public Result combine(EvaluationCtx context, List<CombinerParameter> parameters,
List<? extends CombinerElement> ruleElements) {
boolean atLeastOneError = false;
boolean potentialPermit = false;
boolean atLeastOneDeny = false;
Result firstIndeterminateResult = null;
Iterator<? extends CombinerElement> it = ruleElements.iterator();
while (it.hasNext()) {
Rule rule = ((RuleCombinerElement) (it.next())).getRule();
Result result = rule.evaluate(context);
int value = result.getDecision();
// if there was a value of PERMIT, then regardless of what
// else we've seen, we always return PERMIT
if (value == Result.DECISION_PERMIT)
return result;
// if it was INDETERMINATE, then we couldn't figure something
// out, so we keep track of these cases...
if (value == Result.DECISION_INDETERMINATE) {
atLeastOneError = true;
// there are no rules about what to do if multiple cases
// cause errors, so we'll just return the first one
if (firstIndeterminateResult == null)
firstIndeterminateResult = result;
// if the Rule's effect is PERMIT, then we can't let this
// alg return DENY, since this Rule might have permitted
// if it could do its stuff
if (rule.getEffect() == Result.DECISION_PERMIT)
potentialPermit = true;
} else {
// keep track of whether we had at least one rule that
// actually pertained to the request
if (value == Result.DECISION_DENY)
atLeastOneDeny = true;
}
}
// we didn't explicitly PERMIT, but we might have had some Rule
// been evaluated, so we have to return INDETERMINATE
if (potentialPermit)
return firstIndeterminateResult;
// some Rule said DENY, so since nothing could have permitted,
// we return DENY
if (atLeastOneDeny)
return new Result(Result.DECISION_DENY, context.getResourceId().encode());
// we didn't find anything that said DENY, but if we had a
// problem with one of the Rules, then we're INDETERMINATE
if (atLeastOneError)
return firstIndeterminateResult;
// if we hit this point, then none of the rules actually applied
// to us, so we return NOT_APPLICABLE
return new Result(Result.DECISION_NOT_APPLICABLE, context.getResourceId().encode());
}