Index: libabac/abac_pl_yy.c
===================================================================
--- libabac/abac_pl_yy.c	(revision 9335cfa1f9ee260325c436b438f6063dfd4ec4e7)
+++ libabac/abac_pl_yy.c	(revision 8bd77b59df89993868555d3b87f91fc241b09228)
@@ -18,12 +18,9 @@
 extern char *generate_pl_range_constraint(char *,char *,char *,char *);
 extern char *generate_pl_range_time_constraint(char *,char *,char *);
-extern char *generate_pl_oset_constraint_clause(abac_oset_t *, char *);
-extern abac_list_t *generate_pl_role_clauses(abac_role_t *, abac_role_t *);
-extern abac_list_t *generate_pl_oset_clauses(abac_oset_t *, abac_oset_t *);
-extern char* generate_pl_role_constraint_clause(abac_role_t *, char *);
+extern abac_list_t *generate_pl_clauses(abac_aspect_t *, abac_aspect_t *);
+extern char* generate_pl_constraint_clause(abac_aspect_t *, char *);
 extern char *generate_pl_type_clause(char *, int);
 /* from abac_pl_yap.c */
-extern char *abac_pl_add_range_constraint_clause(char *var, 
-	char *tmplist);
+extern char *abac_pl_add_range_constraint_clause(char *var, char *tmplist);
 /* from rt2.y */
 extern void abac_yyinit();
@@ -34,8 +31,6 @@
 abac_list_t *abac_rule_clauses=NULL;
 abac_stack_t *abac_rule_id_clauses=NULL; /* tracking individual id credentials */
-abac_role_t *abac_rule_head_role=NULL;
-abac_role_t *abac_rule_tail_role=NULL;
-abac_oset_t *abac_rule_head_oset=NULL;
-abac_oset_t *abac_rule_tail_oset=NULL;
+abac_aspect_t *abac_rule_head_aspect=NULL;
+abac_aspect_t *abac_rule_tail_aspect=NULL;
 
 /* to track id certs within a rule clause */
@@ -80,5 +75,5 @@
     char *name;
     char *cond_str;
-    void *cond_ptr; // ptr to a saved abac_role_t
+    void *cond_ptr; // ptr to a saved abac_aspect_t
     abac_yy_expression_t *cond_head_expr;
 };
@@ -98,5 +93,5 @@
     char *name;
     char *cond_str;
-    void *cond_ptr; // ptr to a saved abac_oset_t
+    void *cond_ptr; // ptr to a saved abac_aspect_t
     abac_list_t *cond_range;
     abac_yy_expression_t *cond_head_expr; // parking stub
@@ -119,21 +114,15 @@
 };
 
-/* local role structure */
-struct _abac_yy_role_t {
+/* local role/oset structure, 
+   e_yy_NULL_TYPE, e_yy_ROLE_TYPE, e_yy_OSET_TYPE 
+*/
+struct _abac_yy_roleoset_t {
    int type;
    char *name;
    abac_yy_term_t *terms;
-   struct _abac_yy_role_t *next;
+   struct _abac_yy_roleoset_t *next;
    int bcnt; /* this is to track number of roles in this linked up list */
 };
 
-/* local oset structure */
-struct _abac_yy_oset_t {
-   int type;
-   char *name;
-   abac_yy_term_t *terms;
-   struct _abac_yy_oset_t *next;
-   int bcnt; /* this is to track number of oset in this linked up list */
-};
 
 /* A, A.r, A.r.r */
@@ -147,9 +136,7 @@
        abac_yy_term_data_t *object;
    };
-   abac_yy_role_t *linked_role;
-   union {
-       abac_yy_role_t *role;
-       abac_yy_oset_t *oset;
-   };
+   abac_yy_roleoset_t *linked_role;
+   abac_yy_roleoset_t *roleoset;
+   
    struct _abac_yy_expression_t *next;
    int bcnt;
@@ -209,27 +196,17 @@
 }
 
-int abac_yy_get_rule_is_oset()
+bool abac_yy_get_rule_is_oset()
 {
    return abac_rule_is_oset;
 }
 
-abac_role_t *abac_yy_get_rule_head_role()
-{
-    return abac_rule_head_role;
-}
-
-abac_role_t *abac_yy_get_rule_tail_role()
-{
-    return abac_rule_tail_role;
-}
-
-abac_oset_t *abac_yy_get_rule_head_oset()
-{
-    return abac_rule_head_oset;
-}
-
-abac_oset_t *abac_yy_get_rule_tail_oset()
-{
-    return abac_rule_tail_oset;
+abac_aspect_t *abac_yy_get_rule_head_aspect()
+{
+    return abac_rule_head_aspect;
+}
+
+abac_aspect_t *abac_yy_get_rule_tail_aspect()
+{
+    return abac_rule_tail_aspect;
 }
 
@@ -329,13 +306,13 @@
         switch (type) {
             case e_yy_RANGE_MIN:
-                min=strdup(cur->val);
+                min=abac_xstrdup(cur->val);
                 break;
             case e_yy_RANGE_MAX:
-                max=strdup(cur->val);
+                max=abac_xstrdup(cur->val);
                 break;
             case e_yy_RANGE_TARGET:
                 if(val)
                     asprintf(&val,"%s,%s",val,cur->val);
-                else val=strdup(cur->val);
+                else val=abac_xstrdup(cur->val);
                 break;
         }
@@ -370,5 +347,5 @@
          (abac_yy_range_t *) abac_xmalloc(sizeof(abac_yy_range_t));
     range->type=e_yy_RANGE_TARGET;
-    range->val=strdup(val);
+    range->val=abac_xstrdup(val);
     abac_list_add(ptr, range);
     return ptr;
@@ -380,5 +357,5 @@
          (abac_yy_range_t *) abac_xmalloc(sizeof(abac_yy_range_t));
     range->type=type;
-    range->val=strdup(val);
+    range->val=abac_xstrdup(val);
     abac_list_add(ptr, range);
     return ptr;
@@ -432,5 +409,5 @@
 void set_yy_term_data_name(abac_yy_term_data_t *ptr, char *name)
 {
-    ptr->name=strdup(name);
+    ptr->name=abac_xstrdup(name);
 }
 
