in src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/impl/PrivilegesHelper.java [428:463]
private static LocalPrivilege localPrivAddRestriction(@NotNull Map<Privilege, LocalPrivilege> privilegeToLocalPrivilegesMap,
@NotNull Privilege privilege, boolean forAllow, boolean forDeny, @NotNull LocalRestriction restriction,
boolean requireAllowOrDenyAlreadySet) {
LocalPrivilege localPrivilege = privilegeToLocalPrivilegesMap.computeIfAbsent(privilege, LocalPrivilege::new);
if (forDeny) {
if (requireAllowOrDenyAlreadySet && !localPrivilege.isDeny()) {
//skip it
} else {
localPrivilege.setDeny(true);
localPrivilege.unsetDenyRestrictions(Collections.singleton(restriction.getName()));
localPrivilege.setDenyRestrictions(Collections.singleton(restriction));
}
}
if (forAllow) {
if (requireAllowOrDenyAlreadySet && !localPrivilege.isAllow()) {
//skip it
} else {
localPrivilege.setAllow(true);
localPrivilege.unsetAllowRestrictions(Collections.singleton(restriction.getName()));
localPrivilege.setAllowRestrictions(Collections.singleton(restriction));
}
}
if (localPrivilege.sameAllowAndDenyRestrictions()) {
// same restrictions so we can unset one of them
if (forAllow) {
localPrivilege.setDeny(false);
localPrivilege.setDenyRestrictions(Collections.emptySet());
} else if (forDeny) {
localPrivilege.setAllow(false);
localPrivilege.setAllowRestrictions(Collections.emptySet());
}
}
return localPrivilege;
}