// NewGlobalPermission constructs a global permission capable of accessing any resource of type rt.
15005
func NewGlobalPermission(a Action, rt ResourceType) (*Permission, error) {
	p := &Permission{
		Action: a,
		Resource: Resource{
			Type: rt,
		},
	}
	return p, p.Valid()
}
848369
func (st *State) usersPermissions(objectGlobalKey string) ([]*userPermission, error) {
	permissions, closer := st.db().GetCollection(permissionsC)
	defer closer()

	var matchingPermissions []permissionDoc
	findExpr := fmt.Sprintf("^%s#.*$", objectGlobalKey)
	if err := permissions.Find(
		bson.D{{"_id", bson.D{{"$regex", findExpr}}}},
	).All(&matchingPermissions); err != nil {
		return nil, err
	}
	var result []*userPermission
	for _, pDoc := range matchingPermissions {
		result = append(result, &userPermission{doc: pDoc})
	}
	return result, nil
}
710781
func OrgAdminPermissions(orgID ID) []Permission {
	ps := []Permission{}
	for _, r := range OrgResources {
		for _, a := range actions {
			ps = append(ps, Permission{ID: &orgID, Action: a, Resource: r})
		}
	}

	return ps
}
135601
func AuthUserUserPermissionByUserIDPermissionID(db XODB, userID float64, permissionID float64) (*AuthUserUserPermission, error) {
	var err error

	// sql query
	const sqlstr = `SELECT ` +
		`id, user_id, permission_id ` +
		`FROM django.auth_user_user_permissions ` +
		`WHERE user_id = :1 AND permission_id = :2`

	// run query
	XOLog(sqlstr, userID, permissionID)
	auup := AuthUserUserPermission{
		_exists: true,
	}

	err = db.QueryRow(sqlstr, userID, permissionID).Scan(&auup.ID, &auup.UserID, &auup.PermissionID)
	if err != nil {
		return nil, err
	}

	return &auup, nil
}
510758
func (auup *AuthUserUserPermission) AuthPermission(db XODB) (*AuthPermission, error) {
	return AuthPermissionByID(db, auup.PermissionID)
}
1214810
func (s *S3Grant) SetPermission(v string) *S3Grant {
	s.Permission = &v
	return s
}
943820
func AuthGroupPermissionByGroupIDPermissionID(db XODB, groupID float64, permissionID float64) (*AuthGroupPermission, error) {
	var err error

	// sql query
	const sqlstr = `SELECT ` +
		`id, group_id, permission_id ` +
		`FROM django.auth_group_permissions ` +
		`WHERE group_id = :1 AND permission_id = :2`

	// run query
	XOLog(sqlstr, groupID, permissionID)
	agp := AuthGroupPermission{
		_exists: true,
	}

	err = db.QueryRow(sqlstr, groupID, permissionID).Scan(&agp.ID, &agp.GroupID, &agp.PermissionID)
	if err != nil {
		return nil, err
	}

	return &agp, nil
}
556452
func (m *MockLambdaAPI) AddPermission(arg0 *lambda.AddPermissionInput) (*lambda.AddPermissionOutput, error) {
	ret := m.ctrl.Call(m, "AddPermission", arg0)
	ret0, _ := ret[0].(*lambda.AddPermissionOutput)
	ret1, _ := ret[1].(error)
	return ret0, ret1
}
571562
func NewGlobal(conf *Config, sink MetricSink) (*Metrics, error) {
	metrics, err := New(conf, sink)
	if err == nil {
		globalMetrics.Store(metrics)
	}
	return metrics, err
}
1368198
func WriteGlobalConfig(config *GlobalConfig) error {
	task := "Write the global configuration file"

	// Get the global configuration file absolute path.
	path, err := GlobalConfigFileAbsolutePath()
	if err != nil {
		return errs.NewError(task, err)
	}

