Index: libabac/abac.hh
===================================================================
--- libabac/abac.hh	(revision 16215207beab41500d5d55e67ddedadaad101c84)
+++ libabac/abac.hh	(revision adc08151abcf3a6562b6667bb3f75009c2a1a562)
@@ -648,8 +648,8 @@
 ***/
             void load_privkey(char *filename) {
-                int rt=abac_id_load_privkey_file(m_id, filename);
-                if(rt != 1) 
-                  abac_errx(1, "Failed to load private key");
-              }
+              int rt=abac_id_load_privkey_file(m_id, filename);
+              if(rt != 1) 
+                abac_errx(1, "Failed to load private key");
+            }
 /***
    abac_id_t *id()
@@ -663,5 +663,6 @@
      returns the SHA1 keyid of the id cert
    char *name()
-     returns the CN 
+     returns the CN (the parameter passed to the constructor or the
+     CN of the cert).
 ***/
             char *keyid() { return abac_id_keyid(m_id); }
@@ -756,156 +757,236 @@
             { if(m_attr) abac_attribute_free(m_attr); }
 /***
-XXX
+   Attribute(abac_attribute_t *)
+     constructor that takes abac_attribute_t, locally used
+   Attribute(abac_credential_t *)
+     constructor that takes abac_credential_t, locally used 
 ***/
             Attribute(abac_attribute_t *attr): m_attr(abac_attribute_dup(attr)) 
-              { }
-            Attribute(abac_credential_t *cred) {
-                m_attr=abac_attribute_dup(abac_credential_attribute(cred));
+            { }
+            Attribute(abac_credential_t *cred)
+            { m_attr=abac_attribute_dup(abac_credential_attribute(cred)); }
+/***
+   Attribute(Role&, int)
+     constructor that creates an attribute policy to be signed by the issuer 
+     with the given role with a specified validity period 
+     An exception will be thrown if:
+       - the issuer has no private key
+       - the Head role is invalid
+       - the validity period is invalid (must be >= 1 second) 
+***/
+            Attribute(Role& head, int validity) {
+              int rt=abac_attribute_create(&m_attr, head.role(), NULL, validity);
+              if(rt!=ABAC_ATTRIBUTE_SUCCESS)
+                  abac_errx(1, "attribute(role), unable to make an attribute");
+            }
+/***
+   Attribute(Oset&, int)
+     constructor that creates an attribute policy to be signed by the issuer 
+     with the given oset with a specified validity period 
+     An exception will be thrown if:
+       - the issuer has no private key
+       - the Head oset is invalid
+       - the validity period is invalid (must be >= 1 second) 
+***/
+            Attribute(Oset& head, int validity) {
+              int rt=abac_attribute_create(&m_attr, head.oset(), NULL, validity);
+              if(rt!=ABAC_ATTRIBUTE_SUCCESS)
+                  abac_errx(1, "attribute(oset), unable to make an attribute");
+            }
+/***
+   bool add_tail(Role&)
+      Add a role tail.  Call multiple times for intersections
+   bool add_tail(Oset&)
+      Add an oset tail.  Call multiple times for intersections
+***/
+            bool add_tail(Role& tail) {
+              if(abac_attribute_add_tail(m_attr, tail.role()))
+                  return 1;
+                  else return 0;
+            }
+            bool add_tail(Oset& tail) {
+              if(abac_attribute_add_tail(m_attr, tail.oset()))
+                  return 1;
+                  else return 0;
+            }
+/***
+   char *head_string()
+     returns literal string of head of the attribute
+   char *tail_string()
+     returns literal string of tail of the attribute
+***/
+            char *head_string() {
+              abac_aspect_t *head=abac_attribute_head(m_attr);
+              char *string=abac_aspect_string(head);
+              return string;
+            }
+            char *tail_string() {
+              abac_aspect_t *tail=abac_attribute_tail(m_attr);
+              char *string=abac_aspect_string(tail);
+              return string;
+            }
+/***
+   char *head_typed_string()
+     returns typed literal string of head of the attribute
+   char *tail_typed_string()
+     returns typed literal string of tail of the attribute
+***/
+            char *head_typed_string() {
+              abac_aspect_t *head=abac_attribute_head(m_attr);
+              char *string=abac_aspect_typed_string(head);
+              return string;
+            }
+            char *tail_typed_string() {
+              abac_aspect_t *tail=abac_attribute_tail(m_attr);
+              char *string=abac_aspect_typed_string(tail);
+              return string;
+            }
+/***
+   char *string()
+     returns literal string of the attribute
+   char *typed_string()
+     returns typed literal string of the attribute
+***/
+            char *string() {
+              char *head=head_string();
+              char *tail=tail_string();
+              if(head==NULL || tail==NULL)
+                  abac_errx(1, "attribute string, head and tail can not be NULL");
+              char *tmp=NULL;
+              asprintf(&tmp,"%s<-%s",head,tail);
+              return tmp;
+            }
+            char *typed_string() {
+              char *head=head_typed_string();
+              char *tail=tail_typed_string();
+              if(head==NULL || tail==NULL)
+                  abac_errx(1, "attribute string, head and tail can not be NULL");
+              char *tmp=NULL;
+              asprintf(&tmp,"%s<-%s",head,tail);
+              return tmp;
+            }
+/*** ??? not sure about implmentation
+   const Role &role_head()
+     returns the head role
+   const Oset &oset_head()
+     returns the oset head
+***/
+            const Role &role_head() {
+              abac_aspect_t *head=abac_attribute_head(m_attr);
+              static Role role=Role(head);
+              return role;
+            }
+            const Oset &oset_head() {
+              abac_aspect_t *head=abac_attribute_tail(m_attr);
+              static Oset oset=Oset(head);
+              return oset;
+            }
+/*** ???
