Index: examples/python_tests/file_read_rt2/README
===================================================================
--- examples/python_tests/file_read_rt2/README	(revision 5f551d32ce8befe42bdd0b6cc9391e217749c595)
+++ examples/python_tests/file_read_rt2/README	(revision 5f551d32ce8befe42bdd0b6cc9391e217749c595)
@@ -0,0 +1,96 @@
+#!/bin/sh
+#
+#####################################################################
+# This example demonstrates using a parameters to control access to files based
+# on the attributes of the principals.  The script creates three principals
+# Alpha, Bob, Maryann and Joe and sets out the access policy.
+# 
+# files are named by URNs and are not principals.
+# 
+# A principal's access rights are controlled by the Alpha principal.  If a
+# principal has the role role::read(urn:filename) that
+# principal can read filename.  The policy is that the manager of the owner of
+# a file can read it. (Presumably the owner can, too, but that is not encoded
+# here.)
+# 
+# The example below lays out the policy that the manager of the owner of a file
+# can read it in Credential 1. Credential 2 establishes Bob as the manager of
+# Joe. and Credential 3 establishes Joe as the owner of the file.
+#
+# The attached ./run_query file runs 2 queries.  First it confirms that Bob can read
+# fileA, then it confirms that Maryann cannot. 
+
+# file_read_rt2_typed
+
+# alpha.read(fileA) <-?- Bob
+#[keyid:Alpha].role:read([urn:'file://fileA']) <-?- [keyid:Bob] (yes)
+#[keyid:Alpha].role:read([urn:'file://fileA']) <-?- [keyid:Maryann] (yes)
+
+creddy --generate --cn Alpha
+creddy --generate --cn Bob
+creddy --generate --cn Maryann
+creddy --generate --cn Joe
+
+alpha_keyid=`creddy --keyid --cert Alpha_ID.pem`
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
+joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+
+read_fileA="read([urn:'file://fileA'])"
+managerof_joe="managerOf([keyid:$joe_keyid])"
+ownerof_fileA="ownerOf([urn:'file://fileA'])"
+managerof_qE="managerOf([principal:?E[keyid:$alpha_keyid].role:ownerOf([urn:?F])])"
+
+# alpha.read(?F) <- alpha.managerOf(?E:alpha.ownerOf(?F))
+# [keyid:alpha].role:read([urn:?F])<-
+#    [keyid:alpha].role:managerOf([principal:?E[keyid:alpha].role:ownerOf([urn:?F])]
+# Credential 1
+creddy --attribute \
+       --issuer Alpha_ID.pem --key Alpha_private.pem --role "read([urn:?F])" \
+       --subject-cert Alpha_ID.pem --subject-role "$managerof_qE" \
+       --out Alpha_read_qF__alpha_managerof_qE_attr.der
+
+# Credential 2
+#[keyid:Alpha].role:managerOf([Keyid:Joe]) <- [keyid:Bob]
+creddy --attribute \
+        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$managerof_joe" \
+        --subject-cert Bob_ID.pem \
+        --out Alpha_managerof_Joe__Bob_attr.der
+
+# Credential 3
+#[keyid:Alpha].role:ownerOf([urn:'file://fileA']) <- [keyid:Joe]
+creddy --attribute \
+        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$ownerof_fileA" \
+        --subject-cert Joe_ID.pem \
+        --out Alpha_ownerof_fileA__Joe_attr.der
+
+####################################################################################
+# note:
+# 
+# alpha.read(?F) <- alpha.manager(?E:alpha.owner(?F))
+# [keyid:alpha].role:read([urn:?F])<-
+#       #[keyid:alpha].role:manager([principal:?E[keyid:alpha].role:owner([urn:?F])])
+# 
+# alpha.read(?F) <- alpha.manager(?E) 
+# and alpha.owner(?F) <- ?E
+# 
+# [keyid:alpha].role:read([urn:?F])<-[keyid:?M]
+#     [keyid:alpha].role:manager([principal:?E])<-[keyid:?M]
+#     [keyid:alpha].role:owner([urn:?F])<-[keyid:?E]
+# 
+# isMember(M,role(alpha,read,F)) :-
+#       isMember(M, role(alpha,manager,E)),
+#       isMember(E, role(alpha,owner,F))  <-- constraining rule
+# 
+# alpha.read(?F) <- alpha.manager(?E)
