public Result combine(EvaluationCtx context, List parameters,
List ruleElements) {
boolean atLeastOneError = false;
boolean potentialDeny = false;
boolean atLeastOnePermit = false;
Result firstIndeterminateResult = null;
Iterator it = ruleElements.iterator();
while (it.hasNext()) {
Rule rule = ((RuleCombinerElement)(it.next())).getRule();
Result result = rule.evaluate(context);
int value = result.getDecision();
logger.log(Level.FINE, "Rule id:"+rule.getId().toASCIIString()+":result="+value);
// if there was a value of DENY, then regardless of what else
// we've seen, we always return DENY
if (value == Result.DECISION_DENY)
return result;
// if it was INDETERMINATE, then we couldn't figure something
// out, so we keep track of these cases...
if (value == Result.DECISION_INDETERMINATE) {
atLeastOneError = true;
// there are no rules about what to do if multiple cases
// cause errors, so we'll just return the first one
if (firstIndeterminateResult == null)
firstIndeterminateResult = result;
// if the Rule's effect is DENY, then we can't let this
// alg return PERMIT, since this Rule might have denied
// if it could do its stuff
if (rule.getEffect() == Result.DECISION_DENY)
potentialDeny = true;
} else {
// keep track of whether we had at least one rule that
// actually pertained to the request
if (value == Result.DECISION_PERMIT)
atLeastOnePermit = true;
}
}
// we didn't explicitly DENY, but we might have had some Rule
// been evaluated, so we have to return INDETERMINATE
if (potentialDeny)
return firstIndeterminateResult;
// some Rule said PERMIT, so since nothing could have denied,
// we return PERMIT
if (atLeastOnePermit)
return new Result(Result.DECISION_PERMIT,
context.getResourceId().encode());
// we didn't find anything that said PERMIT, but if we had a
// problem with one of the Rules, then we're INDETERMINATE
if (atLeastOneError)
return firstIndeterminateResult;
// if we hit this point, then none of the rules actually applied
// to us, so we return NOT_APPLICABLE
return new Result(Result.DECISION_NOT_APPLICABLE,
context.getResourceId().encode());
}