diff options
| -rw-r--r-- | xacml-translation/match.rego | 17 |
1 files changed, 8 insertions, 9 deletions
diff --git a/xacml-translation/match.rego b/xacml-translation/match.rego index 947c857..df924bd 100644 --- a/xacml-translation/match.rego +++ b/xacml-translation/match.rego @@ -518,27 +518,26 @@ evaluate_rule_combinator("ordered_legacy_permit_overrides", results) := { "decis result.decision_extended == "indeterminate_d" } else := { "decision_extended": "not_applicable" } -evaluate_policy_decision(policy) := decision if { +# child_results := [result | rule := policy.rules[_]; result := evaluate_rule_decision(rule)] +evaluate_policy_decision(policy, child_results) := decision if { evaluate_target(policy.target).match_result.value == true - child_results := [result | rule := policy.rules[_]; result := evaluate_rule_decision(rule)] decision := evaluate_rule_combinator(policy.combinator, child_results) } else := decision if { is_indeterminate(evaluate_target(policy.target)) - child_results := [result | rule := policy.rules[_]; result := evaluate_rule_decision(rule)] decision := lift_decision_indeterminate(evaluate_rule_combinator(policy.combinator, child_results)) } else := { "decision_extended": "not_applicable" } -evaluate_policy_advices(policy) := { "advice" : advice } if { - decision := evaluate_policy_decision(policy) +# children_advice := [advice | rule := policy.rules[_]; expr := evaluate_rule_advices(rule); advice := expr[_]] +evaluate_policy_advices(policy, child_results, children_advice) := { "advice" : advice } if { + decision := evaluate_policy_decision(policy, child_results) policy_advice := [expr | expr := policy.advice[_]; expr.applies_to == decision ] - children_advice := [advice | rule := policy.rules[_]; expr := evaluate_rule_advices(rule); advice := expr[_]] advice := array.concat(policy_advice, children_advice) } -evaluate_policy_obligations(policy) := { "obligations" : obligations } if { - decision := evaluate_policy_decision(policy) +# children_obligations := [obligation | rule := policy.rules[_]; expr := evaluate_rule_obligations(rule); obligation := expr[_]] +evaluate_policy_obligations(policy, child_results, children_obligations) := { "obligations" : obligations } if { + decision := evaluate_policy_decision(policy, child_results) policy_obligations := [expr | expr := policy.obligations[_]; expr.applies_to == decision ] - children_obligations := [obligation | rule := policy.rules[_]; expr := evaluate_rule_obligations(rule); obligation := expr[_]] obligations := array.concat(policy_obligations, children_obligations) } |