From 282a7ee9108911a19c593cc3b28cbe2b002687a8 Mon Sep 17 00:00:00 2001
From: Jakob L. Kreuze
Date: Wed, 15 Nov 2023 15:00:55 -0500
Subject: Have evaluate_policy* take the results of its children as a parameter

---
 xacml-translation/match.rego | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/xacml-translation/match.rego b/xacml-translation/match.rego
index 947c857..df924bd 100644
--- a/xacml-translation/match.rego
+++ b/xacml-translation/match.rego
@@ -518,27 +518,26 @@ evaluate_rule_combinator("ordered_legacy_permit_overrides", results) := { "decis
     result.decision_extended == "indeterminate_d"
 } else := { "decision_extended": "not_applicable" }
 
-evaluate_policy_decision(policy) := decision if {
+# child_results := [result | rule := policy.rules[_]; result := evaluate_rule_decision(rule)]
+evaluate_policy_decision(policy, child_results) := decision if {
     evaluate_target(policy.target).match_result.value == true
-    child_results := [result | rule := policy.rules[_]; result := evaluate_rule_decision(rule)]
     decision := evaluate_rule_combinator(policy.combinator, child_results)
 } else := decision if {
     is_indeterminate(evaluate_target(policy.target))
-    child_results := [result | rule := policy.rules[_]; result := evaluate_rule_decision(rule)]
     decision := lift_decision_indeterminate(evaluate_rule_combinator(policy.combinator, child_results))
 } else := { "decision_extended": "not_applicable" }
 
-evaluate_policy_advices(policy) := { "advice" : advice } if {
-    decision := evaluate_policy_decision(policy)
+# children_advice := [advice | rule := policy.rules[_]; expr := evaluate_rule_advices(rule); advice := expr[_]]
+evaluate_policy_advices(policy, child_results, children_advice) := { "advice" : advice } if {
+    decision := evaluate_policy_decision(policy, child_results)
     policy_advice := [expr | expr := policy.advice[_]; expr.applies_to == decision ]
-    children_advice := [advice | rule := policy.rules[_]; expr := evaluate_rule_advices(rule); advice := expr[_]]
     advice := array.concat(policy_advice, children_advice)
 }
 
-evaluate_policy_obligations(policy) := { "obligations" : obligations } if {
-    decision := evaluate_policy_decision(policy)
+# children_obligations := [obligation | rule := policy.rules[_]; expr := evaluate_rule_obligations(rule); obligation := expr[_]]
+evaluate_policy_obligations(policy, child_results, children_obligations) := { "obligations" : obligations } if {
+    decision := evaluate_policy_decision(policy, child_results)
     policy_obligations := [expr | expr := policy.obligations[_]; expr.applies_to == decision ]
-    children_obligations := [obligation | rule := policy.rules[_]; expr := evaluate_rule_obligations(rule); obligation := expr[_]]
     obligations := array.concat(policy_obligations, children_obligations)
 }
 
-- 
cgit v1.3