@@ -445,5 +422,5 @@
 }
 
-int is_yy_term_data_has_constraint(abac_yy_term_data_t *ptr)
+bool is_yy_term_data_has_constraint(abac_yy_term_data_t *ptr)
 {
     if(ptr->cond_head_expr != NULL)
@@ -482,5 +459,5 @@
 }
 
-int is_yy_term_data_type_numeric(abac_yy_term_data_t *ptr)
+bool is_yy_term_data_type_numeric(abac_yy_term_data_t *ptr)
 {
     if(ptr->type==abac_term_verify_term_type("integer") ||
@@ -490,5 +467,5 @@
 }
 
-int is_yy_term_data_type_time(abac_yy_term_data_t *ptr)
+bool is_yy_term_data_type_time(abac_yy_term_data_t *ptr)
 {
     if(ptr->type==abac_term_verify_term_type("time"))
@@ -497,5 +474,5 @@
 }
 
-int is_yy_term_data_type_alpha(abac_yy_term_data_t *ptr)
+bool is_yy_term_data_type_alpha(abac_yy_term_data_t *ptr)
 {
     if(ptr->type==abac_term_verify_term_type("string") ||
@@ -513,5 +490,5 @@
 void set_yy_term_data_cond_str(abac_yy_term_data_t *ptr, char *cond)
 {
-    ptr->cond_str=strdup(cond);
+    ptr->cond_str=abac_xstrdup(cond);
 }
 
@@ -688,5 +665,5 @@
     abac_yy_constraint_t *ptr=
         (abac_yy_constraint_t *) abac_xmalloc(sizeof(abac_yy_constraint_t));
-    ptr->clause=strdup(constraint);
+    ptr->clause=abac_xstrdup(constraint);
     abac_list_add(abac_yy_constraints, ptr);
     return ptr;
@@ -767,16 +744,17 @@
 
 /*************************************************************************/
-
-abac_yy_role_t *make_yy_role(char *name, abac_yy_term_t *terms)
-{
-    abac_yy_role_t *ptr=(abac_yy_role_t*)abac_xmalloc(sizeof(abac_yy_role_t));
+abac_yy_roleoset_t *make_yy_roleoset_role(char *name, abac_yy_term_t *terms)
+{
+    abac_yy_roleoset_t *ptr=
+         (abac_yy_roleoset_t*)abac_xmalloc(sizeof(abac_yy_roleoset_t));
     ptr->name=abac_xstrdup(name);
     ptr->terms=terms;
     ptr->next=NULL;
     ptr->bcnt=1;
-    return ptr;
-}
-
-static void _free_yy_role(abac_yy_role_t *ptr)
+    ptr->type=e_yy_ROLE_TYPE;
+    return ptr;
+}
+
+static void _free_yy_roleoset(abac_yy_roleoset_t *ptr)
 {
     free(ptr->name);
@@ -784,33 +762,27 @@
         _free_yy_term(ptr->terms);
     if(ptr->next)
-        _free_yy_role(ptr->next);
+        _free_yy_roleoset(ptr->next);
     free(ptr);
 }
 
 /***************************************************************************/
-abac_yy_oset_t *make_yy_oset(char *name, abac_yy_term_t *terms)
-{
-    abac_yy_oset_t *ptr=(abac_yy_oset_t*)abac_xmalloc(sizeof(abac_yy_oset_t));
+abac_yy_roleoset_t *make_yy_roleoset_oset(char *name, abac_yy_term_t *terms)
+{
+    abac_yy_roleoset_t *ptr=
+           (abac_yy_roleoset_t*)abac_xmalloc(sizeof(abac_yy_roleoset_t));
     ptr->name=abac_xstrdup(name);
     ptr->terms=terms;
     ptr->next=NULL;
     ptr->bcnt=1;
-    return ptr;
-}
-
-static void _free_yy_oset(abac_yy_oset_t *ptr)
-{
-    free(ptr->name);
-    if(ptr->terms)
-        _free_yy_term(ptr->terms);
-    if(ptr->next)
-        _free_yy_oset(ptr->next);
-    free(ptr);
-}
+    ptr->type=e_yy_OSET_TYPE;
+    return ptr;
+}
+
 /***************************************************************************/
 
 /* type: e_yy_EXPR_NAMED, e_yy_EXPR_OBJECT, e_yy_EXPR_OSET,e_yy_EXPR_LINKED */
 
-abac_yy_expression_t *make_yy_expression(int type,void *pptr, void *optr, abac_yy_role_t *linked_role)
+abac_yy_expression_t *make_yy_expression(int type,void *pptr, 
+abac_yy_roleoset_t *optr, abac_yy_roleoset_t *linked_role)
 {
     abac_yy_expression_t *ptr=
@@ -822,8 +794,5 @@
             ptr->principal = (abac_yy_principal_t *)pptr;
     }
-    if(type == e_yy_EXPR_OSET)
-        ptr->oset = (abac_yy_oset_t *) optr;
-        else
-            ptr->role = (abac_yy_role_t *) optr;
+    ptr->roleoset = optr;
     ptr->linked_role=linked_role;
     ptr->next=NULL;
@@ -857,13 +826,7 @@
                _free_yy_principal(ptr->principal);
     }
-    if(ptr->type == e_yy_EXPR_OSET) {
-        if(ptr->oset) 
-            _free_yy_oset(ptr->oset);
-        } else {
-            if(ptr->role)
-                 _free_yy_role(ptr->role);
-    }
+    if(ptr->roleoset) _free_yy_roleoset(ptr->roleoset);
     if(ptr->linked_role)
-        _free_yy_role(ptr->linked_role);
+        _free_yy_roleoset(ptr->linked_role);
     if(ptr->next)
         _free_yy_expression(ptr->next);
@@ -873,538 +836,46 @@
 
