// SecurityScopesFrom request context value.
507230
func SecurityScopesFrom(req *http.Request) []string {
	rs := req.Context().Value(ctxSecurityScopes)
	if res, ok := rs.([]string); ok {
		return res
	}
	return nil
}
506221
func (s *Spec) SecurityDefinitionsForRequirements(requirements []SecurityRequirement) map[string]spec.SecurityScheme {
	result := make(map[string]spec.SecurityScheme)

	for _, v := range requirements {
		if definition, ok := s.spec.SecurityDefinitions[v.Name]; ok {
			if definition != nil {
				result[v.Name] = *definition
			}
		}
	}
	return result
}
297187
func ValidateSecurityContext(sc *core.SecurityContext, fldPath *field.Path) field.ErrorList {
	allErrs := field.ErrorList{}
	//this should only be true for testing since SecurityContext is defaulted by the core
	if sc == nil {
		return allErrs
	}

	if sc.Privileged != nil {
		if *sc.Privileged && !capabilities.Get().AllowPrivileged {
			allErrs = append(allErrs, field.Forbidden(fldPath.Child("privileged"), "disallowed by cluster policy"))
		}
	}

	if sc.RunAsUser != nil {
		for _, msg := range validation.IsValidUserID(*sc.RunAsUser) {
			allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsUser"), *sc.RunAsUser, msg))
		}
	}

	if sc.RunAsGroup != nil {
		for _, msg := range validation.IsValidGroupID(*sc.RunAsGroup) {
			allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsGroup"), *sc.RunAsGroup, msg))
		}
	}

	if sc.ProcMount != nil {
		if err := ValidateProcMountType(fldPath.Child("procMount"), *sc.ProcMount); err != nil {
			allErrs = append(allErrs, err)
		}
	}

	if sc.AllowPrivilegeEscalation != nil && !*sc.AllowPrivilegeEscalation {
		if sc.Privileged != nil && *sc.Privileged {
			allErrs = append(allErrs, field.Invalid(fldPath, sc, "cannot set `allowPrivilegeEscalation` to false and `privileged` to true"))
		}

		if sc.Capabilities != nil {
			for _, cap := range sc.Capabilities.Add {
				if string(cap) == "CAP_SYS_ADMIN" {
					allErrs = append(allErrs, field.Invalid(fldPath, sc, "cannot set `allowPrivilegeEscalation` to false and `capabilities.Add` CAP_SYS_ADMIN"))
				}
			}
		}
	}

	return allErrs
}
1057941
func CheckScopes(possibleScopes []string, authorizedScopes []string) bool {
	if len(possibleScopes) == 0 {
		return true
	}

	for _, allowed := range possibleScopes {
		for _, scope := range authorizedScopes {
			if scope == allowed {
				return true
			}
		}
	}
	return false
}
1214457
func Convert_v1_PodSecurityPolicyReviewSpec_To_security_PodSecurityPolicyReviewSpec(in *v1.PodSecurityPolicyReviewSpec, out *security.PodSecurityPolicyReviewSpec, s conversion.Scope) error {
	return autoConvert_v1_PodSecurityPolicyReviewSpec_To_security_PodSecurityPolicyReviewSpec(in, out, s)
}
558298
func (c *Context) SecureJSON(code int, obj interface{}) {
	c.Render(code, render.SecureJSON{Prefix: c.engine.secureJsonPrefix, Data: obj})
}
571877
func InvalidScopeResponse(requiredScope string, c echo.Context) error {
	message := "Required scope (" + requiredScope + ") is missing"
	c.JSON(http.StatusUnauthorized, &Response{
		HumanMessage: message,
		Message:      message,
		Status:       http.StatusBadRequest,
		Success:      false,
	})
	return errors.New(message)
}
870065
func ScopeFromPB(scope metricpb.Scope) MetricScope {
	switch scope {
	case metricpb.Scope_Global:
		return GlobalOnly
	case metricpb.Scope_Local:
		return LocalOnly
	case metricpb.Scope_Mixed:
		return MixedScope
	}

	return 0
}
708542
func (mr *MockAuthorizeRequesterMockRecorder) GetRequestedScopes() *gomock.Call {
	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestedScopes", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetRequestedScopes))
}
518685
func (fw *Framework) NewSecureRequest(request protocol.Request) (secure protocol.SecureRequest, err error) {
	switch request.Version() {
	case protocol.RequestV1:
		secure, err = v1.NewSecureRequest(request, fw.security)
	default:
		err = fmt.Errorf("Do not know how to create a SecureReply from a Request with version %s", request.Version())
	}

	return
}
533010
func (o *IntrospectOAuth2TokenParams) WithScope(scope *string) *IntrospectOAuth2TokenParams {
	o.SetScope(scope)
	return o
}
764954
func (m *Manager) ScopesForInternalAddrTypes(addrType AddressType) []KeyScope {
	m.mtx.RLock()
	defer m.mtx.RUnlock()

	scopes, _ := m.internalAddrSchemas[addrType]
	return scopes
}
859563
func (fw *Framework) ValidateSecurity() (errors []string, ok bool) {
	return fw.security.Validate()
}
8168
func forEachKeyScope(ns walletdb.ReadBucket, fn func(KeyScope) error) error {
	bucket := ns.NestedReadBucket(scopeBucketName)

	return bucket.ForEach(func(k, v []byte) error {
		// skip non-bucket
		if len(k) != 8 {
			return nil
		}

		scope := KeyScope{
			Purpose: binary.LittleEndian.Uint32(k[:]),
			Coin:    binary.LittleEndian.Uint32(k[4:]),
		}

		return fn(scope)
	})
}
1342606
func Convert_security_PodSecurityPolicyReviewSpec_To_v1_PodSecurityPolicyReviewSpec(in *security.PodSecurityPolicyReviewSpec, out *v1.PodSecurityPolicyReviewSpec, s conversion.Scope) error {
	return autoConvert_security_PodSecurityPolicyReviewSpec_To_v1_PodSecurityPolicyReviewSpec(in, out, s)
}
1079324
func sliceToFSType(s []string) []securityv1.FSType {
	fsTypes := []securityv1.FSType{}
	for _, v := range s {
		fsTypes = append(fsTypes, securityv1.FSType(v))
	}
	return fsTypes
}
141170
func (a *authenticator) getPermissionsForURL(url, method string) []string {
	var groups []string
	for groupName, permissions := range a.groupDb {
		for _, permissions := range permissions {
			// Check URL
			if permissions.Url == url {
				// Check allowed methods
				for _, allowed := range permissions.AllowedMethods {
					if allowed == method {
						groups = append(groups, groupName)
					}
				}
			}
		}
	}
	return groups
}