Source:
public QueryRequest process(QueryRequest input) throws PluginExecutionException, StopProcessingException { final String subjectIdentifier = getSubjectIdentifier(); final Set<String> groups = new HashSet<>(getSubjectGroups()); final String groupThatCanSeeEverything = configuration.getSystemUserAttributeValue(); if (groups.contains(groupThatCanSeeEverything)) { LOGGER.debug( "Will not modify filter; subject ({}) had at least one group that was exempt [{}]", subjectIdentifier, groups, groupThatCanSeeEverything); return input; } final TagAggregationVisitor tagVisitor = new TagAggregationVisitor(); final SimplifyingFilterVisitor simpleVisitor = new SimplifyingFilterVisitor(); final Query query = input.getQuery(); final Filter simplified = (Filter) query.accept(simpleVisitor, null); simplified.accept(tagVisitor, null); final Set<String> discoveredTags = tagVisitor.getTags(); if (CollectionUtils.isEmpty(discoveredTags)) { LOGGER.debug( "Will not modify filter; subject's ({}) query did not completely bind results to tags", subjectIdentifier, query); return input; } Set<String> tagsNotInCollaborationSet = Sets.filter(discoveredTags, tag -> !accessControlledTags.contains(tag)); if (CollectionUtils.isNotEmpty(tagsNotInCollaborationSet)) { LOGGER.debug( "Will not modify filter; subject's ({}) query referenced tags not in collab set [{}]", subjectIdentifier, query, accessControlledTags); return input; } Filter policyBranch = createBakedInSecurityPolicySubset(subjectIdentifier, groups); Filter combined = filterBuilder.allOf(query, policyBranch); return new QueryRequestImpl( new QueryImpl(combined), input.isEnterprise(), input.getSourceIds(), input.getProperties()); }

Target:
public QueryRequest process(QueryRequest input) throws PluginExecutionException, StopProcessingException { if (!configuration.isPolicyToFilterEnabled()) { LOGGER.debug( "Will not modify filter because policy to filter mapping is disabled; " + "refer to Catalog UI Search Workspace Security config to enable this behavior"); return input; } final String subjectIdentifier = getSubjectIdentifier(); final Set<String> groups = new HashSet<>(getSubjectGroups()); final String groupThatCanSeeEverything = configuration.getSystemUserAttributeValue(); if (groups.contains(groupThatCanSeeEverything)) { LOGGER.debug( "Will not modify filter; subject ({}) had at least one group that was exempt [{}]", subjectIdentifier, groups, groupThatCanSeeEverything); return input; } final Query query = input.getQuery(); final SimplifyingFilterVisitor simpleVisitor = new SimplifyingFilterVisitor(); final Filter simplified = (Filter) query.accept(simpleVisitor, null); LOGGER.trace("Simplified filter [{}]", simplified); final TagAggregationVisitor tagVisitor = new TagAggregationVisitor(); simplified.accept(tagVisitor, null); final Set<String> discoveredTags = tagVisitor.getTags(); if (CollectionUtils.isEmpty(discoveredTags)) { LOGGER.debug( "Will not modify filter; subject's ({}) query did not completely bind results to tags", subjectIdentifier, query); return input; } final Set<String> tagsThatAreAccessControlled = tagSet.getAccessControlledTags(); final Set<String> tagsNotAccessControlled = Sets.difference(discoveredTags, tagsThatAreAccessControlled); if (CollectionUtils.isNotEmpty(tagsNotAccessControlled)) { LOGGER.debug( "Will not modify filter; subject's ({}) query referenced tags that are not in access controlled set [{}]", subjectIdentifier, query, tagsThatAreAccessControlled); return input; } final Filter policyBranch = createSecurityPolicySubset(subjectIdentifier, groups); LOGGER.debug("Adding access control policy to the query filter [{}]", policyBranch); final Filter combined = filterBuilder.allOf(query, policyBranch); return new QueryRequestImpl( new QueryImpl(combined), input.isEnterprise(), input.getSourceIds(), input.getProperties()); }