// CheckOfferAccessCaveat checks that the specified caveat required to be satisfied
// to gain access to an offer is valid, and returns the attributes return to check
// that the caveat is satisfied.
17501
func (a *AuthContext) CheckOfferAccessCaveat(caveat string) (*offerPermissionCheck, error) {
	op, rest, err := checkers.ParseCaveat(caveat)
	if err != nil {
		return nil, errors.Annotatef(err, "cannot parse caveat %q", caveat)
	}
	if op != offerPermissionCaveat {
		return nil, checkers.ErrCaveatNotRecognized
	}
	var details offerPermissionCheck
	err = yaml.Unmarshal([]byte(rest), &details)
	if err != nil {
		return nil, errors.Trace(err)
	}
	logger.Debugf("offer access caveat details: %+v", details)
	if !names.IsValidModel(details.SourceModelUUID) {
		return nil, errors.NotValidf("source-model-uuid %q", details.SourceModelUUID)
	}
	if !names.IsValidUser(details.User) {
		return nil, errors.NotValidf("username %q", details.User)
	}
	if err := permission.ValidateOfferAccess(permission.Access(details.Permission)); err != nil {
		return nil, errors.NotValidf("permission %q", details.Permission)
	}
	return &details, nil
}
9124
func (c *aclCheckerV1) getAccessControl(
	parentAC *accessControlV1, p string) (ac *accessControlV1) {
	effectiveAC := c.ac
	if c.ac == nil {
		// If c.ac == nil, it means user didn't specify an ACL for the
		// path that c represents. So just inherit from the parent.
		effectiveAC = parentAC
	}
	elems := cleanPathAndSplit2(p)
	if len(elems[0]) == 0 || c.children == nil {
		// Either what we are looking for is exactly what c represents, or c
		// doesn't have any children *aclCheckerV1's. Either way, c should be
		// the checker that controls the path p, so we can just returned the
		// current effectiveAC.
		return effectiveAC
	}
	// See if we have a sub-checker for the next element in the path p.
	if subChecker, ok := c.children[elems[0]]; ok {
		if len(elems) > 1 {
			// There are more elements in the path p, so ask the sub-checker
			// for check for the rest.
			return subChecker.getAccessControl(effectiveAC, elems[1])
		}
		// The sub-checker is what we need in order to know get the
		// *accessControlV1 for path p, so call it with "." to indicate that.
		return subChecker.getAccessControl(effectiveAC, ".")
	}

	// We don't have a sub-checker for the next element in the path p, so just
	// use the current effectiveAC like the `len(elems[0]) == 0 || c.children
	// == nil` above.
	return effectiveAC
}
574436
func (*denyAuthenticator) AuthenticateAssertion(assertionType, data string) (*authenticator.Response, bool, error) {
	return nil, false, nil
}
880050
func checkPropsExist(loginDoc map[string]interface{}) error {
	// Make sure the user provides a username
	id, ok := loginDoc["username"].(string)
	if ok != true {
		return errors.New("Need username to login")
	} else if len(id) < variables.ShortestUsername {
		// FIXME: Make concatination constant
		return errors.New("Username must be at least " + strconv.Itoa(variables.ShortestUsername))
	}
	// Make sure the user provides a password
	password, ok := loginDoc["password"].(string)
	if ok != true {
		return errors.New("Need password to login")
	} else if len(password) < variables.ShortestPassword {
		// FIXME: Make concatination constant
		return errors.New("Password must be at least " + strconv.Itoa(variables.ShortestPassword))
	}
	return nil
}
1001717
func (cache *schedCache) getOffer(offerId *mesos.OfferID) *cachedOffer {
	if offerId == nil {
		log.V(3).Infoln("WARN: OfferId == nil, returning nil")
		return nil
	}
	cache.lock.RLock()
	defer cache.lock.RUnlock()
	return cache.savedOffers[offerId.GetValue()]
}
788746
func (c *Client) GrantOffer(user, access string, offerURLs ...string) error {
	return c.modifyOfferUser(params.GrantOfferAccess, user, access, offerURLs)
}
1084224
func checkAffinity(ctx Context, operand string, lVal, rVal interface{}, lFound, rFound bool) bool {
	return checkConstraint(ctx, operand, lVal, rVal, lFound, rFound)
}
240117
func (v *VPCRouter) HasRemoteAccessUsers() bool {
	return v.HasSetting() && v.Settings.Router.HasRemoteAccessUsers()
}
1176381
func (c *Config) CheckACL() error {
	switch c.ACLDefaultPolicy {
	case "allow":
	case "deny":
	default:
		return fmt.Errorf("Unsupported default ACL policy: %s", c.ACLDefaultPolicy)
	}
	switch c.ACLDownPolicy {
	case "allow":
	case "deny":
	case "async-cache", "extend-cache":
	default:
		return fmt.Errorf("Unsupported down ACL policy: %s", c.ACLDownPolicy)
	}
	return nil
}
1139687
func (r Account_PersonalData_RemoveRequestReview) GetAuthorizationUrl() (resp string, err error) {
	err = r.Session.DoRequest("SoftLayer_Account_PersonalData_RemoveRequestReview", "getAuthorizationUrl", nil, &r.Options, &resp)
	return
}
464576
func (r Account_ProofOfConcept) GetReviewerEmailFromAccessToken(accessToken *string) (resp string, err error) {
	params := []interface{}{
		accessToken,
	}
	err = r.Session.DoRequest("SoftLayer_Account_ProofOfConcept", "getReviewerEmailFromAccessToken", params, &r.Options, &resp)
	return
}
647655
func GetOauthSecret(service string) (string, error) {
	session := db.GetSession()
	defer session.Close()

