not protecting this method
        if self.protected_methods and request.method not in self.protected_methods:
            return True

        user = getattr(request, "user", None)

        if not user or user.is_anonymous():
            return False

        if self.require_staff and not user.is_staff:
            return False

        # if they have higher-level privileges we can return true right now
        if user.has_perms(self.permissions):
            return True

        # no? ok maybe they're the author and have appropriate author permissions.
        authors_field = getattr(obj, self.authors_field, None)

        if not authors_field:
            return False

        if self.author_permissions and not user.has_perms(self.author_permissions):
            return False

        return user in authors_field.all()
148891
def check_permission(cls, role, permission):
        
        result = permission in settings.ARCTIC_ROLES[role]
        # will try to call a method with the same name as the permission
        # to enable an object level permission check.
        if result:
            try:
                return getattr(cls, permission)(role)
            except AttributeError:
                pass
        return result
698230
def get_permissions(self):
        
        user_role = self.last_login_role() if self.last_login_role_key else self.role_set[0].role
        return user_role.get_permissions()
999551
def _check_view_permission(self, view):
        
        security = get_service("security")
        return security.has_permission(current_user, view.permission, self.obj)
380689
def perform_permissions_check(self, user, obj, perms):
        
        return self.request.forum_permission_handler.can_move_topics(obj, user)
1259106
def __get_permissions(self, res, **kwargs):
        
        response = res._(**kwargs)
        return response.get('permissions', None)
424554
def has_permissions(self, object, group, operations):
        ''''''
        if self.is_superuser:
            return 1
        else:
            models = self.session.router
            # valid permissions
            query = models.permission.for_object(object, operation=operations)
            objects = models[models.role.permissions.model]
            return objects.filter(role=self.role.query(),
                                  permission=query).count()
268988
def get_permissions(self, obj):
        
        # TODO: Optimize this for bulk running
        filters = {
            'object_pk': obj.id,
            'content_type': ContentType.objects.get_for_model(obj),
            'permission__codename__startswith': 'view',
        }
        return {
            'users': list(
                UserObjectPermission.objects.filter(**filters).distinct('user').values_list('user_id', flat=True)
            ),
            'groups': list(
                GroupObjectPermission.objects.filter(**filters).distinct('group').values_list('group', flat=True)
            ),
            'public': UserObjectPermission.objects.filter(user__username=ANONYMOUS_USER_NAME, **filters).exists(),
        }
9238
def check_permission(self, obj_id, permissions):
        
        response = self._client.session.post(
            '{url}/{id}/permissioncheck'.format(
                url=self.endpoint_url, id=obj_id
            ),
            data={'permissions': permissions}
        )
        return self.process_response(response)
1159861
def get_users_with_permission(obj, permission):
    
    user_model = get_user_model()
    return user_model.objects.filter(
        userobjectpermission__object_pk=obj.pk,
        userobjectpermission__permission__codename=permission,
    ).distinct()
808897
private static void checkPermission(final Subject user, 
                                      final Permission... permissions) 
  throws AuthorizationException {
    try{
      Subject.doAs(user, 
                   new PrivilegedExceptionAction<Void>() {
                     @Override
                     public Void run() throws Exception {
                       try {
                         for(Permission permission : permissions) {
                           AccessController.checkPermission(permission);
                         }
                       } catch (AccessControlException ace) {
                         LOG.info("Authorization failed for " + 
                                  UserGroupInformation.getCurrentUGI(), ace);
                         throw new AuthorizationException(ace);
                       }
                      return null;
                     }
                   }
                  );
    } catch (PrivilegedActionException e) {
      throw new AuthorizationException(e.getException());
    }
  }