Does the current user (taken from the request in the context) have
    permission to do the given action on the given item.
346237
def filer_has_permission(context, item, action):
    
    permission_method_name = 'has_{action}_permission'.format(action=action)
    permission_method = getattr(item, permission_method_name, None)
    request = context.get('request')

    if not permission_method or not request:
        return False
    # Call the permission method.
    # This amounts to calling `item.has_X_permission(request)`
    return permission_method(request)
1257039
def has_object_permission(self, request, view, obj=None):
        """"""
        filter_and_actions = self._get_filter_and_actions(
            request.query_params.get('sign'),
            view.action,
            '{}.{}'.format(obj._meta.app_label, obj._meta.model_name))
        if not filter_and_actions:
            return False
        qs = view.queryset.filter(**filter_and_actions['filters'])
        return qs.filter(id=obj.id).exists()
910724
def has_object_permission(self, request, view, obj):
        """"""
        # admins can do anything
        if request.user.is_superuser:
            return True

        # `share` permission is required for editing permissions
        if 'permissions' in view.action:
            self.perms_map['POST'] = ['%(app_label)s.share_%(model_name)s']

        if view.action in ['add_data', 'remove_data']:
            self.perms_map['POST'] = ['%(app_label)s.add_%(model_name)s']

        if hasattr(view, 'get_queryset'):
            queryset = view.get_queryset()
        else:
            queryset = getattr(view, 'queryset', None)

        assert queryset is not None, (
            'Cannot apply DjangoObjectPermissions on a view that '
            'does not set `.queryset` or have a `.get_queryset()` method.'
        )

        model_cls = queryset.model
        user = request.user

        perms = self.get_required_object_permissions(request.method, model_cls)

        if not user.has_perms(perms, obj) and not AnonymousUser().has_perms(perms, obj):
            # If the user does not have permissions we need to determine if
            # they have read permissions to see 403, or not, and simply see
            # a 404 response.

            if request.method in permissions.SAFE_METHODS:
                # Read permissions already checked and failed, no need
                # to make another lookup.
                raise Http404

            read_perms = self.get_required_object_permissions('GET', model_cls)
            if not user.has_perms(read_perms, obj):
                raise Http404

            # Has read permissions.
            return False

        return True
675435
function(objects, user, action, model, body) {
    if (!_.isArray(objects)) {
      return PermissionService.isAllowedToPerformSingle(user.id, action, model, body)(objects);
    }
    return Promise.all(objects.map(PermissionService.isAllowedToPerformSingle(user.id, action, model, body)))
      .then(function (allowedArray) {
        return allowedArray.every(function (allowed) {
          return allowed === true;
        });
      });
  }
575520
def check_permission(self, request, page, permission):
        
        if not getattr(page, "can_" + permission)(request):
            raise PermissionDenied
204869
def has_update_permission(self, request, obj):
        
        perm_string = '%s.change_%s' % (self.model._meta.app_label,
            self.model._meta.object_name.lower()
        )
        return request.user.has_perm(perm_string)
31631
def get(self, request):
        ''''''
        user = request.user
        serializer = PermissionsUserSerializer(
            instance=user, context={'request': request})
        return Response(data=serializer.data)
169981
def run(self, value, errors, request):
        """"""
        thing = super(AccessibleDBThing, self).run(value, errors, request)
        if errors:
            return None
        if not thing.can_access(request.user):
            message = 'Insufficient permissions for {0}'.format(self.param)
            raise HTTPForbidden(message)
        return thing
1309234
def perform_permissions_check(self, user, obj, perms):
        
        return self.request.forum_permission_handler.can_subscribe_to_topic(obj, user)
428607
def has_publish_permission(self, request, obj=None):
        
        # If auto-publishing is enabled, no user has "permission" to publish
        # because it happens automatically
        if is_automatic_publishing_enabled(self.model):
            return False
        user_obj = request.user
        if not user_obj.is_active:
            return False
        if user_obj.is_superuser:
            return True
        # Normal user with `can_publish` permission can always publish
        if user_obj.has_perm('%s.can_publish' % self.opts.app_label):
            return True
        # Normal user with `can_republish` permission can only publish if the
        # item is already published.
        if user_obj.has_perm('%s.can_republish' % self.opts.app_label) and \
                obj and getattr(obj, 'has_been_published', False):
            return True
        # User does not meet any publishing permisison requirements; reject!
        return False
1034061
def _perform_basic_permission_check(self, forum, user, permission):
        
        checker = self._get_checker(user)

        # The action is granted if...
        #     the user is the superuser
        #     the user has the permission to do so
        check = (user.is_superuser or checker.has_perm(permission, forum))
        return check
684378
private boolean authorizedPath(AuthContext context, Path path, String action) {
        Decision evaluate = context.evaluate(
                resourceForPath(path),
                action,
                environmentForPath(path)
        );
        return evaluate.isAuthorized();
    }
219285
public boolean hasPermissionForUser(String user, List<String> permission) {
        return hasPermissionForUser(user, permission.toArray(new String[0]));
    }
834275
def _can_access_request(self):
        
        if self.parent:
            return False

        if not hasattr(self, "context") or not self.context.get("request", None):
            return False

        return self.context["request"].method == "GET"
1369236
def has_permission(cls, user):
        
        # no login is needed, so its always fine
        if not cls.requires_login:
            return True

        # if user is somehow not logged in
        if not user.is_authenticated:
            return False

        # attribute permission_required is mandatory, returns tuple
        perms = cls.get_permission_required()
        # if perms are defined and empty, we skip checking
        if not perms:
            return True

        # get role of user, skip admin role
        role = user.urole.role.name
        if role == cls.ADMIN:
            return True

        # check if at least one permissions is valid
        for permission in perms:
            if cls.check_permission(role, permission):
                return True

        # permission denied
        return False
401817
def perform_permissions_check(self, user, obj, perms):
        
        return self.request.forum_permission_handler.can_delete_post(obj, user)
476668
def has_project_permissions(user: 'User', project: 'Project', request_method: str) -> bool:
    """"""
    # Superusers and the creator is allowed to do everything
    if user.is_staff or user.is_superuser or project.user == user:
        return True

    # Other user
    return request_method in permissions.SAFE_METHODS and project.is_public