index.js
function (policy) {
            // Recursively normalize lists of policies
            if (_.isArray(policy)) {
                // Normalize each policy in the chain
                return _.flatten(
                    _.map(policy, function normalize_each_policy (policy) {
                        return policyHookDef.normalizePolicy(policy);
                    }));
            }

            // Look up the policy in the policy registry
            if (_.isString(policy)) {
                var policyFn = this.lookupFn(policy, 'config.policies');
                // Set the "policy" key on the policy function to the policy name, for debugging
                policyFn._middlewareType = 'POLICY: '+policy;
                return [policyFn];
            }

            /**
             * This line was added to support auto building of policies
             */
            if (_.isObject(policy) && policy.build) {
                policy = policy.build();
            }

            // An explicitly defined, anonymous policy middleware can be directly attached
            if (_.isFunction(policy)) {
                var anonymousPolicy = policy.bind({ });
                // Set the "policy" key on the function name (if any) for debugging
                anonymousPolicy._middlewareType = 'POLICY: '+ (anonymousPolicy.name || 'anonymous');
                return [anonymousPolicy];
            }

            // A false or null policy means NEVER allow any requests
            if (policy === false || policy === null) {
                var neverAllow = function neverAllow (req, res, next) {
                    res.send(403);
                };
                neverAllow._middlewareType = 'POLICY: neverAllow';
                return [neverAllow];
            }

            // A true policy means ALWAYS allow requests
            if (policy === true) {
                var alwaysAllow = function alwaysAllow (req, res, next) {
                    next();
                };
                alwaysAllow._middlewareType  = 'POLICY: alwaysAllow';
                return [alwaysAllow];
            }

            // If we made it here, the policy is invalid
            sails.log.error('Cannot map invalid policy: ', policy);
            return [function(req, res) {
                throw new Error('Invalid policy: ' + policy);
            }];
        }
function (policy) {
            // Recursively normalize lists of policies
            if (_.isArray(policy)) {
                // Normalize each policy in the chain
                return _.flatten(
                    _.map(policy, function normalize_each_policy (policy) {
                        return policyHookDef.normalizePolicy(policy);
                    }));
            }

            // Look up the policy in the policy registry
            if (_.isString(policy)) {
                var policyFn = this.lookupFn(policy, 'config.policies');
                // Set the "policy" key on the policy function to the policy name, for debugging
                policyFn._middlewareType = 'POLICY: '+policy;
                return [policyFn];
            }

            /**
             * This line was added to support auto building of policies
             */
            if (_.isObject(policy) && policy.build) {
                policy = policy.build();
            }

            // An explicitly defined, anonymous policy middleware can be directly attached
            if (_.isFunction(policy)) {
                var anonymousPolicy = policy.bind({ });
                // Set the "policy" key on the function name (if any) for debugging
                anonymousPolicy._middlewareType = 'POLICY: '+ (anonymousPolicy.name || 'anonymous');
                return [anonymousPolicy];
            }

            // A false or null policy means NEVER allow any requests
            if (policy === false || policy === null) {
                var neverAllow = function neverAllow (req, res, next) {
                    res.send(403);
                };
                neverAllow._middlewareType = 'POLICY: neverAllow';
                return [neverAllow];
            }

            // A true policy means ALWAYS allow requests
            if (policy === true) {
                var alwaysAllow = function alwaysAllow (req, res, next) {
                    next();
                };
                alwaysAllow._middlewareType  = 'POLICY: alwaysAllow';
                return [alwaysAllow];
            }

            // If we made it here, the policy is invalid
            sails.log.error('Cannot map invalid policy: ', policy);
            return [function(req, res) {
                throw new Error('Invalid policy: ' + policy);
            }];
        }
Convert a single policy into shallow array notation
(look up string policies using middleware in this hook)

@param {Array|String|Function|Boolean} policy
@api private