// InstallAuthFilter installs authentication filters with the restful Container.
504221
func (s *Server) InstallAuthFilter() {
	s.restfulCont.Filter(func(req *restful.Request, resp *restful.Response, chain *restful.FilterChain) {
		// Authenticate
		info, ok, err := s.auth.AuthenticateRequest(req.Request)
		if err != nil {
			klog.Errorf("Unable to authenticate the request due to an error: %v", err)
			resp.WriteErrorString(http.StatusUnauthorized, "Unauthorized")
			return
		}
		if !ok {
			resp.WriteErrorString(http.StatusUnauthorized, "Unauthorized")
			return
		}

		// Get authorization attributes
		attrs := s.auth.GetRequestAttributes(info.User, req.Request)

		// Authorize
		decision, _, err := s.auth.Authorize(attrs)
		if err != nil {
			msg := fmt.Sprintf("Authorization error (user=%s, verb=%s, resource=%s, subresource=%s)", attrs.GetUser().GetName(), attrs.GetVerb(), attrs.GetResource(), attrs.GetSubresource())
			klog.Errorf(msg, err)
			resp.WriteErrorString(http.StatusInternalServerError, msg)
			return
		}
		if decision != authorizer.DecisionAllow {
			msg := fmt.Sprintf("Forbidden (user=%s, verb=%s, resource=%s, subresource=%s)", attrs.GetUser().GetName(), attrs.GetVerb(), attrs.GetResource(), attrs.GetSubresource())
			klog.V(2).Info(msg)
			resp.WriteErrorString(http.StatusForbidden, msg)
			return
		}

		// Continue
		chain.ProcessFilter(req, resp)
	})
}
602918
func StatusFilter(status rspb.Status_Code) FilterFunc {
	return FilterFunc(func(rls *rspb.Release) bool {
		if rls == nil {
			return true
		}
		return rls.GetInfo().GetStatus().Code == status
	})
}
336126
func (m *Manager) FilterUsersWithAuthorizations(usernames []string, organization string) ([]string, error) {
	var auths []Authorization
	err := m.getAuthorizationCollection().Find(bson.M{"username": bson.M{"$in": usernames}, "grantedto": organization}).Select(bson.M{"username": 1}).All(&auths)
	if err != nil {
		return nil, err
	}
	result := []string{}
	for _, auth := range auths {
		result = append(result, auth.Username)
	}
	return result, nil
}
822235
func InstallHandlers(r *router.Router, base router.MiddlewareChain, templatesPath string) {
	m := base.Extend(func(c *router.Context, next router.Handler) {
		c.Context = context.WithValue(c.Context, startTimeContextKey(0), clock.Now(c.Context))
		next(c)
	}).Extend(
		templates.WithTemplates(prepareTemplates(templatesPath)),
		auth.Authenticate(server.UsersAPIAuthMethod{}),
	)

	r.GET("/", m, renderErr(routeToPage))
	r.GET("/p/*path", m, renderErr(routeToPage))
}
630009
func (fs *Filters) Install(watcher *Filter) (string, error) {
	if watcher.KeySym != nil && watcher.KeyAsym != nil {
		return "", fmt.Errorf("filters must choose between symmetric and asymmetric keys")
	}

	if watcher.Messages == nil {
		watcher.Messages = make(map[common.Hash]*ReceivedMessage)
	}

	id, err := GenerateRandomID()
	if err != nil {
		return "", err
	}

	fs.mutex.Lock()
	defer fs.mutex.Unlock()

	if fs.watchers[id] != nil {
		return "", fmt.Errorf("failed to generate unique ID")
	}

	if watcher.expectsSymmetricEncryption() {
		watcher.SymKeyHash = crypto.Keccak256Hash(watcher.KeySym)
	}

	watcher.id = id
	fs.watchers[id] = watcher
	fs.addTopicMatcher(watcher)
	return id, err
}
292446
func (b *AdapterBase) InstallFlags() {
	b.initFlagSet()
	b.flagOnce.Do(func() {
		if b.CustomMetricsAdapterServerOptions == nil {
			b.CustomMetricsAdapterServerOptions = server.NewCustomMetricsAdapterServerOptions()
		}

		b.SecureServing.AddFlags(b.FlagSet)
		b.Authentication.AddFlags(b.FlagSet)
		b.Authorization.AddFlags(b.FlagSet)
		b.Features.AddFlags(b.FlagSet)

		b.FlagSet.StringVar(&b.RemoteKubeConfigFile, "lister-kubeconfig", b.RemoteKubeConfigFile,
			"kubeconfig file pointing at the 'core' kubernetes server with enough rights to list "+
				"any described objects")
		b.FlagSet.DurationVar(&b.DiscoveryInterval, "discovery-interval", b.DiscoveryInterval,
			"interval at which to refresh API discovery information")
	})
}
1222924
func VerificationCodeFilterByUserID(userID uuid.UUID) func(db *gorm.DB) *gorm.DB {
	return func(db *gorm.DB) *gorm.DB {
		return db.Where("user_id = ?", userID)
	}
}
1342425
func (c *certPool) filterCerts(certs ...*x509.Certificate) []*x509.Certificate {
	c.lock.RLock()
	defer c.lock.RUnlock()