+   std::vector<Role> role_tails(bool &)
+     retrieve tail role which maybe more than 1 if intersecting
+   std::vector<Oset> oset_tails(bool &)
+     retrieve tail oset which maybe more than 1 if intersecting
+***/
+            std::vector<Role> role_tails(bool &success) {
+              abac_aspect_t **tails, **end;
+              int i;
+              /* make sure it is role */
+              if(!abac_attribute_is_role(m_attr)) {
+                success=0; 
+                abac_errx(1, "role_tails, attribute is not a role");
               }
-/* Create an object to be signed by the given issuer with the given role
-   and validity period
-   An exception will be thrown if:
-     - the issuer has no private key
-     - the Head is invalid
-     - the validity period is invalid (must be >= 1 second) */
-            Attribute(Role& head, int validity) {
-                int rt=abac_attribute_create(&m_attr, head.role(), NULL, validity);
-                if(rt!=ABAC_ATTRIBUTE_SUCCESS)
-                    abac_errx(1, "attribute(role), unable to make an attribute");
+              tails = abac_attribute_tail_vectorized(m_attr);
+              for (i = 0; tails[i] != NULL; ++i)
+                  ;
+              end = &tails[i];
+              std::vector<Role> roles = std::vector<Role>(tails, end);
+              abac_aspects_free(tails);
+              success=1;
+              return roles;
+            }
+            std::vector<Oset> oset_tails(bool &success) {
+              abac_aspect_t **tails, **end;
+              int i;
+              /* make sure that tail is not role */
+              if(abac_attribute_is_role(m_attr)) {
+                success=0; 
+                abac_errx(1, "oset_tails, attribute is not an oset");
               }
-            Attribute(Oset& head, int validity) {
-                int rt=abac_attribute_create(&m_attr, head.oset(), NULL, validity);
-                if(rt!=ABAC_ATTRIBUTE_SUCCESS)
-                    abac_errx(1, "attribute(oset), unable to make an attribute");
-              }
-            bool add_tail(Role& tail) {
-                if(abac_attribute_add_tail(m_attr, tail.role()))
-                    return 1;
-                    else return 0;
-              }
-            bool add_tail(Oset& tail) {
-                if(abac_attribute_add_tail(m_attr, tail.oset()))
-                    return 1;
-                    else return 0;
-              }
-            char *head_string() {
-                abac_aspect_t *head=abac_attribute_head(m_attr);
-                char *string=abac_aspect_string(head);
-                return string;
-              }
-            char *tail_string() {
-                abac_aspect_t *tail=abac_attribute_tail(m_attr);
-                char *string=abac_aspect_string(tail);
-                return string;
-              }
-            char *head_typed_string() {
-                abac_aspect_t *head=abac_attribute_head(m_attr);
-                char *string=abac_aspect_typed_string(head);
-                return string;
-              }
-            char *tail_typed_string() {
-                abac_aspect_t *tail=abac_attribute_tail(m_attr);
-                char *string=abac_aspect_typed_string(tail);
-                return string;
-              }
-            char *string() {
-                char *head=head_string();
-                char *tail=tail_string();
-                if(head==NULL || tail==NULL)
-                    abac_errx(1, "attribute string, head and tail can not be NULL");
-                char *tmp=NULL;
-                asprintf(&tmp,"%s<-%s",head,tail);
-                return tmp;
-              }
-            char *typed_string() {
