= ApplicationTenancyEvaluator
:Notice: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR  CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Optional SPI interface to be implemented by a domain service, providing an alternative mechanism for evaluating the application tenancy of the object being interacted with (the "what") and optionally also the tenancy of the user making the call (the "who").

== API

[source,java]
.ApplicationTenancyEvaluator.java
----
interface ApplicationTenancyEvaluator {
  boolean handles(Class<?> cls)     // <.>
  String hides(Object domainObject, ApplicationUser applicationUser)     // <.>
  String disables(Object domainObject, ApplicationUser applicationUser)     // <.>
}
----

<.> xref:#handles_Class[handles(Class)]
+
--
Whether this evaluator can determine the tenancy of the specified domain entity (such as `ToDoItem` ) being interacted with (the "what").
--
<.> xref:#hides_Object_ApplicationUser[hides(Object, ApplicationUser)]
+
--
Whether this domain object should not be visible to the specified xref:refguide:extensions:index/secman/applib/user/dom/ApplicationUser.adoc[ApplicationUser] .
--
<.> xref:#disables_Object_ApplicationUser[disables(Object, ApplicationUser)]
+
--
Whether the object members of this domain object should be disabled/read-only for the specified xref:refguide:extensions:index/secman/applib/user/dom/ApplicationUser.adoc[ApplicationUser] .
--

== Members

[#handles_Class]
=== handles(Class)

Whether this evaluator can determine the tenancy of the specified domain entity (such as `ToDoItem` ) being interacted with (the "what").

This method is also called to determine if the evaluator is also able to determine the tenancy of the security module's own xref:refguide:extensions:index/secman/applib/user/dom/ApplicationUser.adoc[ApplicationUser] , ie the "who" is doing the interacting. If the evaluator does not handle the class, then the fallback behaviour is to invoke _ApplicationUser#getAtPath()_ } on the xref:refguide:extensions:index/secman/applib/user/dom/ApplicationUser.adoc[ApplicationUser] and use the path from that.

[#hides_Object_ApplicationUser]
=== hides(Object, ApplicationUser)

Whether this domain object should not be visible to the specified xref:refguide:extensions:index/secman/applib/user/dom/ApplicationUser.adoc[ApplicationUser] .

The domain object will be one that is handled by this evaluator, in other words that _#handles(Class)_ was previously called and the evaluator returned `true` .

A non-null return value means that the object should be hidden.

[#disables_Object_ApplicationUser]
=== disables(Object, ApplicationUser)

Whether the object members of this domain object should be disabled/read-only for the specified xref:refguide:extensions:index/secman/applib/user/dom/ApplicationUser.adoc[ApplicationUser] .

The domain object will be one that is handled by this evaluator, in other words that _#handles(Class)_ was previously called and the evaluator returned `true` .

This method is only called after _#hides(Object, ApplicationUser)_ and only if that method returned `false` .

A non-null return value means that the object should be disabled, and is used as the reason why the object member is disabled.
