// forbidden renders a simple forbidden error to the response
509610
func forbidden(reason string, attributes kauthorizer.Attributes, w http.ResponseWriter, req *http.Request) {
	resource := ""
	group := ""
	name := ""
	// the attributes can be empty for two basic reasons:
	// 1. malformed API request
	// 2. not an API request at all
	// In these cases, just assume default that will work better than nothing
	if attributes != nil {
		group = attributes.GetAPIGroup()
		resource = attributes.GetResource()
		name = attributes.GetName()
	}

	// Reason is an opaque string that describes why access is allowed or forbidden (forbidden by the time we reach here).
	// We don't have direct access to kind or name (not that those apply either in the general case)
	// We create a NewForbidden to stay close the API, but then we override the message to get a serialization
	// that makes sense when a human reads it.
	forbiddenError := kapierrors.NewForbidden(schema.GroupResource{Group: group, Resource: resource}, name, errors.New("") /*discarded*/)
	forbiddenError.ErrStatus.Message = reason

	formatted := &bytes.Buffer{}
	output, err := runtime.Encode(legacyscheme.Codecs.LegacyCodec(coreapi.SchemeGroupVersion), &forbiddenError.ErrStatus)
	if err != nil {
		fmt.Fprintf(formatted, "%s", forbiddenError.Error())
	} else {
		json.Indent(formatted, output, "", "  ")
	}

	w.Header().Set("Content-Type", restful.MIME_JSON)
	w.WriteHeader(http.StatusForbidden)
	w.Write(formatted.Bytes())
}
493191
func (s *UsersService) IsBlocked(ctx context.Context, user string) (bool, *Response, error) {
	u := fmt.Sprintf("user/blocks/%v", user)

	req, err := s.client.NewRequest("GET", u, nil)
	if err != nil {
		return false, nil, err
	}

	// TODO: remove custom Accept header when this API fully launches.
	req.Header.Set("Accept", mediaTypeBlockUsersPreview)

	resp, err := s.client.Do(ctx, req, nil)
	isBlocked, err := parseBoolResponse(err)
	return isBlocked, resp, err
}
206638
func (r *Repo) errorIfNotReady() error {
	switch r.status {
	case RepoReady:
		return nil
	case RepoNoConfig:
		return ErrNoConfig
	default:
		return NotReadyError{r.err}
	}
}
949956
func PermissionAllowed(p Permission, ps []Permission) bool {
	pID := ID(0)
	if p.ID != nil {
		pID = *p.ID
		if !pID.Valid() {
			return false
		}
	}

	for _, perm := range ps {
		permID := ID(0)
		if perm.ID != nil {
			permID = *perm.ID
			if !permID.Valid() {
				return false
			}
		}
		if perm.Action == p.Action && perm.Resource == p.Resource && permID == pID {
			return true
		}
	}
	return false
}
1340441
func PreventRedirects(_ *http.Request, _ []*http.Request) error {
	return errors.New("redirects forbidden")
}
360999
func (r *Route) methodNotAllowed() http.Handler {

	// determine what methods ARE supported by this route
	methods := make([]string, 0, 8)

	for method := range r.handlers {
		if method != methodAny && method != notFound {
			methods = append(methods, method)
		}
	}

	// 405 only makes sense if some methods are allowed
	if len(methods) > 0 {
		return methodNotAllowedHandler(methods)
	}

	return nil
}
1266671
func notFoundHandlerJSON(w http.ResponseWriter, r *http.Request) {
	writeErrorResponseJSON(context.Background(), w, errorCodes.ToAPIErr(ErrMethodNotAllowed), r.URL)
}
1228926
func (f *ComponentFlag) Allowed() sets.String {
	return sets.NewString(f.allowed.List()...)
}
559331
func (r *Router) Allowed(path, reqMethod string) (allow string) {
	return r.router.Allowed(path, reqMethod)
}
934831
func Error(err error) Response {
	return Response{
		Status:  StatusFail,
		Message: err.Error(),
	}
}
300799
func (p *DNSProxy) AddAllowed(reStr, endpointID string) {
	log.WithField(logfields.DNSName, reStr).Debug("Adding allowed DNS FQDN pattern")
	p.UpdateAllowed([]string{reStr}, nil, endpointID)
}
396304
func (i *ImportRestriction) ForbiddenImportsFor(pkg Package) []string {
	if !i.isRestrictedPath(pkg.ImportPath) {
		return []string{}
	}
	return i.forbiddenImportsFor(pkg)
}
826446
func (self *qbsWrappedUdid) Allow(udid string, method string, pb PBundle) bool {
	var obj interface{}
	switch method {
	case "GET":
		obj = self.find
	case "PUT":
		obj = self.put
	case "DELETE":
		obj = self.del
	}
	allow, ok := obj.(AllowerUdid)
	if !ok {
		return true
	}
	return allow.Allow(udid, method, pb)

}
970210
func (api *ProxyLBAPI) Exclude(key string) *ProxyLBAPI {
	api.exclude(key)
	return api
}
637035
func (c *Cors) areHeadersAllowed(requestedHeaders []string) bool {
	if c.allowedHeadersAll || len(requestedHeaders) == 0 {
		return true
	}
	for _, header := range requestedHeaders {
		header = http.CanonicalHeaderKey(header)
		found := false
		for _, h := range c.allowedHeaders {
			if h == header {
				found = true
			}
		}
		if !found {
			return false
		}
	}
	return true
}
1181257
func (self *qbsWrapped) Allow(id int64, method string, pb PBundle) bool {
	var obj interface{}
	switch method {
	case "GET":
		obj = self.find
	case "PUT":
		obj = self.put
	case "DELETE":
		obj = self.del
	}
	allow, ok := obj.(Allower)
	if !ok {
		return true
	}
	return allow.Allow(id, method, pb)

}
882109
func ChannelAllowed(user, org, app_name, ident, channelName string) bool {

	var available = []string{"email", "web", "push"}
	var preference map[string]availableTopics.ChotaTopic

	appTopics, err := availableTopics.GetAppTopics(app_name, org)
	channels := []string{}
	for _, idnt := range available {
		channels = append(channels, idnt)
	}
	preference, err = availableTopics.GetUserPreferences(user, org, appTopics, &channels)

	if err != nil {
		log.Println(err)
		return false
	}

	if _, ok := preference[ident]; !ok {
		return false
	}

	if _, ok := preference[ident][channelName]; !ok {
		return false
	}

	return preference[ident][channelName].Value
}