-                char *head=head_typed_string();
-                char *tail=tail_typed_string();
-                if(head==NULL || tail==NULL)
-                    abac_errx(1, "attribute string, head and tail can not be NULL");
-                char *tmp=NULL;
-                asprintf(&tmp,"%s<-%s",head,tail);
-                return tmp;
-              }
-            const Role &role_head() {
-                abac_aspect_t *head=abac_attribute_head(m_attr);
-                static Role role=Role(head);
-                return role;
-              }
-            const Oset &oset_head() {
-                abac_aspect_t *head=abac_attribute_tail(m_attr);
-                static Oset oset=Oset(head);
-                return oset;
-              }
-            std::vector<Role> role_tails(bool &success) {
-                abac_aspect_t **tails, **end;
-                int i;
-                tails = abac_attribute_tail_vectorized(m_attr);
-                for (i = 0; tails[i] != NULL; ++i)
-                    ;
-                end = &tails[i];
-                std::vector<Role> roles = std::vector<Role>(tails, end);
-                abac_aspects_free(tails);
-                success=1;
-                return roles;
-              }
-            std::vector<Oset> oset_tails(bool &success) {
-                abac_aspect_t **tails, **end;
-                int i;
-                tails = abac_attribute_tail_vectorized(m_attr);
-                for (i = 0; tails[i] != NULL; ++i)
-                    ;
-                end = &tails[i];
-                std::vector<Oset> osets = std::vector<Oset>(tails, end);
-                success=1;
-                abac_aspects_free(tails);
-                return osets;
-              }
+              tails = abac_attribute_tail_vectorized(m_attr);
+              for (i = 0; tails[i] != NULL; ++i)
+                  ;
+              end = &tails[i];
+              std::vector<Oset> osets = std::vector<Oset>(tails, end);
+              success=1;
+              abac_aspects_free(tails);
+              return osets;
+            }
+/***
+   abac_attribute_t *attribute()
+      return libabac structure for attribute
+***/
             abac_attribute_t *attribute() { return m_attr; }
 
-/* Generate the cert. Call this after you've added subjects to your cert.
-   This returns false if there are no subjects
-   This will throw an exception if the cert's already been baked. */
+/***
+   bool bake()
+     Generate the cert. Call this after you've added subjects to your cert.
+     This returns false if there are no subjects
+     This will throw an exception if the cert's already been baked.
+***/
             bool bake() {
-                /* can not bake in ABAC_CN mode */
-                if(USE("ABAC_CN"))
-                    abac_errx(1, "bake, can not bake the cert with env(ABAC_CN) set");
-                int rt=abac_attribute_bake(m_attr);
-                if(rt!=1)
-                    abac_errx(1, "bake, can not bake the cert");
-              }
-/* Returns true iff the cert has been baked. */
-            bool baked() {
-                return abac_attribute_baked(m_attr);
-              }
-/* Write the DER-encoded X.509 attribute cert to the open file handle
-   Throws an exception if the cert isn't baked */
+              /* can not bake in ABAC_CN mode */
+              if(USE("ABAC_CN"))
+                  abac_errx(1, "bake, can not bake the cert with env(ABAC_CN) set");
+              int rt=abac_attribute_bake(m_attr);
+              if(rt!=1)
+                  abac_errx(1, "bake, can not bake the cert");
+            }
+/***
+   bool baked()
+     returns true iff the cert has been baked.