 /***************************************************************************/
-static void _oset_add_terms(int linked, abac_oset_t *oset, 
-abac_yy_term_t *terms)
-{
-    abac_yy_term_t *curr = terms;
-    int type;
-
-    while (curr) {
-        char *name=NULL;
-        char *cond=NULL;
-        void *ptr=NULL;
-        switch (curr->type) {
-           case e_yy_DTERM_DATA:
-           {
-               abac_yy_term_data_t *ptr=curr->term.d_ptr;
-               type=ptr->type;
-               name=abac_xstrdup(ptr->name);
-               if(ptr->cond_str)
-                  cond=abac_xstrdup(ptr->cond_str);
-                  else cond=NULL;
-               ptr=ptr->cond_ptr;
-               break;
-           }
-           case e_yy_DTERM_PRINCIPAL:
-           {
-               abac_yy_term_principal_t *ptr=curr->term.p_ptr;
-               type=abac_term_verify_term_type("principal");
-               name=abac_xstrdup(ptr->name);
-               if(ptr->cond_str)
-                  cond=abac_xstrdup(ptr->cond_str);
-                  else cond=NULL;
-               ptr=ptr->cond_ptr;
-               break;
-           }
-           case e_yy_DTERM_NAMED:
-           {
-              abac_yy_principal_t *ptr=curr->term.n_ptr;
-              type=ptr->type;
-              name=abac_xstrdup(get_yy_principal_name(ptr));
-              cond=NULL;
-              ptr=NULL;
-              break;
-           }
-           case e_yy_DTERM_ANONYMOUS:
-           {
-              type=0;
-              name=abac_xstrdup("_");
-              cond=NULL;
-              ptr=NULL;
-              break;
-           }
-       }
-
-       abac_term_t *param=abac_term_new(type,name,cond,ptr);
-       if (linked) 
-           abac_oset_oset_add_linked_param(oset, param);
-           else
-                abac_oset_oset_add_param(oset, param);
-       curr=curr->next;
-   }
-}
-
-static void _oset_add_linked_terms(abac_oset_t *oset, abac_yy_term_t *terms)
-{
-    int linked=1;
-    _oset_add_terms(linked, oset, terms);
-}
-
-static void _oset_add_oset_terms(abac_oset_t *oset, abac_yy_term_t *terms)
-{
-    int linked=0;
-    _oset_add_terms(linked, oset, terms);
-}
-
-
-abac_oset_t *validate_intersected_tail_oset(abac_oset_t *oset)
-{
-    abac_oset_t *ret_oset=NULL;
-    abac_list_t *prereqs = abac_list_new();
-    abac_list_add(prereqs, oset);
-    ret_oset = abac_oset_intersection_new("intersectingOSET", prereqs);
-    return ret_oset;
-}
-
-/* A.oset */
-abac_oset_t *validate_head_oset(abac_yy_expression_t *expr)
-{
-     abac_yy_principal_t *principal=expr->principal;
-     abac_yy_oset_t *oset=expr->oset;
-    
-     char *principalname=get_yy_principal_sha(principal);
-     char *othername=get_yy_principal_name(principal);
-     char *osetname=oset->name;
-     abac_yy_term_t *terms=oset->terms;
-
-     abac_oset_t *ret_oset=abac_oset_oset_new(principalname, osetname);
-     if (ret_oset==NULL) {
-         abac_yy_set_error_code(ABAC_RT_ROLE_INVALID);
-         goto error;
-     }
-     if (!abac_oset_is_oset(ret_oset)) {
-         abac_yy_set_error_code(ABAC_RT_CERT_INVALID);
-         goto error;
-     }
-     // insert the params for the oset
-     if(terms) {
-          _oset_add_oset_terms(ret_oset, terms);
-     }
-
-     _add_yy_id_certs(othername,get_yy_principal_type(principal));
-
-     return ret_oset;
-
-error:
-     return NULL;
-}
-
-/* B */
-abac_oset_t *validate_named_tail_oset(abac_yy_expression_t *expr)
-{
-     abac_yy_principal_t *principal=expr->principal;
-     char *principalname=get_yy_principal_sha(principal);
-     char *othername=get_yy_principal_name(principal);
-     abac_oset_t *ret_oset=NULL;
-
-     ret_oset = abac_oset_principal_new(principalname);
-
-     _add_yy_id_certs(othername,get_yy_principal_type(principal));
-
-     if (ret_oset==NULL)
-         goto error;
-     return ret_oset;
-
-error:
-     panic("can not generate a simple named tail oset");
-     return NULL;
-}
-
-
-/* [keyid:alpha].oset:documents([string:'proj1'])<-[urn:'file//fileA'] */
-abac_oset_t *validate_object_tail_oset(abac_yy_expression_t *expr)
-{
-     abac_yy_term_data_t *object=get_yy_expression_object(expr);
-     assert(object != NULL);
-
-     char *name=object->name;
-     int type=object->type;
-     char *cond=object->cond_str;
-     void *ptr=object->cond_ptr;
-     abac_term_t *term=abac_term_new(type,name,cond,ptr);
-     abac_oset_t *ret_oset=abac_oset_object_new(term);
-
-     if(get_yy_term_data_is_variable(object))
-         _add_yy_id_certs(name,type);
-
-     if (ret_oset==NULL)
-         goto error;
-     return ret_oset;
-
-error:
-     panic("can not generate a simple object tail oset");
-     return NULL;
-}
-
-
-/* B.oset */
-abac_oset_t *validate_oset_tail_oset(abac_yy_expression_t *expr)
-{
-     abac_yy_principal_t *principal=expr->principal;
-     abac_yy_oset_t *oset=expr->oset;
-
-     char *principalname=get_yy_principal_sha(principal);
-     char *othername=get_yy_principal_name(principal);
-
-     char *osetname=oset->name;
-     abac_yy_term_t *terms=oset->terms;
-
-     int ret;
-     abac_oset_t *ret_oset=NULL;
-
-     ret_oset = abac_oset_oset_new(principalname, osetname);
-     if (ret_oset==NULL)
-         goto error;
-
-     if(terms) {
-         _oset_add_oset_terms(ret_oset, terms);
-     }
-
-     _add_yy_id_certs(othername,get_yy_principal_type(principal));
-
-     return ret_oset;
-
-error:
-     panic("can not generate a simple tail oset");
-     return NULL;
-}
-
-/* B.role.oset */
-abac_oset_t *validate_linked_tail_oset(abac_yy_expression_t *expr)
-{
-     abac_yy_principal_t *principal=expr->principal;
-     abac_yy_oset_t *oset=expr->oset;
-     abac_yy_role_t *linked_role=expr->linked_role;
-
-     char *principalname=get_yy_principal_sha(principal);
-     char *othername=get_yy_principal_name(principal);
-
-     char *osetname=oset->name;
-     abac_yy_term_t *terms=oset->terms;
-
-     char *linkedrolename=linked_role->name;
-     abac_yy_term_t *linked_terms=linked_role->terms;
-
-     int ret;
-     abac_oset_t *ret_oset=abac_oset_linking_new(principalname,
-                                            linkedrolename, osetname);
-     if (ret_oset==NULL)
-         goto error;
-
-     if(linked_terms) {
-         _oset_add_linked_terms(ret_oset, linked_terms);
-     }
-     if(terms) {
-         _oset_add_oset_terms(ret_oset, terms);
-     }
-
-     _add_yy_id_certs(othername,get_yy_principal_type(principal));
-
-     return ret_oset;
-
-error:
-     panic("can not generate linked tail oset");
-     return NULL;
-}
-
-
-
-abac_list_t *make_oset_statement(abac_yy_expression_t *headexpr,
-                       abac_yy_expression_t *tailexpr) 
-{ 
-    abac_oset_t *head_oset=NULL;
-    abac_oset_t *tail_oset=NULL;
-
-/* build up left side's abac oset structure */
-    head_oset=validate_head_oset(headexpr);
-    if(head_oset == NULL)
-        goto error;
-
-/* build up the right side's abac oset structure */
-    abac_yy_expression_t *curr_tail = tailexpr;
-    int intersecting=(tailexpr->next != NULL)? 1:0;
-    abac_oset_t *curr_oset = NULL;
-        while (curr_tail) {
-            switch(curr_tail->type) {
-                case e_yy_EXPR_OBJECT:
-                    curr_oset=validate_object_tail_oset(curr_tail);
-                    break;
-                case e_yy_EXPR_NAMED:
-                    curr_oset=validate_named_tail_oset(curr_tail);
-                    break;
-                case e_yy_EXPR_OSET:
-                    curr_oset=validate_oset_tail_oset(curr_tail);
-                    break;
-                case e_yy_EXPR_LINKED:
-                    curr_oset=validate_linked_tail_oset(curr_tail);
-                    break;
-            }
