title: Combine logical expressions while prioritizing expressions
body: <p>I'm in the process of creating a complex authorization module for a system which will be based on the <a href="https://www.martinfowler.com/apsupp/spec.pdf" rel="nofollow noreferrer">specification pattern</a>. Access rules are defined as followed:</p>
  
  <ul>
  <li><p>An <code>operationName</code> defines to which operation the rule applies to.</p></li>
  <li><p>A <code>SubjectSpecification</code> defines wheter the rule should apply to a specific <code>Subject</code> or not. E.g. the following would match any subject within the <strong>division A</strong>. </p>
  
  <pre><code>subjectSpec = new MyAppSubjectSpecification(division: 
  Division.SOME_DIVISION)
  </code></pre></li>
  <li><p>An <code>AccessSpecification</code> defines the actual rule expression.</p></li>
  <li><p>An <code>AccessType</code> defines wheter the matching rule grants or deny access.</p></li>
  <li><p>A <code>RulePriorityStrategy</code> that defines how rules shall be inherited.</p></li>
  </ul>
  
  <p>For the question, let's say that our application's <code>Subject</code> has the following structure <code>{divisionId, sectionId, groupId, userId }</code> and that the <code>RulePriority</code> states that the more specific the <code>SubjectSpecification</code> is then the higher it's priority is.</p>
  
  <p>For instance, a rule targeting a specific <code>userId</code> would be prioritized over a rule targeting the <code>division</code> to which that user belongs to.</p>
  
  <p>Now, here's the real challenge which I'm not sure how to solve yet. I want rules to be inherited in a way that high priority rules inherit from the lowest priority rules, while having their own condition override parts of the lowest priority rules which are conflicting. Please also note that operations are denied by default if there are no matching <strong>grant</strong> rule.</p>
  
  <p>For instance, with the following rules:</p>
  
  <pre><code>- Grant OperationA to all where (A &amp;&amp; B) || C
  - Grant OperationA to division A where D
  - Deny Operation to user xyz where B &amp;&amp; E
  </code></pre>
  
  <p>Here I'd expect user xyz (which belongs to division A) to be allowed when <code>C || D || (A &amp;&amp; B &amp;&amp; !E)</code>.</p>
  
  <p>The way I was planning to use the final inherited <code>grant</code> and <code>allow</code> rules is as follow:</p>
  
  <pre><code>canPerformOperation = grantSpec.isSatisfiedBy(...) and not (denySpec.isSatisfiedBy(...))
  </code></pre>
  
  <p>In this case it seems that combining in the following way would work, but it does not in all scenarios (e.g. when allow must override denial).</p>
  
  <pre><code>GR = Grant rule
  DN = Deny rule
  
  allowed = (GRn || GRn+1 ... || GRn+x)) &amp;&amp; !(DRn || DRn+1 ... || DRn+x)
  allowed = ((A &amp;&amp; B) || C) || D) &amp;&amp; !(B &amp;&amp; E)
  </code></pre>
  
  <p>I've made a bit of research and I'm sure this is standard academic knowledge of logical expressions, but I couldn't find a standard algorithm that solves the issue somehow and I'm sure coming up with a solution will take me quite a lot of time or will not be efficient.</p>