+***/
+            bool baked()
+            { return abac_attribute_baked(m_attr); }
+
+/***
+   void write_cert(FILE *)
+     write the DER-encoded X.509 attribute cert to the open file handle
+     Throws an exception if the cert isn't baked 
+***/
             void write_cert(FILE *out) {
-                int rt= abac_attribute_write(m_attr,out);
-                if(!rt)
-                    abac_errx(1, "write, cert is not baked");
-              }
-/* Write the DER-encoded X.509 attribute cert to a file named out
-   Throws an exception if the cert isn't baked */
+              int rt= abac_attribute_write(m_attr,out);
+              if(!rt)
+                  abac_errx(1, "write, cert is not baked");
+            }
+/***
+   void write_cert(char *)
+     write the DER-encoded X.509 attribute cert to a file named out
+     Throws an exception if the cert isn't baked 
+***/
             void write_cert(char *filename) {
-                FILE *out = fopen(filename, "w");
-                printf("writing to %s\n", filename);
-                write_cert(out);
-                printf("done writing to %s\n", filename);
-                fclose(out);
-              }
-/* returns a DER-encoded binary representation of the X.509 attribute
-   cert associated with this cert
-   Throws an exception if the cert isn't baked
-   the chunk can be passed to libabac's Context::load_attribute_chunk() */
-            abac_chunk_t cert_chunk() {
-                return abac_attribute_cert_chunk(m_attr);
-              }
-/* generate yap clauses and injected into db */
+              FILE *out = fopen(filename, "w");
+              write_cert(out);
+              fclose(out);
+            }
+/***
+   abac_chunk_t cert_chunk()
+     returns a DER-encoded binary representation of the X.509 attribute
+     cert associated with this cert
+     Throws an exception if the cert isn't baked
+     the chunk can be passed to libabac's Context::load_attribute_chunk() 
+***/
+            abac_chunk_t cert_chunk()
+            { return abac_attribute_cert_chunk(m_attr); }
+
+/***
+   int consume()
+     generate yap clauses and injected into db 
+***/
             int consume() {
               /* attribute needs to be baked */  
-                if(!baked()) {
-                    return ABAC_ATTRIBUTE_FAIL;
-                }
+              if(!baked()) {
+                  return ABAC_ATTRIBUTE_FAIL;
               }
+            }
       private:
             abac_attribute_t *m_attr;
@@ -913,153 +994,203 @@
 
 
+/*** 
+ABAC::Context
+   An ABAC Context 
+***/
     class Context {
         public:
+/***
+   Context()
+     default constructor
+   Context(const Context &)
+     copy constructor, used for cloning the context
+   ~Context()
+     default destructor
+***/
             Context() { m_ctx = abac_context_new(); m_abac_version=strdup("1.0"); }
             Context(const Context &context) { 
-                m_ctx = abac_context_dup(context.m_ctx);
-                m_abac_version=strdup(context.m_abac_version);
-              }
+              m_ctx = abac_context_dup(context.m_ctx);
+              m_abac_version=strdup(context.m_abac_version);
+            }
             ~Context() { 
-                abac_context_free(m_ctx);
-                if(m_abac_version) free(m_abac_version);
-              }
-
-/* load an identity certificate, returns:
-      ABAC_CERT_SUCCESS   successfully loaded
-      ABAC_CERT_INVALID   invalid certificate (or file not found)
-      ABAC_CERT_BAD_SIG   invalid signature */
-            void dump_yap() {
-                show_yap_db("dump_yap");
-              }
-            int load_id(ABAC::ID& id) {
-                return abac_context_load_id_id(m_ctx, id.id());
-              }
-            int load_id_file(char *filename) {
-                return abac_context_load_id_idkey_file(m_ctx, filename);
-              }
-            int load_id_file(char *filename, char *keyfilename) {
-                return abac_context_load_id_id_file_key_file(m_ctx, filename, keyfilename);
-              }
-            int load_id_chunk(abac_chunk_t cert) { 
-                return abac_context_load_id_chunk(m_ctx, cert);
-              }
-/* load an attribute certificate, returns the same values as above
-   * additionally can return ABAC_CERT_MISSING_ISSUER if the issuer
-   certificate has not been loaded */
-            int load_attribute(ABAC::Attribute& a) {
-                return abac_context_load_attribute_attribute(m_ctx, a.attribute());
-              }
-            int load_attribute_file(char *filename) { 
-                return abac_context_load_attribute_file(m_ctx, filename);
-              }
-            int load_attribute_chunk(abac_chunk_t cert) {
-                return abac_context_load_attribute_chunk(m_ctx, cert);
-              }
-/* load a directory full of certificates:
-   first: ${path}/*_ID.{der,pem} as identity certificates
-   then: ${path}/*_attr.der as attribute certificates */
-            void load_directory(char *path) {
-                abac_context_load_directory(m_ctx, path);