-            if(curr_oset==NULL)
-                goto error;
-
-            /* check if first one */
-            if(tail_oset==NULL) {
-                if(intersecting) 
-                    tail_oset=validate_intersected_tail_oset(curr_oset);
-                    else 
-                        tail_oset=curr_oset;
-                } else {  
-                    abac_oset_add_intersecting_oset(tail_oset,curr_oset);
-            }
-            curr_tail=curr_tail->next;
-        } /* while */
-
-/* XXX collect up type clauses, constraint clauses and 
-   generate rule clauses */
-        abac_list_t *tmp=generate_pl_oset_clauses(head_oset,tail_oset);
-        if(tmp == NULL)
-            goto error;
-
-        if(debug) {
-            abac_print_oset_string_with_condition(head_oset,NULL);
-            printf("\n");
-            abac_print_oset_string_with_condition(tail_oset,NULL);
-            printf("\n");
-        }
-
-        _free_yy_expression(headexpr);
-        _free_yy_expression(tailexpr);
-        abac_rule_head_oset=head_oset;
-        abac_rule_tail_oset=tail_oset;
-        abac_rule_is_oset=1;
-        return tmp;
-
-error:
-        _free_yy_expression(headexpr);
-        _free_yy_expression(tailexpr);
-        if(head_oset)
-            abac_oset_free(head_oset);
-        if(tail_oset)
-            abac_oset_free(tail_oset);
-        return NULL;
-}
-
-/****************************************************************/
-static void _role_add_terms(int linked, abac_role_t *role, 
-abac_yy_term_t *terms)
-{
-    abac_yy_term_t *curr = terms;
-    int type;
-    while (curr) {
-        char *name=NULL;
-        char *cond=NULL;
-        void *ptr=NULL;
-        switch (curr->type) {
-           case e_yy_DTERM_DATA:
-           {
-               abac_yy_term_data_t *pptr=curr->term.d_ptr;
-               type=pptr->type;
-               name=abac_xstrdup(pptr->name);
-               if(pptr->cond_str)
-                   cond=abac_xstrdup(pptr->cond_str);
-               ptr=pptr->cond_ptr;
-               break;
-           }
-           case e_yy_DTERM_PRINCIPAL:
-           {
-              abac_yy_term_principal_t *pptr=curr->term.p_ptr;
-              type=abac_term_verify_term_type("principal");
-              name=abac_xstrdup(pptr->name);
-              if(pptr->cond_str)
-                 cond=abac_xstrdup(pptr->cond_str);
-              ptr=pptr->cond_ptr;
-              break;
-           }
-           case e_yy_DTERM_NAMED:
-           {
-              abac_yy_principal_t *pptr=curr->term.n_ptr;
-              type=pptr->type;
-              name=abac_xstrdup(get_yy_principal_name(pptr));
-              cond=NULL;
-              ptr=NULL;
-              break;
-           }
-           case e_yy_DTERM_ANONYMOUS:
-           {
-              type=0;
-              name=abac_xstrdup("_");
-              cond=NULL;
-              ptr=NULL;
-              break;
-           }
-       }
-           
-       abac_term_t *param=abac_term_new(type,name,cond,ptr);
-       if (linked) 
-           abac_role_role_add_linked_param(role, param);
-           else
-                abac_role_role_add_param(role, param);
-       curr=curr->next;
-   }
-}
-
-static void _role_add_linked_terms(abac_role_t *role, abac_yy_term_t *terms)
-{
-    int linked=1;
-    _role_add_terms(linked, role, terms);
-}
-
-static void _role_add_role_terms(abac_role_t *role, abac_yy_term_t *terms)
-{
-    int linked=0;
-    _role_add_terms(linked, role, terms);
-}
-
-
-abac_role_t *validate_intersected_tail_role(abac_role_t *role)
-{
-    abac_role_t *ret_role=NULL;
-    abac_list_t *prereqs = abac_list_new();
-    abac_list_add(prereqs, role);
-    ret_role = abac_role_intersection_new("intersectingROLE", prereqs);
-    return ret_role;
-}
-
-abac_role_t *validate_head_role(abac_yy_expression_t *expr)
-{
-     abac_yy_principal_t *principal=expr->principal;
-     abac_yy_role_t *role=expr->role;
-
-     char *principalname=get_yy_principal_sha(principal);
-     char *othername=get_yy_principal_name(principal);
-     char *rolename=role->name;
-     abac_yy_term_t *terms=role->terms;
-     abac_role_t *ret_role=NULL;
-
-     ret_role=abac_role_role_new(principalname, rolename);
-     if (ret_role==NULL) {
-         abac_yy_set_error_code(ABAC_RT_ROLE_INVALID);
-         goto error;
-     }
-     if (!abac_role_is_role(ret_role)) {
-         abac_yy_set_error_code(ABAC_RT_CERT_INVALID);
-         goto error;
-     }
-     // insert the params for the role
-     if(terms) {
-          _role_add_role_terms(ret_role, terms);
-     }
-
-     _add_yy_id_certs(othername,get_yy_principal_type(principal));
-
-     return ret_role;
-
-error:
-     return NULL;
-}
-
-abac_role_t *validate_named_tail_role(abac_yy_expression_t *expr)
-{
-     abac_yy_principal_t *principal=expr->principal;
-     char *principalname=get_yy_principal_sha(principal);
-     char *othername=get_yy_principal_name(principal);
-     abac_role_t *ret_role=NULL;
-
-     ret_role = abac_role_principal_new(principalname);
-
-     _add_yy_id_certs(othername,get_yy_principal_type(principal));
-
-     if (ret_role==NULL)
-         goto error;
-     return ret_role;
-
-error:
-     panic("can not generate a simple named tail role");
-     return NULL;
-}
-
-abac_role_t *validate_role_tail_role(abac_yy_expression_t *expr)
-{
-     abac_yy_principal_t *principal=expr->principal;
-     abac_yy_role_t *role=expr->role;
-
-     char *principalname=get_yy_principal_sha(principal);
-     char *othername=get_yy_principal_name(principal);
-
-     char *rolename=role->name;
-     abac_yy_term_t *terms=role->terms;
-
-     int ret;
-     abac_role_t *ret_role=NULL;
-
-     ret_role = abac_role_role_new(principalname, rolename);
-     if (ret_role==NULL)
-         goto error;
-
-     if(terms) {
-         _role_add_role_terms(ret_role, terms);
-     }
-
-     _add_yy_id_certs(othername,get_yy_principal_type(principal));
-
-     return ret_role;
-
-error:
-     panic("can not generate a simple tail role");
-     return NULL;
-}
-/* need to validate/generate a linked role out of this */
-abac_role_t *validate_linked_tail_role(abac_yy_expression_t *expr)
-{
-     abac_yy_principal_t *principal=expr->principal;
-     abac_yy_role_t *role=expr->role;
-     abac_yy_role_t *linked_role=expr->linked_role;
-
-     char *principalname=get_yy_principal_sha(principal);
-     char *othername=get_yy_principal_name(principal);
-
-     char *rolename=role->name;
-     abac_yy_term_t *terms=role->terms;
-
-     char *linkedrolename=linked_role->name;
-     abac_yy_term_t *linked_terms=linked_role->terms;
-
-     int ret;
-     abac_role_t *ret_role=NULL;
-
-     ret_role = abac_role_linking_new(principalname, linkedrolename, rolename);
-     if (ret_role==NULL)
-         goto error;
-
-     if(linked_terms) {
-         _role_add_linked_terms(ret_role, linked_terms);
-     }
-     if(terms) {
-         _role_add_role_terms(ret_role, terms);
-     }
-
-     _add_yy_id_certs(othername,get_yy_principal_type(principal));
-
-     return ret_role;
-
-error:
-     panic("can not generate linked tail role");
-     return NULL;
-}
-
-/***********************************************************************/
-/* add the condition to constraint list */
+/* add the oset condition to constraint list */
 char *make_yy_oset_constraint(abac_yy_term_data_t *ptr, char *tail_string)
 {
    abac_yy_expression_t *head_expr=get_yy_term_data_cond_head_expr(ptr);
    if(head_expr) {
-       abac_oset_t *head_oset=validate_head_oset(head_expr);
-       if(head_oset == NULL)
+       abac_aspect_t *head_aspect=validate_head(e_yy_OSET_TYPE,head_expr);
+       if(head_aspect == NULL)
            goto error;
 
