Index: java/net/deterlab/abac/Query.java
===================================================================
--- java/net/deterlab/abac/Query.java	(revision 05953726ec721137e596dd936e8ee15f70ba66a9)
+++ java/net/deterlab/abac/Query.java	(revision b67a7ac65fd3b349b05ff0a3f584db5525074316)
@@ -11,9 +11,17 @@
  * A class for making queries against the graph. It supports direct queries as
  * well as reachability in either direction. See the run method for details.
+ * @author <a href="http://abac.deterlab.net">ISI ABAC team</a>
+ * @version 1.3
  */
 class Query {
+    /** Internal graph representation */
     private Graph<Role,Credential> g;
+    /** Count of vertices in g */
     private int vertex_count;
 
+    /**
+     * Create a query to be run against the credential graph.
+     * @param g a Graph represneting the credentials and implicit connections.
+     */
     public Query(Graph<Role,Credential> g) {
         this.g = g;
@@ -25,4 +33,7 @@
      * derived edges are involved, the subgraphs that imply those edges are
      * included.
+     * @param attr a String containing the role to look for
+     * @param prin a String containing the principal
+     * @return a Graph with the proof or partial proof.
      */
     public Graph<Role,Credential> run(String attr, String prin) {
@@ -68,4 +79,6 @@
      * Returns true after running a query that returns a non-empty set of
      * vertices.
+     * @return a boolean, true after running a query that returns a non-empty
+     * set of vertices.
      */
     public boolean successful() {
@@ -76,4 +89,6 @@
      * Returns a collection of principals reachable from a Role when
      * traversing edges in the reverse direction.
+     * @param n the Role to start from
+     * @return a Set containinf the principals
      */
     public Set<Role> find_principals(Role n) {
@@ -87,9 +102,17 @@
 
     /**
-     * Interface to pass to the reverse_dfs class.  The node function gets
-     * called for every node visited by the dfs.
+     * Interface to pass to the reverse_dfs class that operates on nodes in the
+     * graph as part of the depth first search (DFS).
      */
     interface DfsFcn {
+	/**
+	 * Called when the node is first encountered on the DFS.
+	 * @param x the Role being visited
+	 */
         public void node(Role x);
+	/**
+	 * Called when all the node's children have been visited on the DFS.
+	 * @param x the Role being visited
+	 */
         public void node_after(Role x);
     }
@@ -103,6 +126,11 @@
      */
     private class GetPrincipals implements DfsFcn {
+	/** The principals collected */
         public Collection<Role> p;
 
+	/**
+	 * Initialize the principals collection.
+	 * @param vc the initial collection.  May be null.
+	 */
         public GetPrincipals(Collection<Role> vc) {
             if ( vc != null) { p =vc;}
@@ -110,7 +138,15 @@
         }
 
+	/**
+	 * Adds principals to the collection, called by the DFS.
+	 * @param r the Role visited.
+	 */
         public void node(Role r) {
             if ( r.is_principal() ) p.add(r);
         }
+	/**
+	 * Does nothing.
+	 * @param r a Role, a dummy
+	 */
         public void node_after(Role r) { }
     }
@@ -124,8 +160,15 @@
      */
     private class CollectQueryGraph implements DfsFcn {
+	/** The subgraph being collected */
         public Graph<Role, Credential> ng;
+	/** The linking roles already added to the sub-graph */
         protected HashSet<Role> linking_roles_seen;
+	/** The intersection roles already added to the sub-graph */
         protected HashSet<Role> intersection_roles_seen;
 
+	/**
+	 * Initialize the graph into which to gather nodes/edges.
+	 * @param g A graph to collect
+	 */
         public CollectQueryGraph(Graph<Role,Credential> g) {
             ng = g;
@@ -134,4 +177,9 @@
         }
 
+
+	/**
+	 * Do the collection on each node we visit.
+	 * @param r a Role, the current node in the DFS.
+	 */
         public void node(Role r) {
             if (r.is_linking() && !linking_roles_seen.contains(r)) {
@@ -154,4 +202,8 @@
             }
         }
+	/**
+	 * Does nothing.
+	 * @param r a Role, a dummy
+	 */
         public void node_after(Role r) { }
 
@@ -159,10 +211,16 @@
 
     /**
-     * Collect the path from one node to another. It only includes vertices that
+     * Collect the path from one node to another. It includes vertices that
      * are traversed to reach the node. It also includes subgraphs that imply
      * the linking/intersection edges traversed.
      */
     private class CollectQueryPath extends CollectQueryGraph {
-        HashSet<Role> onPath;     // Vertices on the path to the principal
+	/** Vertices on the path to the principal */
+        HashSet<Role> onPath;
+	/**
+	 * Establish the collection graph and the destination.
+	 * @param g the graph that collects the result
+	 * @param dest the Role to find
+	 */
         public CollectQueryPath(Graph<Role,Credential> g, Role dest) {
             super(g);
@@ -171,6 +229,14 @@
         }
 