-              }
-/* run the query:
+              abac_context_free(m_ctx);
+              if(m_abac_version) free(m_abac_version);
+            }
+/***
+   void dump_yap()
+     dump the complete yap prolog database
+***/
+            void dump_yap()
+            { show_yap_db("dump_yap"); }
+
+/***
+   int load_id(ABAC::ID&)
+     load id cert from ID 
+   int load_id_file(char *)
+     load id cert from an idkey combo file. key retrieval will be attempt
+     but won't fail if not found
+   int load_id_file(char *, char *) 
+     load id cert from an id file and a key file
+   int load_id_chunk(abac_chunk_t) 
+     load id cert from a chunk structure
+   returns:
+       ABAC_CERT_SUCCESS   successfully loaded
+       ABAC_CERT_INVALID   invalid certificate (or file not found)
+       ABAC_CERT_BAD_SIG   invalid signature 
+***/
+            int load_id(ABAC::ID& id)
+            { return abac_context_load_id_id(m_ctx, id.id()); }
+            int load_id_file(char *filename)
+            { return abac_context_load_id_idkey_file(m_ctx, filename); }
+            int load_id_file(char *filename, char *keyfilename) 
+            { return abac_context_load_id_id_file_key_file(m_ctx, filename, keyfilename); }
+            int load_id_chunk(abac_chunk_t cert) 
+            { return abac_context_load_id_chunk(m_ctx, cert); }
+
+/***
+   int load_attribute(ABAC::Attribute&)
+     load attribute credential from attribute structure
+   int load_attribute_file(char *)
+     load attribute credential from a file
+   int load_attribute_chunk(abac_chunk_t)
+     load attribute credential from a chunk
+   returns the same values as above, additionally
+   returns ABAC_CERT_MISSING_ISSUER if the issuer
+   certificate has not been loaded 
+***/
+            int load_attribute(ABAC::Attribute& a)
+            { return abac_context_load_attribute_attribute(m_ctx, a.attribute()); }
+            int load_attribute_file(char *filename)
+            { return abac_context_load_attribute_file(m_ctx, filename); }
+            int load_attribute_chunk(abac_chunk_t cert)
+            { return abac_context_load_attribute_chunk(m_ctx, cert); }
+
+/***
+   void load_directory(char *)
+     load a directory full of certificates:
+        first: ${path}/*_ID.{der,pem} as identity certificates
+               implicitly looking for ${path}/*_private.{der,pem} as
+               the private key file
+        then: ${path}/*_IDKEY.{der,pem} as id/key combo certificate
+        last: ${path}/*_attr.der as attribute certificates 
+***/
+            void load_directory(char *path)
+            { abac_context_load_directory(m_ctx, path); }
+/*** 
+   std::vector<Attribute> query(char *, char *, bool &)
+     the string version is for query that is composed by hand with SHA or
+     in non ABAC_CN mode  
+   std::vector<Attribute> query(Role &, Role &, bool &)
+   std::vector<Attribute> query(Oset &, Oset &, bool &)
+
+     runs the query:
        role <-?- principal
-   returns true/false in success
-   returns a proof upon success, partial proof on failure */
-/* the string version is for query that is composed by hand with SHA or
-   in non ABAC_CN mode  */
+     returns true/false in success
+     returns a proof upon success, partial proof on failure 
+***/
             std::vector<Attribute> query(char *role, char *principal, bool &success) {
-                 abac_credential_t **creds, **end;
-                 int i, success_int;
-
-                 creds = abac_context_query(m_ctx, role, principal, &success_int);
-                 success = success_int;
-
-                 for (i = 0; creds[i] != NULL; ++i)
-                    ;
-
-                 end = &creds[i];
-                 std::vector<Attribute> attributes = std::vector<Attribute>(creds, end);
-                 if(debug) printf("query, got rules(%d)\n", i);
-
-                 abac_context_credentials_free(creds);
-
-                 return attributes;
-              }
-
-/* another way */
+               abac_credential_t **creds, **end;
+               int i, success_int;
+
+               creds = abac_context_query(m_ctx, role, principal, &success_int);
+               success = success_int;
+
+               for (i = 0; creds[i] != NULL; ++i)
+                  ;
+
+               end = &creds[i];
+               std::vector<Attribute> attributes = std::vector<Attribute>(creds, end);
+               if(debug) printf("query, got rules(%d)\n", i);
+
+               abac_context_credentials_free(creds);
+
+               return attributes;
+            }
+
             std::vector<Attribute> query(Role &role, Role &p_role, bool &success) {
-                 abac_credential_t **creds, **end;
-                 int i, success_int;
-
-                 creds = abac_context_query_with_structure(m_ctx, role.role(), p_role.role(), &success_int);
-                 success = success_int;
-
-                 for (i = 0; creds[i] != NULL; ++i)
-                    ;
-
-                 end = &creds[i];