-       char *tmp=generate_pl_oset_constraint_clause(head_oset,tail_string);
+       char *tmp=generate_pl_constraint_clause(head_aspect,tail_string);
        set_yy_term_data_cond_str(ptr,tmp);
-       set_yy_term_data_cond_ptr(ptr,head_oset);
+       set_yy_term_data_cond_ptr(ptr,head_aspect);
        abac_yy_add_yy_constraints(tmp);
        return tmp;
    }
-   return NULL;
+
 error:
    return NULL;
 } 
+/* add the role condition to constraint list */
+char *make_yy_role_constraint(abac_yy_term_principal_t *ptr, char *tail_string)
+{
+   abac_yy_expression_t *head_expr=get_yy_term_principal_cond_head_expr(ptr);
+   if(head_expr) {
+       abac_aspect_t *head_aspect=validate_head(e_yy_ROLE_TYPE,head_expr);
+       if(head_aspect == NULL)
+           goto error;
+
+       char *tmp=generate_pl_constraint_clause(head_aspect,tail_string);
+       set_yy_term_principal_cond_str(ptr,tmp);
+       set_yy_term_principal_cond_ptr(ptr,head_aspect);
+       abac_yy_add_yy_constraints(tmp);
+       if(debug) {
+           printf("make_yy_role_constraint, adding (%s) \n",tmp);
+       }
+       return tmp;
+   }
+
+error:
+   return NULL;
+}
+
 
