// Helper function to validate subjects, etc for account permissioning.
344180
func checkSubjectArray(sa []string) error {
	for _, s := range sa {
		if !IsValidSubject(s) {
			return fmt.Errorf("subject %q is not a valid subject", s)
		}
	}
	return nil
}
1258188
func GlobalAccountPermissions(getter AccountGetter) permission.AccountPermissions {
	if getter == nil {
		return permission.AccountPermissions{
			Roles: []string{},
		}
	}
	return GlobalPermissionsAccount(getter).Permissions
}
950315
func (m *Permission) Validate() error {
	if m == nil {
		return nil
	}

	switch m.Rule.(type) {

	case *Permission_AndRules:

		{
			tmp := m.GetAndRules()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "AndRules",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	case *Permission_OrRules:

		{
			tmp := m.GetOrRules()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "OrRules",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	case *Permission_Any:

		if m.GetAny() != true {
			return PermissionValidationError{
				field:  "Any",
				reason: "value must equal true",
			}
		}

	case *Permission_Header:

		{
			tmp := m.GetHeader()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "Header",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	case *Permission_DestinationIp:

		{
			tmp := m.GetDestinationIp()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "DestinationIp",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	case *Permission_DestinationPort:

		if m.GetDestinationPort() > 65535 {
			return PermissionValidationError{
				field:  "DestinationPort",
				reason: "value must be less than or equal to 65535",
			}
		}

	case *Permission_Metadata:

		{
			tmp := m.GetMetadata()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "Metadata",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	case *Permission_NotRule:

		{
			tmp := m.GetNotRule()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "NotRule",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	case *Permission_RequestedServerName:

		{
			tmp := m.GetRequestedServerName()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "RequestedServerName",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	default:
		return PermissionValidationError{
			field:  "Rule",
			reason: "value is required",
		}

	}

	return nil
}
657941
func (si SignerInfo) subjectKeyIdentifierSID() ([]byte, error) {
	if si.SID.Class != asn1.ClassContextSpecific || si.SID.Tag != 0 {
		return nil, ErrWrongType
	}

	return si.SID.Bytes, nil
}
448159
func (c *Client) ValidateCredentials(user user.User) (bool, error) {
	result := false
	err := c.call("ValidateCredentials", user, &result)
	return result, err
}
385985
func Convert_authorization_SubjectAccessReview_To_v1beta1_SubjectAccessReview(in *authorization.SubjectAccessReview, out *v1beta1.SubjectAccessReview, s conversion.Scope) error {
	return autoConvert_authorization_SubjectAccessReview_To_v1beta1_SubjectAccessReview(in, out, s)
}
238904
func Convert_rbac_Subject_To_v1_Subject(in *rbac.Subject, out *v1.Subject, s conversion.Scope) error {
	return autoConvert_rbac_Subject_To_v1_Subject(in, out, s)
}
4377
func validateCloudWatchEventPermissionPrincipal(v interface{}, k string) (ws []string, es []error) {
	value := v.(string)
	if !regexp.MustCompile(`^(\d{12}|\*)$`).MatchString(value) {
		es = append(es, fmt.Errorf("%q must be * or a 12 digit AWS account ID", k))
	}
	return
}
539752
func (a *Authorization) Valid() error {
	for _, p := range a.Permissions {
		if p.Resource.OrgID != nil && *p.Resource.OrgID != a.OrgID {
			return &Error{
				Msg:  fmt.Sprintf("permission %s is not for org id %s", p, a.OrgID),
				Code: EInvalid,
			}
		}
	}

	return nil
}
840074
func (r *GetOAuthTokenRequest) Validate() error {
	switch {
	case len(r.Scopes) == 0:
		return errors.New(`field "scopes" is required`)
	case len(r.Secret) == 0:
		return errors.New(`field "secret" is required`)
	case r.AccountID == "":
		return errors.New(`field "account_id" is required`)
	}
	return nil
}
740704
func FilterValidatedEmails(authorizedMails []user.AuthorizationMap, verifiedMails []user.EmailAddress) []user.AuthorizationMap {
	var e []user.AuthorizationMap
	for _, authorizedMail := range authorizedMails {
		for _, verifiedMail := range verifiedMails {
			if authorizedMail.RealLabel == verifiedMail.Label {
				e = append(e, authorizedMail)
				break
			}
		}
	}
	return e
}
636284
func (c *Client) Subjects() (subjects []string, err error) {
	// # List all available subjects
	// GET /subjects
	resp, respErr := c.do(http.MethodGet, subjectsPath, "", nil)
	if respErr != nil {
		err = respErr
		return
	}

	err = c.readJSON(resp, &subjects)
	return
}
39342
func Convert_authorization_SubjectAccessReviewSpec_To_v1_SubjectAccessReviewSpec(in *authorization.SubjectAccessReviewSpec, out *v1.SubjectAccessReviewSpec, s conversion.Scope) error {
	return autoConvert_authorization_SubjectAccessReviewSpec_To_v1_SubjectAccessReviewSpec(in, out, s)
}
355406
func (s *Server) accountClaimUpdate(sub *subscription, subject, reply string, msg []byte) {
	s.mu.Lock()
	defer s.mu.Unlock()
	if !s.eventsEnabled() {
		return
	}
	toks := strings.Split(subject, tsep)
	if len(toks) < accUpdateTokens {
		s.Debugf("Received account claims update on bad subject %q", subject)
		return
	}
	if v, ok := s.accounts.Load(toks[accUpdateAccIndex]); ok {
		s.updateAccountWithClaimJWT(v.(*Account), string(msg))
	}
}
887055
func (c *Client) ListTopicPermissions() (rec []TopicPermissionInfo, err error) {
	req, err := newGETRequest(c, "topic-permissions/")
	if err != nil {
		return []TopicPermissionInfo{}, err
	}

	if err = executeAndParseRequest(c, req, &rec); err != nil {
		return []TopicPermissionInfo{}, err
	}

	return rec, nil
}
1267665
func (m *SubjectAlternateName) Validate() error {
	if m == nil {
		return nil
	}

	switch m.Name.(type) {

	case *SubjectAlternateName_Dns:
		// no validation rules for Dns

	case *SubjectAlternateName_Uri:
		// no validation rules for Uri

	}

	return nil
}
535656
func (a *Account) checkServiceImportAuthorizedNoLock(account *Account, subject string, imClaim *jwt.Import) bool {
	// Find the subject in the services list.
	if a.exports.services == nil || !IsValidLiteralSubject(subject) {
		return false
	}
	return a.checkExportApproved(account, subject, imClaim, a.exports.services)
}