// RoleForUser creates an admin role for a services.User.
171004
func RoleForUser(u User) Role {
	return &RoleV3{
		Kind:    KindRole,
		Version: V3,
		Metadata: Metadata{
			Name:      RoleNameForUser(u.GetName()),
			Namespace: defaults.Namespace,
		},
		Spec: RoleSpecV3{
			Options: RoleOptions{
				CertificateFormat: teleport.CertificateFormatStandard,
				MaxSessionTTL:     NewDuration(defaults.MaxCertDuration),
				PortForwarding:    NewBoolOption(true),
				ForwardAgent:      NewBool(true),
			},
			Allow: RoleConditions{
				Namespaces: []string{defaults.Namespace},
				NodeLabels: Labels{Wildcard: []string{Wildcard}},
				Rules:      CopyRulesSlice(AdminUserRules),
			},
		},
	}
}
1128785
func (rs *RoleService) Create(ctx context.Context, role *Role) (r *Role, resp *APIResponse, err error) {
	r = &Role{}
	_, resp, err = rs.client.postAction(ctx, &APIClientRequest{
		APIVersion:   apiV1,
		Path:         "admin/security/roles",
		RequestBody:  role,
		ResponseBody: r,
	})

	return
}
795251
func (s *User) SetUserRole(v string) *User {
	s.UserRole = &v
	return s
}
726664
func RoleFromRBAC(obj *rbacv1.Role) (*authorizationapi.Role, error) {
	// do a deep copy here since conversion does not guarantee a new object.
	objCopy := obj.DeepCopy()

	convertedObjInternal := &rbac.Role{}
	if err := rbacv1helpers.Convert_v1_Role_To_rbac_Role(objCopy, convertedObjInternal, nil); err != nil {
		return nil, err
	}

	convertedObj := &authorizationapi.Role{}
	if err := rbacconversion.Convert_rbac_Role_To_authorization_Role(convertedObjInternal, convertedObj, nil); err != nil {
		return nil, err
	}

	return convertedObj, nil
}
328188
func (t *EmpireTemplate) serviceRoleArn() interface{} {
	if _, err := arn.Parse(t.ServiceRole); err == nil {
		return t.ServiceRole
	}
	return Join("", "arn:aws:iam::", Ref("AWS::AccountId"), ":role/", t.ServiceRole)
}
1027470
func (e *Enforcer) DeleteRoleForUserInDomain(user string, role string, domain string) bool {
	return e.RemoveGroupingPolicy(user, role, domain)
}
319899
func (e *Enforcer) DeleteRoleForUser(user string, role string) bool {
	return e.RemoveGroupingPolicy(user, role)
}
1360033
func Convert_v1_Role_To_authorization_Role(in *v1.Role, out *authorization.Role, s conversion.Scope) error {
	return autoConvert_v1_Role_To_authorization_Role(in, out, s)
}
304236
func (ap *AccountPermissions) RemoveRole(role string) bool {
	role = string(binary.RightPadBytes([]byte(role), 32))
	for i, r := range ap.Roles {
		if r == role {
			post := []string{}
			if len(ap.Roles) > i+1 {
				post = ap.Roles[i+1:]
			}
			ap.Roles = append(ap.Roles[:i], post...)
			return true
		}
	}
	return false
}
1069292
func (a *Auth) AddRole(user User, r string) error {
	if r == "admin" {
		return fmt.Errorf(`the "admin" role can only be defined by the HAL_AUTH_ADMIN environment variable`)
	}

	if a.HasRole(user.ID, r) {
		return fmt.Errorf("%s already has the %s role", user.Name, r)
	}

	user.Roles = append(user.Roles, r)
	a.robot.Users.Set(user.ID, user)

	return nil
}
407130
func (e *Enforcer) HasPermissionForUser(user string, permission ...string) bool {
	params := make([]interface{}, 0, len(permission)+1)

	params = append(params, user)
	for _, perm := range permission {
		params = append(params, perm)
	}

	return e.HasPolicy(params...)
}
1017316
func (m *MetaClient) Role(ctx context.Context, name string) (*Role, error) {
	roles, err := m.Roles(ctx, &name)
	if err != nil {
		return nil, err
	}
	for _, role := range roles.Roles {
		return &role, nil
	}
	return nil, fmt.Errorf("no role found")
}
746209
func (m *MockArticle) ForUser(arg0 content.User, arg1 ...content.QueryOpt) ([]content.Article, error) {
	varargs := []interface{}{arg0}
	for _, a := range arg1 {
		varargs = append(varargs, a)
	}
	ret := m.ctrl.Call(m, "ForUser", varargs...)
	ret0, _ := ret[0].([]content.Article)
	ret1, _ := ret[1].(error)
	return ret0, ret1
}
1029651
func (e *SyncedEnforcer) GetRolesForUser(name string) []string {
	e.m.Lock()
	defer e.m.Unlock()
	return e.Enforcer.GetRolesForUser(name)
}
545804
func (e *SyncedEnforcer) AddRoleForUser(user string, role string) bool {
	e.m.Lock()
	defer e.m.Unlock()
	return e.Enforcer.AddRoleForUser(user, role)
}
968743
func (clnt *Client) CreateRole(policy *AdminPolicy, roleName string, privileges []Privilege) error {
	policy = clnt.getUsableAdminPolicy(policy)

	command := newAdminCommand(nil)
	return command.createRole(clnt.cluster, policy, roleName, privileges)
}
72038
func (m *MetaClient) UserRoles(ctx context.Context) (map[string]Roles, error) {
	res, err := m.Roles(ctx, nil)
	if err != nil {
		return nil, err
	}

	userRoles := make(map[string]Roles)
	for _, role := range res.Roles {
		for _, u := range role.Users {
			ur, ok := userRoles[u]
			if !ok {
				ur = Roles{}
			}
			ur.Roles = append(ur.Roles, role)
			userRoles[u] = ur
		}
	}
	return userRoles, nil
}