def check_access(self, rh: RestApiHandler, allowlist_check_members: bool = True) -> Optional[bool]:
        """Ensure client has enough privileges to perform a given request.

        Write a response back to the client if any issue is observed, and the HTTP status may be:

            * ``401``: if ``Authorization`` header is missing or contain an invalid password;
            * ``403``: if:

                * ``restapi.allowlist`` was configured, but client IP is not in the allowed list; or
                * ``restapi.allowlist_include_members`` is enabled, but client IP is not in the members list; or
                * a client certificate is expected by the server, but is missing in the request.

        :param rh: the request which access should be checked.
        :param allowlist_check_members: whether we should check the source ip against existing cluster members.

        :returns: ``True`` if client access verification succeeded, otherwise ``None``.
        """
        allowlist_check_members = allowlist_check_members and bool(self.__allowlist_include_members)
        if self.__allowlist or allowlist_check_members:
            incoming_ip = ip_address(rh.client_address[0])

            members_ips = tuple(self.__members_ips()) if allowlist_check_members else ()

            if not any(incoming_ip in net for net in self.__allowlist + members_ips):
                return rh.write_response(403, 'Access is denied')

        if not hasattr(rh.request, 'getpeercert') or not rh.request.getpeercert():  # valid client cert isn't present
            if self.__protocol == 'https' and self.__ssl_options.get('verify_client') in ('required', 'optional'):
                return rh.write_response(403, 'client certificate required')

        reason = self.check_auth_header(rh.headers.get('Authorization'))
        if reason:
            headers = {'WWW-Authenticate': 'Basic realm="' + self.patroni.__class__.__name__ + '"'}
            return rh.write_response(401, reason, headers=headers)
        return True
Ensure client has enough privileges to perform a given request.

        Write a response back to the client if any issue is observed, and the HTTP status may be:

            * ``401``: if ``Authorization`` header is missing or contain an invalid password;
            * ``403``: if:

                * ``restapi.allowlist`` was configured, but client IP is not in the allowed list; or
                * ``restapi.allowlist_include_members`` is enabled, but client IP is not in the members list; or
                * a client certificate is expected by the server, but is missing in the request.

        :param rh: the request which access should be checked.
        :param allowlist_check_members: whether we should check the source ip against existing cluster members.

        :returns: ``True`` if client access verification succeeded, otherwise ``None``.
        
patroni/api.py