	filtered := []*x509.Certificate{}

CertLoop:
	for _, cert := range certs {
		if cert == nil {
			continue
		}
		possibilities := c.certsByName[string(cert.RawSubject)]
		for _, p := range possibilities {
			if c.certs[p].Equal(cert) {
				continue CertLoop
			}
		}
		filtered = append(filtered, cert)
	}

	//remove duplicate from list of certs being passed
	return removeDuplicates(filtered...)
}
1152484
func NewAuthorizerFromFile(baseURI string) (autorest.Authorizer, error) {
	settings, err := GetSettingsFromFile()
	if err != nil {
		return nil, err
	}
	if a, err := settings.ClientCredentialsAuthorizer(baseURI); err == nil {
		return a, err
	}
	if a, err := settings.ClientCertificateAuthorizer(baseURI); err == nil {
		return a, err
	}
	return nil, errors.New("auth file missing client and certificate credentials")
}
2589
func (fm *filterManager) AddFilter(filter ...Filter) {
	fm.fmLocker.Lock()
	fm.addFilter(filter...)
	fm.fmLocker.Unlock()
}
139325
func GetFilter(identifier string) *FilterInterface {
	filter, ok := filters[identifier]
	if ok {
		return filter
	}

	return nil
}
1373562
func (self *StandardFilterer) AddFilter(filter Filter) {
	if !self.filters.SetContains(filter) {
		self.filters.SetAdd(filter)
	}
}
1091630
func IdentityFilterByUserID(userID uuid.UUID) func(db *gorm.DB) *gorm.DB {
	return func(db *gorm.DB) *gorm.DB {
		return db.Where("user_id = ?", userID)
	}
}
606719
func (s *ListAssessmentRunsInput) SetFilter(v *AssessmentRunFilter) *ListAssessmentRunsInput {
	s.Filter = v
	return s
}
546664
func (ps *pulloutSubquery) PushFilter(pb *primitiveBuilder, filter sqlparser.Expr, whereType string, origin builder) error {
	return ps.underlying.PushFilter(pb, filter, whereType, origin)
}
132599
func FilterByIssuer(iss string) (CertificateFilter, error) {
	issFilter, err := regexp.Compile(iss)
	if err != nil {
		return nil, err
	}

	return func(cm *CertificateMetadata) bool {
		return issFilter.MatchString(cm.Issuer)
	}, nil
}
663193
func (commonOpts *CommonOptions) InstallFlags(flags *pflag.FlagSet) {
	if dockerCertPath == "" {
		dockerCertPath = cliconfig.Dir()
	}

	flags.BoolVarP(&commonOpts.Debug, "debug", "D", false, "Enable debug mode")
	flags.StringVarP(&commonOpts.LogLevel, "log-level", "l", "info", `Set the logging level ("debug"|"info"|"warn"|"error"|"fatal")`)
	flags.BoolVar(&commonOpts.TLS, "tls", dockerTLS, "Use TLS; implied by --tlsverify")
	flags.BoolVar(&commonOpts.TLSVerify, FlagTLSVerify, dockerTLSVerify, "Use TLS and verify the remote")

	// TODO use flag flags.String("identity"}, "i", "", "Path to libtrust key file")

	commonOpts.TLSOptions = &tlsconfig.Options{
		CAFile:   filepath.Join(dockerCertPath, DefaultCaFile),
		CertFile: filepath.Join(dockerCertPath, DefaultCertFile),
		KeyFile:  filepath.Join(dockerCertPath, DefaultKeyFile),
	}
	tlsOptions := commonOpts.TLSOptions
	flags.Var(opts.NewQuotedString(&tlsOptions.CAFile), "tlscacert", "Trust certs signed only by this CA")
	flags.Var(opts.NewQuotedString(&tlsOptions.CertFile), "tlscert", "Path to TLS certificate file")
	flags.Var(opts.NewQuotedString(&tlsOptions.KeyFile), "tlskey", "Path to TLS key file")

	// opts.ValidateHost is not used here, so as to allow connection helpers
	hostOpt := opts.NewNamedListOptsRef("hosts", &commonOpts.Hosts, nil)
	flags.VarP(hostOpt, "host", "H", "Daemon socket(s) to connect to")
	flags.StringVarP(&commonOpts.Context, "context", "c", "",
		`Name of the context to use to connect to the daemon (overrides DOCKER_HOST env var and default context set with "docker context use")`)
}