+# alpha.owner(?F) <- ?E
+# 
+# condition like this,
+#          ?E:A.r  needs to be translate into constraining rule,  A.r<-?E
+# 
+# query,
+# alpha.read(fileA) <-?- Bob
+# needs
+# alpha.manager(Joe)<-Bob
+# alpha.owner(fileA)<-Joe
+
Index: examples/python_tests/file_read_rt2/attr.py
===================================================================
--- examples/python_tests/file_read_rt2/attr.py	(revision 5f551d32ce8befe42bdd0b6cc9391e217749c595)
+++ examples/python_tests/file_read_rt2/attr.py	(revision 5f551d32ce8befe42bdd0b6cc9391e217749c595)
@@ -0,0 +1,104 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./attr.py 
+"""
+
+import os
+import ABAC
+
+keystore=os.environ["keystore"]
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+ctxt.load_directory(keystore)
+
+out = ctxt.context_principals()
+print "...initial principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n" 
+
+out = ctxt.context_credentials()
+print "...initial policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+alphaID=ABAC.ID("Alpha_ID.pem")
+alphaID.id_load_privkey_file("Alpha_private.pem");
+alpha=alphaID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem")
+bobID.id_load_privkey_file("Bob_private.pem");
+bob=bobID.id_keyid()
+
+maryannID=ABAC.ID("Maryann_ID.pem")
+maryannID.id_load_privkey_file("Maryann_private.pem")
+maryann=maryannID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem")
+joeID.id_load_privkey_file("Joe_private.pem")
+joe=joeID.id_keyid()
+
+
+################################################
+# [keyid:alpha].role:read([urn:?F])<-
+#    [keyid:alpha].role:managerOf([principal:?E[keyid:alpha].role:ownerOf([urn:?F])]
+param=ABAC.DataTerm("urn", "F")
+head = ABAC.Role(alpha,"read")
+head.role_add_data_term(param)
+param=ABAC.DataTerm("urn", "F")
+condoset=ABAC.Role(alpha,"ownerOf")
+condoset.role_add_data_term(param)
+cond=ABAC.Constraint(condoset)
+param=ABAC.DataTerm("principal", "E", cond)
+tail = ABAC.Role(alpha,"managerOf")
+tail.role_add_data_term(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_read_qF__alpha_managerof_qE_attr.der")
+ctxt.load_attribute_file("Alpha_read_qF__alpha_managerof_qE_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:Alpha].role:managerOf([Keyid:Joe]) <- [keyid:Bob]
+#
+param=ABAC.DataTerm(joeID)
+role = ABAC.Role(alpha,"managerOf")
+role.role_add_data_term(param)
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(role, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_managerof_Joe__Bob_attr.der")
+ctxt.load_attribute_file("Alpha_managerof_Joe__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+#[keyid:Alpha].role:ownerOf([urn:'file://fileA']) <- [keyid:Joe]
+#
+param=ABAC.DataTerm("urn", "'file://fileA'")
+role = ABAC.Role(alpha,"ownerOf")
+role.role_add_data_term(param)
+tail = ABAC.Role(joe)
+attr=ABAC.Attribute(role, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_ownerof_fileA__Joe_attr.der")
+ctxt.load_attribute_file("Alpha_ownerof_fileA__Joe_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+
+ctxt.dump_yap_db()
+##
Index: examples/python_tests/file_read_rt2/file.save
===================================================================
--- examples/python_tests/file_read_rt2/file.save	(revision 5f551d32ce8befe42bdd0b6cc9391e217749c595)
+++ examples/python_tests/file_read_rt2/file.save	(revision 5f551d32ce8befe42bdd0b6cc9391e217749c595)
@@ -0,0 +1,25 @@
+% Restoring file /usr/local/lib/Yap/startup.yss
+
+===good============ alpha.read(fileA) <- Bob
+YAP query succeed
+pAlpha.read(F) <- pAlpha.managerOf(E:pAlpha.ownerOf(F))
+pAlpha.ownerOf('file://fileA') <- pJoe
+pAlpha.managerOf(pJoe) <- pBob
+
+===bad============ alpha.read(fileA) <- Maryann
+YAP query failed
+
+...final principal set...
