Index: examples/python_tests/acme_rockets_intersection_rt0/README
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_intersection_rt0/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,39 @@
+#
+# This example demonstrates intersections.  An intersection is a logical-AND of
+# roles or osets.  An intersection succeeds if the principal is in the
+# intersection of the sets defined by the roles.
+#
+# The policy set by Acme is that a character must both a preferred customer and
+# a WarnerBrothers character to buy rockets.  Each of those attributes is
+# specified by a role.
+#
+# This example defines 4 principals, Acme, WarnerBrothers, Coyote and Batman.
+# Credential 1 defines the policy requiring both roles to get the buy_rockets
+# role.  Credential 2 gives the Coyote a preferred_customer role.  Credential 3
+# gives Batman the preferred_customer role and Credential 4 recognizes the
+# Coyote as a Warner Brothers character.
+#
+#In order to buy rockets from Acme, you must be BOTH a preferred customer
+#AND a WarnerBros character. In this example, the following query will be
+#successful:
+#
+#    Acme.buy_rockets <-?- Coyote
+#
+#The following query will fail (because Batman does not have the
+#attribute WarnerBros.character):
+#
+#    Acme.buy_rockets <-?- Batman
+# 
+# acme_rockets_intersection_rt0
+
+# Credential 1
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
+                                    & [keyid:WarnerBros].role:charater
+# Credential 2
+# [keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+
+# Credential 3
+#[keyid:Acme].role:preferred_customer <- [keyid:Batman]
+
+# Credential 4
+#[keyid:WarnerBros].role:character <- [keyid:Coyote]
Index: examples/python_tests/acme_rockets_intersection_rt0/attr.py
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/attr.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_intersection_rt0/attr.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,88 @@
+#!/usr/bin/env python
+
+"""
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
+
+cmd1: ./attr.py 
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# retrieve principals' keyid value from local credential files
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.load_privkey("Acme_private.pem");
+ctxt.load_id_chunk(acmeID.cert_chunk())
+acme=acmeID.keyid()
+
+coyoteID=ABAC.ID("Coyote_ID.pem");
+coyoteID.load_privkey("Coyote_private.pem");
+ctxt.load_id_chunk(coyoteID.cert_chunk())
+coyote=coyoteID.keyid()
+
+warnerbrosID=ABAC.ID("WarnerBros_ID.pem");
+warnerbrosID.load_privkey("WarnerBros_private.pem");
+ctxt.load_id_chunk(warnerbrosID.cert_chunk())
+warnerbros=warnerbrosID.keyid()
+
+batmanID=ABAC.ID("Batman_ID.pem");
+batmanID.load_privkey("Batman_private.pem");
+ctxt.load_id_chunk(batmanID.cert_chunk())
+batman=batmanID.keyid()
+
+
+################################################
+# Credential 1, establish the intersection rule on who can buy
+# rockets from Acme
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
+#                                    & [keyid:WarnerBros].role:charater
+attr = ABAC.Attribute(acmeID, "buy_rockets", 0)
+
+# to add intersection, just add multiple roles
+attr.role(acme,"preferred_customer")
+attr.role(warnerbros,"character")
+
+# finalize the rule
+attr.bake()
+
+# create a policy file at the file system
+attr.write_file("Acme_buy_rockets__Acme_preferred_customer_and_WarnerBros_character_attr.xml")
+
+# load the policy into current context by with the newly created policy file
+ctxt.load_attribute_file("Acme_buy_rockets__Acme_preferred_customer_and_WarnerBros_character_attr.xml")
+
+#################################################
+# Credential 2
+#[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+attr = ABAC.Attribute(acmeID, "preferred_customer", 0)
+attr.principal(coyote)
+attr.bake()
+
+attr.write_file("Acme_preferred_customer__Coyote_attr.xml")
+ctxt.load_attribute_file("Acme_preferred_customer__Coyote_attr.xml")
+
+#################################################
+# Credential 3
+#[keyid:Acme].role:preferred_customer <- [keyid:Batman]
