Index: examples/python_tests/access_rt2/README
===================================================================
--- examples/python_tests/access_rt2/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/python_tests/access_rt2/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+#####################################################################
+# This directory contains examples that use libabac api call to
+# access and generate attribute policy rules using python
+#
+# Two pre-existing id credentials are generated using separate python
+# script
+
+
Index: examples/python_tests/access_rt2/access.save
===================================================================
--- examples/python_tests/access_rt2/access.save	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/python_tests/access_rt2/access.save	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,14 @@
+% Restoring file /usr/local/lib/Yap/startup.yss
+
+===good============ Alpha.access(Read,fileA)<-?-Bob
+YAP query succeed
+pAlpha.access('Read',F:pAlpha.documents(P)) <- pAlpha.team(P)
+pAlpha.documents('proj1') <- 'file//fileA'
+pAlpha.team('proj1') <- pBob
+
+===bad============ Alpha.access(Read,fileA)<-?-Joe
+YAP query failed
+
+===good============ Alpha.team(proj2)<-?-Joe
+YAP query succeed
+pAlpha.team('proj2') <- pJoe
Index: examples/python_tests/access_rt2/attr.py
===================================================================
--- examples/python_tests/access_rt2/attr.py	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/python_tests/access_rt2/attr.py	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,145 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./attr.py 
+expect this to fail,
+cmd2: env ABAC_CN=1 keystore=`pwd` ./attr.py
+
+"""
+
+import os
+import ABAC
+
+keystore=os.environ["keystore"]
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+ctxt.load_directory(keystore)
+
+out = ctxt.context_principals()
+print "...initial principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n" 
+
+out = ctxt.context_credentials()
+print "...initial policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+joeID=ABAC.ID("Joe", 0)
+ctxt.load_id(joeID)
+#joeID.write_privkey("Joe_IDKEY.pem")
+#joeID.write_cert("Joe_IDKEY.pem")
+joeID.write_privkey("Joe_private.pem")
+joeID.write_cert("Joe_ID.pem")
+joe=joeID.keyid()
+
+#ctxt.load_id_file("Alpha_ID.pem","Alpha_private.pem")
+alphaID=ABAC.ID("Alpha_ID.pem")
+alphaID.load_privkey("Alpha_private.pem");
+alpha=alphaID.keyid()
+
+#ctxt.load_id_file("Bob_ID.pem","Bob_private.pem")
+bobID=ABAC.ID("Bob_ID.pem")
+bobID.load_privkey("Bob_private.pem");
+bob=bobID.keyid()
+
+################################################
+# [keyid:alpha].role:access([string:'Read'],[urn:'file//fileB']) <- [keyid:bob]
+param1=ABAC.DataTerm("string", "'Read'")
+param2=ABAC.DataTerm("urn","'file//fileB'")
+role = ABAC.Role(alpha,"access")
+role.add_data_term(param1)
+role.add_data_term(param2)
+p = ABAC.Role(bob)
+attr=ABAC.Attribute(role, 1800)
+attr.add_tail(p)
+attr.bake()
+attr.write_cert("Alpha_access_fileB__Bob_attr.der")
+ctxt.load_attribute_file("Alpha_access_fileB__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+## [keyid:alpha].role:team([string:'proj1'])<-[keyid:bob]
+param1=ABAC.DataTerm("string", "'proj1'")
+role = ABAC.Role(alpha,"team")
+role.add_data_term(param1)
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(role, 1800)
+attr.add_tail(tail)
+attr.bake()
+attr.write_cert("Alpha_team_proj1__Bob_attr.der")
+ctxt.load_attribute_file("Alpha_team_proj1__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+## [keyid:alpha].role:team([string:'proj2'])<-[keyid:Joe]
+param1=ABAC.DataTerm("string", "'proj2'")
+role = ABAC.Role(alpha,"team")
+role.add_data_term(param1)
+tail = ABAC.Role(joe)
+attr=ABAC.Attribute(role, 1800)
+attr.add_tail(tail)
+attr.bake()
+attr.write_cert("Alpha_team_proj2__Joe_attr.der")
+ctxt.load_attribute_file("Alpha_team_proj2__Joe_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+## bad beause of that constraint.. 