 /****************************************************************/
@@ -1413,5 +884,5 @@
 void make_yy_range_numeric_constraint(abac_yy_term_data_t *ptr, char *var)
 {
-   char *typestr=abac_term_type(ptr->type);
+   char *typestr=abac_termtype_name(ptr->type);
    abac_list_t *rlist=get_yy_term_data_cond_range(ptr);
    char *tmplist=NULL;
@@ -1459,5 +930,5 @@
 void make_yy_range_time_constraint(abac_yy_term_data_t *ptr, char *var)
 {
-   char *typestr=abac_term_type(ptr->type);
+   char *typestr=abac_termtype_name(ptr->type);
    abac_list_t *rlist=get_yy_term_data_cond_range(ptr);
    char *tmplist=NULL;
@@ -1518,5 +989,5 @@
 void make_yy_range_string_constraint(abac_yy_term_data_t *ptr, char *var)
 {
-   char *typestr=abac_term_type(ptr->type);
+   char *typestr=abac_termtype_name(ptr->type);
    abac_list_t *rlist=get_yy_term_data_cond_range(ptr);
    char *tmplist=NULL;
@@ -1567,25 +1038,336 @@
 }
 
-char *make_yy_role_constraint(abac_yy_term_principal_t *ptr, char *tail_string)
-{
-   char *tmp=NULL;
-   abac_role_t *head_role=NULL;
-
-   abac_yy_expression_t *head_expr=get_yy_term_principal_cond_head_expr(ptr);
-/* build up left side's abac role constraint structure */
-   head_role=validate_head_role(head_expr);
-   if(head_role == NULL)
-       goto error;
-
-   tmp=generate_pl_role_constraint_clause(head_role,tail_string);
-   set_yy_term_principal_cond_str(ptr,tmp);
-   set_yy_term_principal_cond_ptr(ptr,head_role);
-   abac_yy_add_yy_constraints(tmp);
-   return tmp;
+
+/************************************************************************/
+
+static void _aspect_add_terms(int linked, abac_aspect_t *aspect_ptr, 
+abac_yy_term_t *terms)
+{
+    abac_yy_term_t *curr = terms;
+    int type;
+
+    while (curr) {
+        char *name=NULL;
+        char *cond=NULL;
+        void *ptr=NULL;
+        switch (curr->type) {
+           case e_yy_DTERM_DATA:
+           {
+               abac_yy_term_data_t *dptr=curr->term.d_ptr;
+               type=dptr->type;
+               name=abac_xstrdup(dptr->name);
+               if(dptr->cond_str) {
+                  cond=abac_xstrdup(dptr->cond_str);
+                  ptr=dptr->cond_ptr;
+               }
+               break;
+           }
+           case e_yy_DTERM_PRINCIPAL:
+           {
+               abac_yy_term_principal_t *pptr=curr->term.p_ptr;
+               type=abac_term_verify_term_type("principal");
+               name=abac_xstrdup(pptr->name);
+               if(pptr->cond_str) {
+                  cond=abac_xstrdup(pptr->cond_str);
+                  ptr=pptr->cond_ptr;
+               }
+               break;
+           }
+           case e_yy_DTERM_NAMED:
+           {
+              abac_yy_principal_t *pptr=curr->term.n_ptr;
+              type=pptr->type;
+              name=abac_xstrdup(get_yy_principal_name(pptr));
+              cond=NULL;
+              ptr=NULL;
+              break;
+           }
+           case e_yy_DTERM_ANONYMOUS:
+           {
+              type=0;
+              name=abac_xstrdup("_");
+              cond=NULL;
+              ptr=NULL;
+              break;
+           }
+       }
+
+       abac_term_t *param=abac_term_new(type,name,cond,ptr);
+       if (linked) 
+           abac_aspect_add_linked_param(aspect_ptr, param);
+           else
+                abac_aspect_add_param(aspect_ptr, param);
+       curr=curr->next;
+   }
+}
+
+static void _aspect_add_linked_terms(abac_aspect_t *ptr, abac_yy_term_t *terms)
+{
+    int linked=1;
+    _aspect_add_terms(linked, ptr, terms);
+}
+
+static void _aspect_add_aspect_terms(abac_aspect_t *ptr, abac_yy_term_t *terms)
+{
+    int linked=0;
+    _aspect_add_terms(linked, ptr, terms);
+}
+
+abac_aspect_t *validate_intersected_tail(abac_aspect_t *ptr)
+{
+    abac_aspect_t *ret_ptr=abac_aspect_intersection_new(ptr);
+    return ret_ptr;
+}
+
+/* A.oset, A.role */
+abac_aspect_t *validate_head(int yytype, abac_yy_expression_t *expr)
+{
+     abac_yy_principal_t *principal=expr->principal;
+     abac_yy_roleoset_t *ptr=expr->roleoset;
+    
+     char *principalname=get_yy_principal_sha(principal);
+     char *othername=get_yy_principal_name(principal);
+     char *name=ptr->name;
+     abac_yy_term_t *terms=ptr->terms;
+
+     abac_aspect_t *aptr=NULL;
+     if(yytype==e_yy_OSET_TYPE)
+         aptr=abac_aspect_oset_new(principalname, name);
+         else aptr=abac_aspect_role_new(principalname, name);
+
+     if (aptr==NULL) {
+         abac_yy_set_error_code(ABAC_YY_INVALID_HEAD);
+         goto error;
+     }
+
+     // insert the params for the oset
+     if(terms) {
+          _aspect_add_aspect_terms(aptr, terms);
+     }
+     _add_yy_id_certs(othername,get_yy_principal_type(principal));
+     return aptr;
 
