ezsystems / ezpublish-kernel

                $limitation = $permissionSet['limitation'];

                $identifier = $limitation->getIdentifier();

                if (isset($queryLimitationMap[$identifier])) {

                    $value = reset($queryLimitationMap[$identifier]->limitationValues);

                    $type = $this->limitationService->getLimitationType($identifier);

                    // Try with next role permission set

                    if (!$type->evaluateSingle($limitation, $value)) {

                        continue;

                    }

                } else {

                    // todo How to decide if this is at all relevant for module/function?

                    // ACCESS_ABSTAIN is returned by evaluate().

                    // Maybe it could be modelled on the permission map instead?

                    $roleLimitations[] = $limitation;

                }

            }

            $policyLimitationSet = [];

                foreach ($limitations as $limitation) {

                    $identifier = $limitation->getIdentifier();

                    if (isset($queryLimitationMap[$identifier])) {

                        $value = reset($queryLimitationMap[$identifier]->limitationValues);

                        $type = $this->limitationService->getLimitationType($identifier);

                        if ($type->evaluateSingle($limitation, $value)) {

                            // Continue evaluating

                            continue;

                        } else {

                            // Break to next policy, all limitations must either pass or record

                            break 2;

                        }

                    } else {

                        // Record limitation for return

                        $policyLimitations[] = $limitation;

                    }

                }

                $policiesPass = true;