//bq.setMaxClauseCount(1000000);

   

    // Add the empty-acl case

    BoolFilterBuilder subUnprotectedClause = new BoolFilterBuilder();

    subUnprotectedClause.must(denyOpen);

    bq.should(subUnprotectedClause);

    for (String accessToken : userAccessTokens)

    {

      bq.should(new TermFilterBuilder(allowField,accessToken));

   

    // Add the empty-acl case

    BoolFilterBuilder subUnprotectedClause = new BoolFilterBuilder();

    subUnprotectedClause.must(allowOpen);

    bq.should(subUnprotectedClause);

    for (String accessToken : userAccessTokens)

    {

      bq.should(new TermFilterBuilder(allowField,accessToken));

      bq.mustNot(new TermFilterBuilder(denyField,accessToken));

    if (null != entityTypeFilterStrings) {

      if ('-' != entityTypeFilterStrings[0].charAt(0)) { // (negative entity type, don't add to filter)

        outputFilter = FilterBuilders.boolFilter();

               

            FilterBuilders.termsFilter(EntityPojo.docQuery_type_, entityTypeFilterStrings)));

      }

    }

    if (null != assocVerbFilterStrings) {

      if ('-' != assocVerbFilterStrings[0].charAt(0)) { // (negative verb, don't add to filter)

            manualWeights.add(FilterBuilders.termsFilter(DocumentPojo.mediaType_, invTypeEl.getValue().toArray()), invTypeEl.getKey());

          }

          else { // Need to filter out sources they are matched with higher prio

            BoolFilterBuilder typesNotSources = FilterBuilders.boolFilter();

                              mustNot(FilterBuilders.termsFilter(DocumentPojo.sourceKey_, score.sourceWeights.keySet().toArray()));

           

            manualWeights.add(typesNotSources, invTypeEl.getKey());

          }

        }

      // That query is:

      // (fieldAllowShare is empty AND fieldDenyShare is empty AND fieldAllowDocument is empty AND fieldDenyDocument is empty)

      // We're trying to map to:  -(fieldAllowShare:*) , which should be pretty efficient in Solr because it is negated.  If this turns out not to be so, then we should

      // have the SolrConnector inject a special token into these fields when they otherwise would be empty, and we can trivially match on that token.

      bq.must(denyShareOpen);

      bq.must(allowDocumentOpen);

      bq.must(denyDocumentOpen);

    }

    else

      // (fieldAllowShare is empty AND fieldDenyShare is empty AND fieldAllowDocument is empty AND fieldDenyDocument is empty)

      // We're trying to map to:  -(fieldAllowShare:*) , which should be pretty efficient in Solr because it is negated.  If this turns out not to be so, then we should

      // have the SolrConnector inject a special token into these fields when they otherwise would be empty, and we can trivially match on that token.

      bq.must(allowShareOpen);

      bq.must(allowDocumentOpen);

      bq.must(denyDocumentOpen);

    }

    else

    {

      // We're trying to map to:  -(fieldAllowShare:*) , which should be pretty efficient in Solr because it is negated.  If this turns out not to be so, then we should

      // have the SolrConnector inject a special token into these fields when they otherwise would be empty, and we can trivially match on that token.

      bq.must(allowShareOpen);

      bq.must(denyShareOpen);

      bq.must(denyDocumentOpen);

    }

    else

    {

      // Extend the query appropriately for each user access token.

      // have the SolrConnector inject a special token into these fields when they otherwise would be empty, and we can trivially match on that token.

      bq.must(allowShareOpen);

      bq.must(denyShareOpen);

      bq.must(allowDocumentOpen);

    }

    else

    {

      // Extend the query appropriately for each user access token.

      bq.must(calculateCompleteSubquery(fieldAllowShare,fieldDenyShare,allowShareOpen,denyShareOpen,userAccessTokens));

    }

    else

    {

      // Extend the query appropriately for each user access token.

      bq.must(calculateCompleteSubquery(fieldAllowDocument,fieldDenyDocument,allowDocumentOpen,denyDocumentOpen,userAccessTokens));

    }

    return bq;

  }

    else

    {

      // Extend the query appropriately for each user access token.

      bq.must(calculateCompleteSubquery(fieldAllowShare,fieldDenyShare,allowShareOpen,denyShareOpen,userAccessTokens));

    }

    return bq;

  }