	// Write the file.
	if err := writeConfig(path, config, 0644); err != nil {
		return errs.NewError(task, err)
	}

	return nil
}
933063
func (e *Env) DeleteGlobal(k string) error {
	if e.parent == nil {
		return e.Delete(k)
	}

	e.RLock()
	_, ok := e.env[k]
	e.RUnlock()

	if ok {
		return e.Delete(k)
	}

	return e.parent.DeleteGlobal(k)
}
948055
func (st *State) UserPermission(subject names.UserTag, target names.Tag) (permission.Access, error) {
	if err := st.userMayHaveAccess(subject); err != nil {
		return "", errors.Trace(err)
	}

	switch target.Kind() {
	case names.ModelTagKind, names.ControllerTagKind:
		access, err := st.UserAccess(subject, target)
		if err != nil {
			return "", errors.Trace(err)
		}
		return access.Access, nil
	case names.ApplicationOfferTagKind:
		offerUUID, err := applicationOfferUUID(st, target.Id())
		if err != nil {
			return "", errors.Trace(err)
		}
		return st.GetOfferAccess(offerUUID, subject)
	case names.CloudTagKind:
		return st.GetCloudAccess(target.Id(), subject)
	default:
		return "", errors.NotValidf("%q as a target", target.Kind())
	}
}
404523
func (s *GlobalTableDescription) SetGlobalTableStatus(v string) *GlobalTableDescription {
	s.GlobalTableStatus = &v
	return s
}
1054825
func CreateAdmissionReview(attr *generic.VersionedAttributes) admissionv1beta1.AdmissionReview {
	gvk := attr.GetKind()
	gvr := attr.GetResource()
	aUserInfo := attr.GetUserInfo()
	userInfo := authenticationv1.UserInfo{
		Extra:    make(map[string]authenticationv1.ExtraValue),
		Groups:   aUserInfo.GetGroups(),
		UID:      aUserInfo.GetUID(),
		Username: aUserInfo.GetName(),
	}
	dryRun := attr.IsDryRun()

	// Convert the extra information in the user object
	for key, val := range aUserInfo.GetExtra() {
		userInfo.Extra[key] = authenticationv1.ExtraValue(val)
	}

	return admissionv1beta1.AdmissionReview{
		Request: &admissionv1beta1.AdmissionRequest{
			UID: uuid.NewUUID(),
			Kind: metav1.GroupVersionKind{
				Group:   gvk.Group,
				Kind:    gvk.Kind,
				Version: gvk.Version,
			},
			Resource: metav1.GroupVersionResource{
				Group:    gvr.Group,
				Resource: gvr.Resource,
				Version:  gvr.Version,
			},
			SubResource: attr.GetSubresource(),
			Name:        attr.GetName(),
			Namespace:   attr.GetNamespace(),
			Operation:   admissionv1beta1.Operation(attr.GetOperation()),
			UserInfo:    userInfo,
			Object: runtime.RawExtension{
				Object: attr.VersionedObject,
			},
			OldObject: runtime.RawExtension{
				Object: attr.VersionedOldObject,
			},
			DryRun: &dryRun,
		},
	}
}
1372869
func (o *GatewaySecurity) CreateGlobalMetadata(child *GlobalMetadata) *bambou.Error {

	return bambou.CurrentSession().CreateChild(o, child)
}
750024
func validatePermission(permission string) error {
	switch permission {
	case "public-read":
		return nil
	case "private":
		return nil
	case "public-read-write":
		return nil
	case "authenticated-read":
		return nil
	case "bucket-owner-read":
		return nil
	case "bucket-owner-full-control":
		return nil
	}
	return fmt.Errorf("unsupported permission: %q", permission)
}
336438
func NewRestrictedEndpointsAdmission(restrictedNetworks []*net.IPNet) *restrictedEndpointsAdmission {
	return &restrictedEndpointsAdmission{
		Handler:            admission.NewHandler(admission.Create, admission.Update),
		restrictedNetworks: restrictedNetworks,
	}
}