+(pAlpha,keyid,y) 
+(pBob,keyid,y) 
+(pJoe,keyid,y) 
+(pMaryann,keyid,y) 
+
+
+
+...final policy attribute set...
+pAlpha.managerOf(pJoe) <- pBob
+pAlpha.ownerOf('file://fileA') <- pJoe
+pAlpha.read(F) <- pAlpha.managerOf(E:pAlpha.ownerOf(F))
+
+
Index: examples/python_tests/file_read_rt2/query.py
===================================================================
--- examples/python_tests/file_read_rt2/query.py	(revision 5f551d32ce8befe42bdd0b6cc9391e217749c595)
+++ examples/python_tests/file_read_rt2/query.py	(revision 5f551d32ce8befe42bdd0b6cc9391e217749c595)
@@ -0,0 +1,75 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./query.py 
+cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# print "ABAC version %s" % ctxt.version()
+
+keystore=os.environ["keystore"]
+
+ctxt.load_directory(keystore)
+
+alphaID=ABAC.ID("Alpha_ID.pem")
+alphaID.id_load_privkey_file("Alpha_private.pem");
+alpha=alphaID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem")
+bobID.id_load_privkey_file("Bob_private.pem");
+bob=bobID.id_keyid()
+
+maryannID=ABAC.ID("Maryann_ID.pem")
+maryannID.id_load_privkey_file("Maryann_private.pem")
+maryann=maryannID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem")
+joeID.id_load_privkey_file("Joe_private.pem")
+joe=joeID.id_keyid()
+
+##########################################################################
+# role=[keyid:Alpha].role:read([urn:'file://fileA']) 
+# p=[keyid:Bob]
+param=ABAC.DataTerm("urn", "'file://fileA'")
+role = ABAC.Role(alpha,"read")
+role.role_add_data_term(param)
+p=ABAC.Role(bob)
+print "\n===good============ alpha.read(fileA) <- Bob"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role=[keyid:Alpha].role:read([urn:'file://fileA']) 
+# p=[keyid:Maryann]
+param=ABAC.DataTerm("urn", "'file://fileA'")
+role = ABAC.Role(alpha,"read")
+p=ABAC.Role(maryann)
+print "\n===bad============ alpha.read(fileA) <- Maryann"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+##########################################################################
+# dump the loaded principals/policies 
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n"
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
Index: examples/python_tests/file_read_rt2/run_test
===================================================================
--- examples/python_tests/file_read_rt2/run_test	(revision 5f551d32ce8befe42bdd0b6cc9391e217749c595)
+++ examples/python_tests/file_read_rt2/run_test	(revision 5f551d32ce8befe42bdd0b6cc9391e217749c595)
@@ -0,0 +1,36 @@
+#!/bin/sh 
+
+ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+export ABAC_PROVER_PATH
+
+
+echo '---setup principals'
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1>/dev/null 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > file.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>file.cn 2>&1
+
+result=`diff file.cn file.save 2>/dev/null`
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:file_read_rt2 test result differs!!!"
+    fi
+else
+    echo "   ERROR:file_read_rt2 test result differs!!!"
+fi
+
+
Index: examples/python_tests/file_read_rt2/setup.py
===================================================================
--- examples/python_tests/file_read_rt2/setup.py	(revision 5f551d32ce8befe42bdd0b6cc9391e217749c595)
+++ examples/python_tests/file_read_rt2/setup.py	(revision 5f551d32ce8befe42bdd0b6cc9391e217749c595)
@@ -0,0 +1,27 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+alphaID=ABAC.ID("Alpha", 0)
+alphaID.id_write_cert("Alpha_ID.pem")
+alphaID.id_write_privkey("Alpha_private.pem")
+
+bobID=ABAC.ID("Bob", 0)
+bobID.id_write_cert("Bob_ID.pem")
+bobID.id_write_privkey("Bob_private.pem")
+
+maryannID=ABAC.ID("Maryann", 0)
+maryannID.id_write_cert("Maryann_ID.pem")
+maryannID.id_write_privkey("Maryann_private.pem")
+
+joeID=ABAC.ID("Joe", 0)
+joeID.id_write_cert("Joe_ID.pem")
+joeID.id_write_privkey("Joe_private.pem")