+################################################
+# [keyid:alpha].role:access([string:'Read',
+#                [urn:?F[keyid:alpha].oset:documents([string:?P])])
+#                                 <- [keyid:alpha].role:team([string:?P]) 
+param=ABAC.DataTerm("string", "P")
+oset=ABAC.Oset(alpha,"documents")
+oset.add_data_term(param)
+cond=ABAC.Constraint(oset)
+param2=ABAC.DataTerm("urn", "F", cond)
+param1=ABAC.DataTerm("string", "'Read'")
+head = ABAC.Role(alpha,"access")
+head.add_data_term(param1)
+head.add_data_term(param2)
+param3=ABAC.DataTerm("string", "P")
+tail = ABAC.Role(alpha,"team")
+tail.add_data_term(param3)
+
+attr=ABAC.Attribute(head, 1800)
+attr.add_tail(tail)
+attr.bake()
+attr.write_cert("Alpha_access_qFqP__alpha_team_qP_attr.der")
+#ctxt.load_attribute_file("Alpha_access_qFqP__alpha_team_qP_attr.der")
+ctxt.load_attribute(attr)
+#print attr.string() 
+#print attr.typed_string()
+#print "\n"
+
+
+#################################################
+## [keyid:alpha].oset:documents([string:'proj1'])<-[urn:'file//fileA']
+param1=ABAC.DataTerm("string", "'proj1'")
+oset = ABAC.Oset(alpha,"documents")
+oset.add_data_term(param1)
+obj = ABAC.DataTerm("urn", "'file//fileA'")
+tail= ABAC.Oset(obj)
+attr=ABAC.Attribute(oset, 1800)
+attr.add_tail(tail)
+attr.bake()
+attr.write_cert("Alpha_team_proj1__fileA_attr.der")
+ctxt.load_attribute_file("Alpha_team_proj1__fileA_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#ctxt.dump_yap()
+##
Index: examples/python_tests/access_rt2/query.py
===================================================================
--- examples/python_tests/access_rt2/query.py	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/python_tests/access_rt2/query.py	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,82 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./query.py 
+cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# print "ABAC version %s" % ctxt.version()
+
+keystore=os.environ["keystore"]
+
+ctxt.load_directory(keystore)
+
+alphaID=ABAC.ID("Alpha_ID.pem");
+alphaID.load_privkey("Alpha_private.pem");
+#ctxt.load_id(alphaID)
+alpha=alphaID.keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.load_privkey("Bob_private.pem");
+#ctxt.load_id(bobID)
+bob=bobID.keyid()
+
+joeID=ABAC.ID("Joe_ID.pem");
+joeID.load_privkey("Joe_private.pem");
+joe=joeID.keyid()
+
+
+##########################################################################
+# role =[keyid:alpha].role:access([string:'Read'],[urn:'file//fileA'])
+# p = "[keyid:bob]" 
+param1=ABAC.DataTerm("string", "'Read'")
+param2=ABAC.DataTerm("urn","'file//fileA'")
+role = ABAC.Role(alpha,"access")
+role.add_data_term(param1)
+role.add_data_term(param2)
+p = ABAC.Role(bob)
+
+print "\n===good============ Alpha.access(Read,fileA)<-?-Bob"
+out = ctxt.query(role, p)
+
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role =[keyid:alpha].role:access([string:'Read'],[urn:'file//fileA'])
+# p = "[keyid:joe]" 
+param1=ABAC.DataTerm("string", "'Read'")
+param2=ABAC.DataTerm("urn","'file//fileA'")
+role = ABAC.Role(alpha,"access")
+role.add_data_term(param1)
+role.add_data_term(param2)
+p = ABAC.Role(joe)
+
+print "\n===bad============ Alpha.access(Read,fileA)<-?-Joe"
+out = ctxt.query(role,p)
+
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+##########################################################################
+# role =[keyid:alpha].role:team([string:'proj2'])
+# p = "[keyid:joe]" 
+param=ABAC.DataTerm("string", "'proj2'")
+role = ABAC.Role(alpha,"team")
+role.add_data_term(param)
+p = ABAC.Role(joe)
+print "\n===good============ Alpha.team(proj2)<-?-Joe"
+out = ctxt.query(role,p)
+
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
Index: examples/python_tests/access_rt2/run_test
===================================================================
--- examples/python_tests/access_rt2/run_test	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/python_tests/access_rt2/run_test	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,38 @@
+#!/bin/sh 
+
+ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+export ABAC_PROVER_PATH
+
+echo '---setup principals'
+# Two pre-existing id credentials are generated using separate python
+# script (just to show we can)
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+# Add policy attribute credentials along with a new id credential
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1>/dev/null 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > access.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>access.cn 2>&1
+
+result=`diff access.cn access.save 2>/dev/null`
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:access_rt2 test result differs!!!"
+    fi
+else
+    echo "   ERROR:access_rt2 test result differs!!!"
+fi
+
+
Index: examples/python_tests/access_rt2/setup.py
===================================================================
--- examples/python_tests/access_rt2/setup.py	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/python_tests/access_rt2/setup.py	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,19 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+id=ABAC.ID("Alpha", 0)
+id.write_cert("Alpha_ID.pem")
+id.write_privkey("Alpha_private.pem")
+
+id=ABAC.ID("Bob", 0)
+id.write_cert("Bob_ID.pem")
+id.write_privkey("Bob_private.pem")
