// applyResourcePolicy checks whether the resource class matches what has
// been authorized and allowed by the policy configuration.
162136
func (imh *manifestHandler) applyResourcePolicy(manifest distribution.Manifest) error {
	allowedClasses := imh.App.Config.Policy.Repository.Classes
	if len(allowedClasses) == 0 {
		return nil
	}

	var class string
	switch m := manifest.(type) {
	case *schema1.SignedManifest:
		class = imageClass
	case *schema2.DeserializedManifest:
		switch m.Config.MediaType {
		case schema2.MediaTypeImageConfig:
			class = imageClass
		case schema2.MediaTypePluginConfig:
			class = "plugin"
		default:
			return errcode.ErrorCodeDenied.WithMessage("unknown manifest class for " + m.Config.MediaType)
		}
	case *ocischema.DeserializedManifest:
		switch m.Config.MediaType {
		case v1.MediaTypeImageConfig:
			class = imageClass
		default:
			return errcode.ErrorCodeDenied.WithMessage("unknown manifest class for " + m.Config.MediaType)
		}
	}

	if class == "" {
		return nil
	}

	// Check to see if class is allowed in registry
	var allowedClass bool
	for _, c := range allowedClasses {
		if class == c {
			allowedClass = true
			break
		}
	}
	if !allowedClass {
		return errcode.ErrorCodeDenied.WithMessage(fmt.Sprintf("registry does not allow %s manifest", class))
	}

	resources := auth.AuthorizedResources(imh)
	n := imh.Repository.Named().Name()

	var foundResource bool
	for _, r := range resources {
		if r.Name == n {
			if r.Class == "" {
				r.Class = imageClass
			}
			if r.Class == class {
				return nil
			}
			foundResource = true
		}
	}

	// resource was found but no matching class was found
	if foundResource {
		return errcode.ErrorCodeDenied.WithMessage(fmt.Sprintf("repository not authorized for %s manifest", class))
	}

	return nil

}
1356366
func ValidatePolicy(policy string) error {
	_, err := casbin.NewEnforcerSafe(newBuiltInModel(), newAdapter("", "", policy))
	if err != nil {
		return fmt.Errorf("policy syntax error: %s", policy)
	}
	return nil
}
582015
func (r *resourceRecordChangeset) Apply() error {
	glog.V(2).Info("applying changes in record change set")
	if r.IsEmpty() {
		glog.V(2).Info("record change set is empty")
		return nil
	}

	if len(r.additions) > 0 {
		for _, rrset := range r.additions {
			err := r.applyResourceRecordSet(rrset)
			if err != nil {
				return fmt.Errorf("failed to apply resource record set: %s, err: %s", rrset.Name(), err)
			}
		}

		glog.V(2).Info("record change set additions complete")
	}

	if len(r.upserts) > 0 {
		for _, rrset := range r.upserts {
			err := r.applyResourceRecordSet(rrset)
			if err != nil {
				return fmt.Errorf("failed to apply resource record set: %s, err: %s", rrset.Name(), err)
			}
		}

		glog.V(2).Info("record change set upserts complete")
	}

	if len(r.removals) > 0 {
		records, err := getRecords(r.client, r.zone.Name())
		if err != nil {
			return err
		}

		for _, record := range r.removals {
			for _, domainRecord := range records {
				if domainRecord.Name == record.Name() {
					err := deleteRecord(r.client, r.zone.Name(), domainRecord.ID)
					if err != nil {
						return fmt.Errorf("failed to delete record: %v", err)
					}
				}
			}
		}

		glog.V(2).Info("record change set removals complete")
	}

	glog.V(2).Info("record change sets successfully applied")
	return nil
}
548986
func (a *AdapterMock) LoadPolicy(model model.Model) error {
	err := a.loadPolicyFile(model, persist.LoadPolicyLine)
	return err
}
405612
func eventSourceMappingPoliciesForResource(resource *resourceRef,
	template *gocf.Template,
	logger *logrus.Logger) ([]spartaIAM.PolicyStatement, error) {

	policyStatements := []spartaIAM.PolicyStatement{}

	if isResolvedResourceType(resource, template, ":dynamodb:", &gocf.DynamoDBTable{}) {
		policyStatements = append(policyStatements, CommonIAMStatements.DynamoDB...)
	} else if isResolvedResourceType(resource, template, ":kinesis:", &gocf.KinesisStream{}) {
		policyStatements = append(policyStatements, CommonIAMStatements.Kinesis...)
	} else if isResolvedResourceType(resource, template, ":sqs:", &gocf.SQSQueue{}) {
		policyStatements = append(policyStatements, CommonIAMStatements.SQS...)
	} else {
		logger.WithFields(logrus.Fields{
			"Resource": resource,
		}).Debug("No additional EventSource IAM permissions found for event type")
	}
	return policyStatements, nil
}
176233
func authorizedForPolicy(info user.Info, namespace string, policyName string, authz authorizer.Authorizer) bool {
	// Check against extensions API group for backward compatibility
	return authorizedForPolicyInAPIGroup(info, namespace, policyName, policy.GroupName, authz) ||
		authorizedForPolicyInAPIGroup(info, namespace, policyName, extensions.GroupName, authz)
}
224044
func (s *LicenseConfigurationUsage) SetResourceType(v string) *LicenseConfigurationUsage {
	s.ResourceType = &v
	return s
}
1093794
func (f RedirectPolicyFunc) Apply(req *http.Request, via []*http.Request) error {
	return f(req, via)
}
143499
func (s *Job) SetResourceType(v string) *Job {
	s.ResourceType = &v
	return s
}
868956
func (s *LoadBalancerTlsCertificate) SetResourceType(v string) *LoadBalancerTlsCertificate {
	s.ResourceType = &v
	return s
}
522657
func (s *Relationship) SetResourceType(v string) *Relationship {
	s.ResourceType = &v
	return s
}
1368058
func AuthorizedResources(ctx context.Context) []Resource {
	if resources, ok := ctx.Value(resourceKey{}).([]Resource); ok {
		return resources
	}

	return nil
}
423049
func (st *State) ApplyOperation(op ModelOperation) error {
	err := st.db().Run(op.Build)
	return op.Done(err)
}
365389
func (s *Scope) SetComplianceResourceTypes(v []*string) *Scope {
	s.ComplianceResourceTypes = v
	return s
}
304769
func (s *GetImportOutput) SetResourceType(v string) *GetImportOutput {
	s.ResourceType = &v
	return s
}
1252540
func (s *EvaluationResultQualifier) SetResourceType(v string) *EvaluationResultQualifier {
	s.ResourceType = &v
	return s
}
601420
func (d *defaultACLProvider) defaultPolicy(resName string, cprovider bool) string {
	var pol string
	if cprovider {
		pol = d.cResourcePolicyMap[resName]
	} else {
		pol = d.pResourcePolicyMap[resName]
	}
	return pol
}