 error:
-   return NULL;
-}
-
+     return NULL;
+}
+
+abac_aspect_t *validate_head_oset(abac_yy_expression_t *expr)
+{
+     return validate_head(e_yy_OSET_TYPE,expr);
+}
+
+abac_aspect_t *validate_head_role(abac_yy_expression_t *expr)
+{
+     return validate_head(e_yy_ROLE_TYPE,expr);
+}
+
+/*****************************************************************************/
+/* B */
+abac_aspect_t *validate_named_tail(int yytype, abac_yy_expression_t *expr)
+{
+     abac_yy_principal_t *principal=expr->principal;
+     char *principalname=get_yy_principal_sha(principal);
+     char *othername=get_yy_principal_name(principal);
+
+     abac_aspect_t *ptr=NULL;
+     if(yytype==e_yy_OSET_TYPE)
+         ptr=abac_aspect_oset_principal_new(principalname);
+         else ptr=abac_aspect_role_principal_new(principalname);
+     _add_yy_id_certs(othername,get_yy_principal_type(principal));
+
+     if (ptr==NULL)
+         goto error;
+     return ptr;
+
+error:
+     panic("can not generate a simple named tail oset aspect");
+     return NULL;
+}
+
+
+/* [keyid:alpha].oset:documents([string:'proj1'])<-[urn:'file//fileA'] */
+abac_aspect_t *validate_object_tail(int yytype,abac_yy_expression_t *expr)
+{
+     abac_yy_term_data_t *object=get_yy_expression_object(expr);
+     assert(object != NULL);
+
+     char *name=object->name;
+     int type=object->type;
+     char *cond=object->cond_str;
+     void *ptr=object->cond_ptr;
+     abac_term_t *term=abac_term_new(type,name,cond,ptr);
+     abac_aspect_t *aptr=NULL;
+     if(yytype==e_yy_OSET_TYPE)
+         aptr=abac_aspect_oset_object_new(term);
+         else
+             goto error; /* can not be a role expression with obj */
+
+     if(get_yy_term_data_is_variable(object))
+         _add_yy_id_certs(name,type);
+
+     if (aptr==NULL)
+         goto error;
+     return aptr;
+
+error:
+     panic("can not generate a simple object tail oset aspect");
+     return NULL;
+}
+
+
+/* B.role or B.oset */
+abac_aspect_t *validate_some_tail(int yytype, abac_yy_expression_t *expr)
+{
+     abac_yy_principal_t *principal=expr->principal;
+     abac_yy_roleoset_t *eptr=expr->roleoset;
+
+     char *principalname=get_yy_principal_sha(principal);
+     char *othername=get_yy_principal_name(principal);
+
+     char *name=eptr->name;
+     abac_yy_term_t *terms=eptr->terms;
+
+     abac_aspect_t *ptr=NULL;
+     if(yytype==e_yy_OSET_TYPE)
+         ptr=abac_aspect_oset_new(principalname, name);
+         else
+             ptr=abac_aspect_role_new(principalname, name);
+     if (ptr==NULL)
+         goto error;
+
+     if(terms) {
+         _aspect_add_aspect_terms(ptr, terms);
+     }
+
+     _add_yy_id_certs(othername,get_yy_principal_type(principal));
+
+     return ptr;
+
+error:
+     panic("can not generate a simple tail aspect");
+     return NULL;
+}
+
+/* B.role.role or B.role.oset */
+abac_aspect_t *validate_linked_tail(int yytype, abac_yy_expression_t *expr)
+{
+     abac_yy_principal_t *principal=expr->principal;
+
+     abac_yy_roleoset_t *eptr=expr->roleoset;
+     abac_yy_roleoset_t *linked_role=expr->linked_role;
+
+     char *principalname=get_yy_principal_sha(principal);
+     char *othername=get_yy_principal_name(principal);
+
+     char *name=eptr->name;
+     abac_yy_term_t *terms=eptr->terms;
+
+     char *linkedrolename=linked_role->name;
+     abac_yy_term_t *linked_terms=linked_role->terms;
+
+     abac_aspect_t *ptr=NULL;
+     if(yytype==e_yy_OSET_TYPE)
+         ptr=abac_aspect_oset_linking_new(principalname,
+                                            linkedrolename, name);
+         else ptr=abac_aspect_role_linking_new(principalname,
+                                            linkedrolename, name);
+     if (ptr==NULL)
+         goto error;
+
+     if(linked_terms) {
+         _aspect_add_linked_terms(ptr, linked_terms);
+     }
+     if(terms) {
+         _aspect_add_aspect_terms(ptr, terms);
+     }
+
+     _add_yy_id_certs(othername,get_yy_principal_type(principal));
+
+     return ptr;
+
+error:
+     panic("can not generate linked tail oset");
+     return NULL;
+}
+
+
+/**********************************************************************/
+
+abac_list_t *make_oset_statement(abac_yy_expression_t *headexpr,
+                       abac_yy_expression_t *tailexpr) 
+{ 
+    abac_aspect_t *head_oset=NULL;
+    abac_aspect_t *tail_oset=NULL;
+
+/* build up left side's abac oset structure */
+    head_oset=validate_head(e_yy_OSET_TYPE, headexpr);
+    if(head_oset == NULL)
+        goto error;
+
+/* build up the right side's abac oset structure */
+    abac_yy_expression_t *curr_tail = tailexpr;
+    int intersecting=(tailexpr->next != NULL)? 1:0;
+    abac_aspect_t *curr_oset = NULL;
+        while (curr_tail) {
+            switch(curr_tail->type) {
+                case e_yy_EXPR_OBJECT:
+                    curr_oset=validate_object_tail(e_yy_OSET_TYPE,curr_tail);
+                    break;
+                case e_yy_EXPR_NAMED:
+                    curr_oset=validate_named_tail(e_yy_OSET_TYPE,curr_tail);
+                    break;
+                case e_yy_EXPR_OSET:
+                    curr_oset=validate_some_tail(e_yy_OSET_TYPE,curr_tail);
+                    break;
+                case e_yy_EXPR_LINKED:
+                    curr_oset=validate_linked_tail(e_yy_OSET_TYPE,curr_tail);
+                    break;
+            }
+            if(curr_oset==NULL)
+                goto error;
+
+            /* check if first one */
+            if(tail_oset==NULL) {
+                if(intersecting) 
+                    tail_oset=validate_intersected_tail(curr_oset);
+                    else 
+                        tail_oset=curr_oset;
+                } else {  
+                    abac_aspect_add_intersecting_aspect(tail_oset,curr_oset);
+            }
+            curr_tail=curr_tail->next;
+        } /* while */
+
+/* XXX collect up type clauses, constraint clauses and 
+   generate rule clauses */
+        abac_list_t *tmp=generate_pl_clauses(head_oset,tail_oset);
+        if(tmp == NULL)
+            goto error;
+
+        if(debug) {
+            abac_print_aspect_string_with_condition(head_oset,NULL);
+            printf("\n");
+            abac_print_aspect_string_with_condition(tail_oset,NULL);
+            printf("\n");
+        }
+
+        _free_yy_expression(headexpr);
+        _free_yy_expression(tailexpr);
+        abac_rule_head_aspect=head_oset;
+        abac_rule_tail_aspect=tail_oset;
+        abac_rule_is_oset=1;
+        return tmp;
+
+error:
+        _free_yy_expression(headexpr);
+        _free_yy_expression(tailexpr);
+        if(head_oset)
+            abac_aspect_free(head_oset);
+        if(tail_oset)
+            abac_aspect_free(tail_oset);
+        return NULL;
+}
+
+/*****************************************************************************/
 /* build up the abac structure and also create the yap clause
    and insert it into db */
@@ -1593,9 +1375,9 @@
 abac_yy_expression_t *tailexpr) 
 { 
-    abac_role_t *head_role=NULL;
-    abac_role_t *tail_role=NULL;
+    abac_aspect_t *head_role=NULL;
+    abac_aspect_t *tail_role=NULL;
 