	config := globalconfig.NewManager()
	globalconfig.InitModels()
	secretModel, err := config.GetByKey(service + "-secret")
	if err != nil {
		log.Errorf("No Oauth secret found for %s. Please insert it into the collection globalconfig with key %s-secret",
			service, service)
	}
	return secretModel.Value, err
}
423354
func processFeeUpdate(feeUpdate *PaymentDescriptor, nextHeight uint64,
	remoteChain bool, mutateState bool, view *htlcView) {

	// Fee updates are applied for all commitments after they are
	// sent/received, so we consider them being added and removed at the
	// same height.
	var addHeight *uint64
	var removeHeight *uint64
	if remoteChain {
		addHeight = &feeUpdate.addCommitHeightRemote
		removeHeight = &feeUpdate.removeCommitHeightRemote
	} else {
		addHeight = &feeUpdate.addCommitHeightLocal
		removeHeight = &feeUpdate.removeCommitHeightLocal
	}

	if *addHeight != 0 {
		return
	}

	// If the update wasn't already locked in, update the current fee rate
	// to reflect this update.
	view.feePerKw = SatPerKWeight(feeUpdate.Amount.ToSatoshis())

	if mutateState {
		*addHeight = nextHeight
		*removeHeight = nextHeight
	}
}
825889
func (r Account_ProofOfConcept) GetTotalRequestsPendingOverThresholdReviewCount() (resp int, err error) {
	err = r.Session.DoRequest("SoftLayer_Account_ProofOfConcept", "getTotalRequestsPendingOverThresholdReviewCount", nil, &r.Options, &resp)
	return
}
339271
func (c *AuthPreferenceV2) CheckAndSetDefaults() error {
	// if nothing is passed in, set defaults
	if c.Spec.Type == "" {
		c.Spec.Type = teleport.Local
	}
	if c.Spec.SecondFactor == "" {
		c.Spec.SecondFactor = teleport.OTP
	}

	// make sure type makes sense
	switch c.Spec.Type {
	case teleport.Local, teleport.OIDC, teleport.SAML, teleport.Github:
	default:
		return trace.BadParameter("authentication type %q not supported", c.Spec.Type)
	}

	// make sure second factor makes sense
	switch c.Spec.SecondFactor {
	case teleport.OFF, teleport.OTP, teleport.U2F:
	default:
		return trace.BadParameter("second factor type %q not supported", c.Spec.SecondFactor)
	}

	return nil
}
140573
func (w *WalletKit) EstimateFee(ctx context.Context,
	req *EstimateFeeRequest) (*EstimateFeeResponse, error) {

	switch {
	// A confirmation target of zero doesn't make any sense. Similarly, we
	// reject confirmation targets of 1 as they're unreasonable.
	case req.ConfTarget == 0 || req.ConfTarget == 1:
		return nil, fmt.Errorf("confirmation target must be greater " +
			"than 1")
	}

	satPerKw, err := w.cfg.FeeEstimator.EstimateFeePerKW(
		uint32(req.ConfTarget),
	)
	if err != nil {
		return nil, err
	}

	return &EstimateFeeResponse{
		SatPerKw: int64(satPerKw),
	}, nil
}
757363
func (c *Core) RekeyVerifyRestart(recovery bool) logical.HTTPCodedError {
	c.stateLock.RLock()
	defer c.stateLock.RUnlock()
	if c.Sealed() {
		return logical.CodedError(http.StatusServiceUnavailable, consts.ErrSealed.Error())
	}
	if c.standby {
		return logical.CodedError(http.StatusBadRequest, consts.ErrStandby.Error())
	}

	c.rekeyLock.Lock()
	defer c.rekeyLock.Unlock()

	// Attempt to generate a new nonce, but don't bail if it doesn't succeed
	// (which is extraordinarily unlikely)
	nonce, nonceErr := uuid.GenerateUUID()

	// Clear any progress or config
	if recovery {
		c.recoveryRekeyConfig.VerificationProgress = nil
		if nonceErr == nil {
			c.recoveryRekeyConfig.VerificationNonce = nonce
		}
	} else {
		c.barrierRekeyConfig.VerificationProgress = nil
		if nonceErr == nil {
			c.barrierRekeyConfig.VerificationNonce = nonce
		}
	}

	return nil
}