in src/main/java/org/apache/sling/resourceaccesssecurity/impl/ResourceAccessSecurityImpl.java [180:208]
private boolean canDoOperation(ResourceAccessGate.Operation operation, String path, Predicate<ResourceAccessGate> gatePredicate, Function<ResourceAccessGate, GateResult> gateResultFilter) {
final Iterator<ResourceAccessGateHandler> handlers = getMatchingResourceAccessGateHandlerIterator(
path, operation);
boolean result = false;
if ( handlers != null ) {
GateResult finalGateResult = null;
boolean noGateMatched = true;
while ( handlers.hasNext() ) {
noGateMatched = false;
final ResourceAccessGateHandler resourceAccessGateHandler = handlers.next();
final GateResult gateResult = !gatePredicate.test(resourceAccessGateHandler.getResourceAccessGate()) ? GateResult.GRANTED
: gateResultFilter.apply(resourceAccessGateHandler.getResourceAccessGate());
if (finalGateResult == null || finalGateResult == GateResult.DENIED) {
finalGateResult = gateResult;
}
if (finalGateResult == GateResult.GRANTED || gateResult != GateResult.CANT_DECIDE &&
resourceAccessGateHandler.isFinalOperation(operation)) {
break;
}
}
if ( finalGateResult == GateResult.GRANTED || (noGateMatched && this.defaultAllowIfNoGateMatches)) {
result = true;
}
}
return result;
}