// isAllowed checks to see if the current user has rights to issue a LocalSubjectAccessReview on the namespace they're attempting to access
778002
func (r *REST) isAllowed(user user.Info, rar *authorizationapi.ResourceAccessReview) error {
	localRARAttributes := kauthorizer.AttributesRecord{
		User:            user,
		Verb:            "create",
		Namespace:       rar.Action.Namespace,
		Resource:        "localresourceaccessreviews",
		ResourceRequest: true,
	}
	authorized, reason, err := r.authorizer.Authorize(localRARAttributes)

	if err != nil {
		return kapierrors.NewForbidden(authorization.Resource(localRARAttributes.GetResource()), localRARAttributes.GetName(), err)
	}
	if authorized != kauthorizer.DecisionAllow {
		forbiddenError := kapierrors.NewForbidden(authorization.Resource(localRARAttributes.GetResource()), localRARAttributes.GetName(), errors.New("") /*discarded*/)
		forbiddenError.ErrStatus.Message = reason
		return forbiddenError
	}

	return nil
}
247356
func (dl *DefaultLogger) IsAllowed(loglevel LogLevel) bool {
	return logLevelPriorities[loglevel] >= logLevelPriorities[dl.GetLogLevel()]
}
1115109
func (c *Cache) IsAssumedPod(pod *v1.Pod) (bool, error) {
	return c.IsAssumedPodFunc(pod), nil
}
1055900
func (rulesMap accessRules) isAuthorized(reqs []*requestedAccess) bool {
	for _, req := range reqs {
		// Check rules for resource type and also check wildcard variations
		// see: https://github.com/openshift/origin-web-common/blob/v3.10.0/src/services/authorizationService.js#L156
		res := req.resource
		allRes := &qualifiedResource{res.apiGroup, rulesReviewWildcard}
		allGroup := &qualifiedResource{rulesReviewWildcard, res.resourceType}

		// Check if all requested actions are permitted
		for _, verb := range req.verbs {
			if !containsVerb(rulesMap, res, verb) &&
				!containsVerb(rulesMap, allResAllGroup, verb) &&
				!containsVerb(rulesMap, allRes, verb) &&
				!containsVerb(rulesMap, allGroup, verb) {
				return false
			}
		}
	}
	return true
}
599606
func (s *Server) NewAccountsAllowed() bool {
	s.mu.Lock()
	defer s.mu.Unlock()
	return s.opts.AllowNewAccounts
}
594443
func IsAllowed(c context.Context, project string) (bool, error) {
	switch admin, err := IsAdmin(c); {
	case err != nil:
		return false, err
	case admin:
		return true, nil
	}

	// Get the project, because that's where the ACLs lie.
	err := access.Check(c, backend.AsUser, config.ProjectSet(project))
	innerError := errors.Unwrap(err)

	switch {
	case err == nil:
		return true, nil
	case err == access.ErrNoAccess:
		return false, nil
	case innerError == config.ErrNoConfig:
		return false, grpcutil.NotFoundTag.Apply(err)
	default:
		return false, err
	}
}
560707
func (auth *AuthProxy) IsAllowedIP() (bool, *Error) {
	ip := auth.ctx.Req.RemoteAddr

	if len(strings.TrimSpace(auth.whitelistIP)) == 0 {
		return true, nil
	}

	proxies := strings.Split(auth.whitelistIP, ",")
	var proxyObjs []*net.IPNet
	for _, proxy := range proxies {
		result, err := coerceProxyAddress(proxy)
		if err != nil {
			return false, newError("Could not get the network", err)
		}

		proxyObjs = append(proxyObjs, result)
	}

	sourceIP, _, _ := net.SplitHostPort(ip)
	sourceObj := net.ParseIP(sourceIP)

	for _, proxyObj := range proxyObjs {
		if proxyObj.Contains(sourceObj) {
			return true, nil
		}
	}

	err := fmt.Errorf(
		"Request for user (%s) from %s is not from the authentication proxy", auth.header,
		sourceIP,
	)

	return false, newError("Proxy authentication required", err)
}
885984
func (_m *IdentityDeserializer) IsWellFormed(identity *protosmsp.SerializedIdentity) error {
	ret := _m.Called(identity)

	var r0 error
	if rf, ok := ret.Get(0).(func(*protosmsp.SerializedIdentity) error); ok {
		r0 = rf(identity)
	} else {
		r0 = ret.Error(0)
	}