+attr = ABAC.Attribute(acmeID, "preferred_customer", 0)
+attr.principal(batman)
+attr.bake()
+
+attr.write_file("Acme_preferred_customer__Batman_attr.xml")
+ctxt.load_attribute_file("Acme_preferred_customer__Batman_attr.xml")
+
+################################################
+# Credential 4
+#[keyid:WarnerBros].role:character <- [keyid:Coyote]
+attr = ABAC.Attribute(warnerbrosID, "character", 0)
+attr.principal(coyote)
+attr.bake()
+
+attr.write_file("WarnerBros_character__Coyote_attr.xml")
+ctxt.load_attribute_file("WarnerBros_character__Coyote_attr.xml")
+
+# demonstrate how attribute can be load from structure insted of a file
+ctxt.load_attribute_chunk(attr.cert_chunk())
+
Index: examples/python_tests/acme_rockets_intersection_rt0/query.py
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/query.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_intersection_rt0/query.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,74 @@
+#!/usr/bin/env python
+
+"""
+Run the queries described in README
+
+cmd:env keystore=`pwd` ./query.py 
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
+
+# retrieve principals' keyid value from local credential files
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.load_privkey("Acme_private.pem");
+acme=acmeID.keyid()
+
+coyoteID=ABAC.ID("Coyote_ID.pem");
+coyoteID.load_privkey("Coyote_private.pem");
+coyote=coyoteID.keyid()
+
+warnerbrosID=ABAC.ID("WarnerBros_ID.pem");
+warnerbrosID.load_privkey("WarnerBros_private.pem");
+warnerbros=warnerbrosID.keyid()
+
+batmanID=ABAC.ID("Batman_ID.pem");
+batmanID.load_privkey("Batman_private.pem");
+batman=batmanID.keyid()
+
+##########################################################################
+# dump the loaded principals/policies
+#
+print "\n...policy attribute set..."
+credentials = ctxt.credentials()
+for credential in credentials:
+    print "context: %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# can coyote buy rockets from Acme ?
+# role = "[keyid:Acme].role:buy_rockets"
+# p = "[keyid:coyote]" 
+
+print "\n===good============ Acme.buy_rockets <- Coyote"
+(success, credentials) = ctxt.query("%s.buy_rockets" % acme, coyote)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# can batman buy rockets from Acme ?
+# role = "[keyid:Acme].role:buy_rockets"
+# p = "[keyid:batman]" 
+
+print "\n===bad============ Acme.buy_rockets <- Batman"
+(success, credentials) = ctxt.query("%s.buy_rockets" % acme, batman)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
Index: examples/python_tests/acme_rockets_intersection_rt0/run_test
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_intersection_rt0/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,20 @@
+#!/bin/sh 
+
+rm -rf *.pem *.xml *.log *.out
+
+echo '---setup principals'
+./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+./attr.py 1>intersect.log 2>& 1
+
+echo '---run queries'
+env keystore=`pwd` ./query.py 1>intersect.out 2>& 1
+
+good=`grep success intersect.out |wc -l`
+bad=`grep failure intersect.out |wc -l`
+if [ "$good" = "1" -a "$bad" = "1" ]; then
+    echo "   PASSED"
+else
+    echo "   ERROR:acme_rockets_intersection_rt0 test result differs!!!"
+fi
Index: examples/python_tests/acme_rockets_intersection_rt0/setup.py
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_intersection_rt0/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,28 @@
+#!/usr/bin/env python
+
+"""
+See README for the semantics.  This creates four principals used
+by the example.
+
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+acme=ABAC.ID("Acme", 0)
+acme.write_cert_file("Acme_ID.pem")
+acme.write_privkey_file("Acme_private.pem")
+
+coyote=ABAC.ID("Coyote", 0)
+coyote.write_cert_file("Coyote_ID.pem")
+coyote.write_privkey_file("Coyote_private.pem")
+
+warnerbros=ABAC.ID("WarnerBros", 0)
+warnerbros.write_cert_file("WarnerBros_ID.pem")
+warnerbros.write_privkey_file("WarnerBros_private.pem")
+
+batman=ABAC.ID("Batman", 0)
+batman.write_cert_file("Batman_ID.pem")
+batman.write_privkey_file("Batman_private.pem")
+