-                 std::vector<Attribute> attributes = std::vector<Attribute>(creds, end);
-
-                 abac_context_credentials_free(creds);
-
-                 return attributes;
-              }
+               abac_credential_t **creds, **end;
+               int i, success_int;
+
+               creds = abac_context_query_with_structure(m_ctx, role.role(), p_role.role(), &success_int);
+               success = success_int;
+
+               for (i = 0; creds[i] != NULL; ++i)
+                  ;
+
+               end = &creds[i];
+               std::vector<Attribute> attributes = std::vector<Attribute>(creds, end);
+
+               abac_context_credentials_free(creds);
+
+               return attributes;
+            }
 
             std::vector<Attribute> query(Oset &oset, Oset &p_oset, bool &success) {
-                 abac_credential_t **creds, **end;
-                 int i, success_int;
-              
-                 creds = abac_context_query_with_structure(m_ctx, oset.oset(), p_oset.oset(), &success_int);
-                 success = success_int;
-
-                 for (i = 0; creds[i] != NULL; ++i)
-                    ;
-
-                 end = &creds[i];
-                 std::vector<Attribute> attributes = std::vector<Attribute>(creds, end);
-                 if(debug) printf("query, returning rules(%d)\n", i);
-
-                 abac_context_credentials_free(creds);
-
-                 return attributes;
-              }
-
-/* returns a vector of all the credentials loaded in the context */
+               abac_credential_t **creds, **end;
+               int i, success_int;
+            
+               creds = abac_context_query_with_structure(m_ctx, oset.oset(), p_oset.oset(), &success_int);
+               success = success_int;
+
+               for (i = 0; creds[i] != NULL; ++i)
+                  ;
+
+               end = &creds[i];
+               std::vector<Attribute> attributes = std::vector<Attribute>(creds, end);
+               if(debug) printf("query, returning rules(%d)\n", i);
+
+               abac_context_credentials_free(creds);
+
+               return attributes;
+            }
+
+/***
+   std::vector<Attribute> context_credentials(bool &)
+     returns a vector of all the credentials loaded in the context
+     extracted from the internal data structure
+***/
             std::vector<Attribute> context_credentials(bool &success) {
-                abac_credential_t **creds, **end;
-                int i;
-                success = 1;
-
-                creds = abac_context_credentials(m_ctx);
-                for (i = 0; creds[i] != NULL; ++i)
-                    ;
-
-                end = &creds[i];
-                std::vector<Attribute> attributes = std::vector<Attribute>(creds, end);
-                if(debug) printf("credentials, got (%d)\n", i);
-
-                abac_context_credentials_free(creds);
-                if(debug) show_yap_db("calling from context_credentials");
-                return attributes;
-              }
-
-/* returns a vector of all the principals loaded in the context */
+              abac_credential_t **creds, **end;
+              int i;
+              success = 1;
+
+              creds = abac_context_credentials(m_ctx);
+              for (i = 0; creds[i] != NULL; ++i)
+                  ;
+
+              end = &creds[i];
+              std::vector<Attribute> attributes = std::vector<Attribute>(creds, end);
+              if(debug) printf("credentials, got (%d)\n", i);
+
+              abac_context_credentials_free(creds);
+              if(debug) show_yap_db("calling from context_credentials");
+              return attributes;
+            }
+
+/***
+   std::vector<Attribute> context_principals(bool &)
+     returns a vector of all the principals loaded in the context
+     extracted from the internal data structure
+***/
             std::vector<ID> context_principals(bool &success) {
-                abac_id_credential_t **ids, **end;
-                int i;
-                success = 1;
-
-                ids = abac_context_principals(m_ctx);
-                for (i = 0; ids[i] != NULL; ++i)
-                    ;
-
-                end = &ids[i];
-                std::vector<ID> principals = std::vector<ID>(ids, end);
-                if(debug) printf("principals, got (%d)\n", i);
-
-                abac_context_principals_free(ids);
-                return principals;
-              }
-            
+              abac_id_credential_t **ids, **end;
+              int i;
+              success = 1;
+
+              ids = abac_context_principals(m_ctx);
+              for (i = 0; ids[i] != NULL; ++i)
+                  ;
+
+              end = &ids[i];
+              std::vector<ID> principals = std::vector<ID>(ids, end);
+              if(debug) printf("principals, got (%d)\n", i);
+
+              abac_context_principals_free(ids);
+              return principals;
+            }
+/***
+   char *version()
+     return the version of this interface
+***/
             char *version() const { return m_abac_version; }
 