	return r0
}
288250
func (s *Server) IsACLReplicationEnabled() bool {
	authDC := s.config.ACLDatacenter
	return len(authDC) > 0 && (authDC != s.config.Datacenter) &&
		s.config.ACLTokenReplication
}
128817
func IsGranted(scope string, c echo.Context) bool {
	parts := strings.Split(scope, ":")
	switch parts[0] {
	case "profile_messages", "project_messages":
		return IsGranted("messages:"+parts[1], c)

	case "profile_comments":
		return IsGranted("profile_messages:"+parts[1], c)

	case "project_comments":
		return IsGranted("project_messages:"+parts[1], c)
	}

	scopes := c.Get("scopes").([]string)
	i := sort.SearchStrings(scopes, scope)
	if i < len(scopes) && scopes[i] == scope {
		return true
	}

	scope = "base:" + parts[1]
	i = sort.SearchStrings(scopes, scope)
	return i < len(scopes) && scopes[i] == scope
}
813564
func newLocalSubjectAccessReviews(c *AuthorizationV1Client, namespace string) *localSubjectAccessReviews {
	return &localSubjectAccessReviews{
		client: c.RESTClient(),
		ns:     namespace,
	}
}
1251849
func IsHeldElsewhere(err error) bool {
	if errno, ok := err.(syscall.Errno); ok {
		return errno == syscall.EWOULDBLOCK
	}
	return false
}
462589
func Convert_v1_LocalSubjectAccessReview_To_authorization_LocalSubjectAccessReview(in *v1.LocalSubjectAccessReview, out *authorization.LocalSubjectAccessReview, s conversion.Scope) error {
	return autoConvert_v1_LocalSubjectAccessReview_To_authorization_LocalSubjectAccessReview(in, out, s)
}
232054
func (p *Peer) isAllowedReadError(err error) bool {
	// Only allow read errors in regression test mode.
	if p.cfg.ChainParams.Net != wire.TestNet {
		return false
	}

	// Don't allow the error if it's not specifically a malformed message error.
	if _, ok := err.(*wire.MessageError); !ok {
		return false
	}

	// Don't allow the error if it's not coming from localhost or the
	// hostname can't be determined for some reason.
	host, _, err := net.SplitHostPort(p.addr)
	if err != nil {
		return false
	}

	if host != "127.0.0.1" && host != "localhost" {
		return false
	}

	// Allowed if all checks passed.
	return true
}
414443
func (sys *PolicySys) IsAllowed(args policy.Args) bool {
	sys.RLock()
	defer sys.RUnlock()

	// If policy is available for given bucket, check the policy.
	if p, found := sys.bucketPolicyMap[args.BucketName]; found {
		return p.IsAllowed(args)
	}

	// As policy is not available for given bucket name, returns IsOwner i.e.
	// operation is allowed only for owner.
	return args.IsOwner
}
525612
func (cp *ComparablePrincipal) IsFound(set ...*ComparablePrincipal) bool {
	for _, cp2 := range set {
		if cp.IsA(cp2) {
			return true
		}
	}
	return false
}
419530
func (i *ImportRestriction) isAllowed(packageToCheck string) bool {
	// if its not under our root, then its a built-in.  Everything else is under
	// github.com/openshift/origin or github.com/openshift/origin/vendor
	if !strings.HasPrefix(packageToCheck, rootPackage) {
		return true
	}
	if i.isIncludedInRestrictedPackages(packageToCheck) {
		return true
	}

	for _, forbiddenPackageRoot := range i.ForbiddenImportPackageRoots {
		if strings.HasPrefix(forbiddenPackageRoot, "vendor") {
			forbiddenPackageRoot = rootPackage + "/" + forbiddenPackageRoot
		}
		if strings.HasPrefix(packageToCheck, forbiddenPackageRoot) {
			return false
		}
	}
	for _, allowedPackage := range i.AllowedImportPackages {
		if strings.HasPrefix(allowedPackage, "vendor") {
			allowedPackage = rootPackage + "/" + allowedPackage
		}
		if packageToCheck == allowedPackage {
			return true
		}
	}
	for _, allowedPackageRoot := range i.AllowedImportPackageRoots {
		if strings.HasPrefix(allowedPackageRoot, "vendor") {
			allowedPackageRoot = rootPackage + "/" + allowedPackageRoot
		}
		if strings.HasPrefix(packageToCheck, allowedPackageRoot) {
			return true
		}
	}

	return false
}