+	/**
+	 * Does nothing.
+	 * @param r a Role, a dummy
+	 */
         public void node(Role r) { }
 
+	/**
+	 * Do the collection on each node we visit.
+	 * @param r a Role, the current node in the DFS.
+	 */
         public void node_after(Role r) {
             for (Credential c : g.getInEdges(r)) {
@@ -180,5 +246,6 @@
                     Credential edge = g.findEdge(child, r);
                     if (edge == null)
-                        throw new RuntimeException("Credential missing from parent graph, state is messed up");
+                        throw new RuntimeException("Credential missing from " +
+				"parent graph, state is messed up");
 
                     ng.addEdge(edge, child, r);
@@ -188,5 +255,6 @@
                     // authorizer
                     if (r.is_linking()) {
-                        CollectQueryPath link = new CollectQueryPath(ng, new Role(child.principal_part()));
+                        CollectQueryPath link = new CollectQueryPath(ng, 
+				new Role(child.principal_part()));
                         reverse_dfs(new Role(r.principal_part()), link);
                     }
@@ -194,5 +262,6 @@
                     // intersection: collect the subgraph of each prereq
                     else if (r.is_intersection()) {
-                        CollectQueryPath prereq_finder = new CollectQueryPath(ng, child);
+                        CollectQueryPath prereq_finder = 
+			    new CollectQueryPath(ng, child);
                         for (Role prereq : r.prereqs())
                             reverse_dfs(prereq, prereq_finder);
@@ -208,9 +277,16 @@
      */
     private class CollectReversePath extends CollectQueryGraph {
+	/**
+	 * Initialize the collection graph.
+	 * @param g a Graph that collects the results.
+	 */
         public CollectReversePath(Graph<Role,Credential> g) {
             super(g);
         }
 
-        /* add all of the node's parents */
+        /**
+	 * add all of the node's parents
+	 * @param r a Role, the current node being visited
+	 */
         public void node(Role r) {
             for (Credential c : g.getOutEdges(r)) {
@@ -218,5 +294,6 @@
                 Credential cred = g.findEdge(r, head);
                 if (cred == null)
-                    throw new RuntimeException("Credential missing from parent graph, state is messed up");
+                    throw new RuntimeException("Credential missing from " + 
+			    "parent graph, state is messed up");
 
                 ng.addEdge(cred, r, head);
@@ -224,4 +301,8 @@
         }
 
+	/**
+	 * Do the collection on each node we visit.
+	 * @param r a Role, the current node in the DFS.
+	 */
         public void node_after(Role r) {
             for (Credential c : g.getOutEdges(r)) {
@@ -231,5 +312,6 @@
                 // the subgraph that implies said link
                 if (parent.is_linking()) {
-                    CollectQueryPath link = new CollectQueryPath(ng, new Role(r.principal_part()));
+                    CollectQueryPath link = new CollectQueryPath(ng, 
+			    new Role(r.principal_part()));
                     reverse_dfs(new Role(parent.principal_part()), link);
                 }
@@ -245,5 +327,7 @@
      * Interface to the reverse_dfs member that does allocates the visited map
      * so the user doesn't have to.
-     * */
+     * @param r a Role from which to start the search
+     * @param f a DfsFcn that customizes the search operation
+     */
     private void reverse_dfs(Role r, DfsFcn f) {
         reverse_dfs(r, new HashSet<Role>(), f);
@@ -254,4 +338,8 @@
      * Role is visited once and has the node() function of the dfs_fcn called
      * on it.  Order is not guaranteed.
+     * @param r a Role from which to start the search
+     * @param visited a HashSet of Roles that tells which nodes have been
+     * visited.
+     * @param f a DfsFcn that customizes the search operation
      */
     private void reverse_dfs(Role r, HashSet<Role> visited,
@@ -270,4 +358,6 @@
      * Interface to the forward_dfs member that allocates the visited map so
      * the user doesn't have to.
+     * @param r a Role from which to start the search
+     * @param f a DfsFcn that customizes the search operation
      */
     private void forward_dfs(Role r, DfsFcn f) {
@@ -279,4 +369,8 @@
      * visited once and has the node() function of the dfs_fcn called on it.
      * Order is not guaranteed
+     * @param r a Role from which to start the search
+     * @param visited a HashSet of Roles that tells which nodes have been
+     * visited.
+     * @param f a DfsFcn that customizes the search operation
      */
     private void forward_dfs(Role r, Set<Role> visited, DfsFcn f) {