 /* build up left side's abac role structure */
-    head_role=validate_head_role(headexpr);
+    head_role=validate_head(e_yy_ROLE_TYPE,headexpr);
     if(head_role == NULL)
         goto error;
@@ -1604,15 +1386,15 @@
     abac_yy_expression_t *curr_tail = tailexpr;
     int intersecting=(tailexpr->next != NULL)? 1:0;
-    abac_role_t *curr_role = NULL;
+    abac_aspect_t *curr_role = NULL;
         while (curr_tail) {
             switch(curr_tail->type) {
                 case e_yy_EXPR_NAMED:
-                    curr_role=validate_named_tail_role(curr_tail);
+                    curr_role=validate_named_tail(e_yy_ROLE_TYPE,curr_tail);
                     break;
                 case e_yy_EXPR_ROLE:
-                    curr_role=validate_role_tail_role(curr_tail);
+                    curr_role=validate_some_tail(e_yy_ROLE_TYPE,curr_tail);
                     break;
                 case e_yy_EXPR_LINKED:
-                    curr_role=validate_linked_tail_role(curr_tail);
+                    curr_role=validate_linked_tail(e_yy_ROLE_TYPE,curr_tail);
                     break;
             }
@@ -1623,9 +1405,9 @@
             if(tail_role==NULL) {
                 if(intersecting) 
-                    tail_role=validate_intersected_tail_role(curr_role);
+                    tail_role=validate_intersected_tail(curr_role);
                     else 
                         tail_role=curr_role;
                 } else {  
-                    abac_role_add_intersecting_role(tail_role,curr_role);
+                    abac_aspect_add_intersecting_aspect(tail_role,curr_role);
             }
             curr_tail=curr_tail->next;
@@ -1634,12 +1416,12 @@
 /* collect up type clauses, constraint clauses and 
    generate the final rule clauses */
-        abac_list_t *tmp=generate_pl_role_clauses(head_role,tail_role);
+        abac_list_t *tmp=generate_pl_clauses(head_role,tail_role);
         if(tmp == NULL)
             goto error;
 
         if(debug) {
-            abac_print_role_string_with_condition(head_role,NULL);
+            abac_print_aspect_string_with_condition(head_role,NULL);
             printf("\n");
-            abac_print_role_string_with_condition(tail_role,NULL);
+            abac_print_aspect_string_with_condition(tail_role,NULL);
             printf("\n");
         }
@@ -1647,6 +1429,6 @@
         _free_yy_expression(headexpr);
         _free_yy_expression(tailexpr);
-        abac_rule_head_role=head_role;
-        abac_rule_tail_role=tail_role;
+        abac_rule_head_aspect=head_role;
+        abac_rule_tail_aspect=tail_role;
         abac_rule_is_oset=0;
         return tmp;
@@ -1656,10 +1438,9 @@
         _free_yy_expression(tailexpr);
         if(head_role)
-            abac_role_free(head_role);
+            abac_aspect_free(head_role);
         if(tail_role)
-            abac_role_free(tail_role);
+            abac_aspect_free(tail_role);
         return NULL;
 }
-
 
 /************************************************************************/
