Index: libabac/rt2.y
===================================================================
--- libabac/rt2.y	(revision 718ad9243faff3a00dea5c5c5b2ef6fe89caedbe)
+++ libabac/rt2.y	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -1,23 +1,6 @@
 
 /* bison grammar rules for process new rt1 statements */
-
 /*
-   [keyid:isi].role:employee <- [keyid:ted]
-   [keyid:ted].role:friend <- [keyid:mike]
-   [keyid:usc].role:employee <- [keyid:isi].role:employee
-   [keyid:usc].role:playground <- [keyid:usc].role:employee.role:friend
-   query,
-      [keyid:isi].role:playground <- [keyid:?Z]
-      [keyid:isi].role:playground <- [keyid:mike]
-
-USC.evaluatorOf(this)<-USC.managerOf(this)
-USC.managerOf(this)<-USC.employee
-ISI.managerOf(Maryann) <- John
-USC.employee <- ISI.employee
-ISI.employee  <- Maryann
-ISI.employee <- John
-
-USC.employee <-?- John
-USC.evaluatorOf(Maryann)<-?- John
+    [keyid:A].oset:r <- [urn:'file://dir/filename']
 */
 
@@ -32,4 +15,5 @@
 #include "abac_pl_yy.h"
 
+/* lex tie-ins flag */
 int yyerror (char *s);
 
@@ -37,4 +21,5 @@
 FILE *abac_yyout = NULL;
 char *abac_yyfptr = NULL;
+char *abac_yyfptr_encoded = NULL;
 
 static int sz_overhead = 0;
@@ -43,23 +28,33 @@
 void panic(char *msg);
  
+/* lex tie-ins functions*/
 extern void set_yap_clauses(abac_list_t *);
-extern abac_list_t *make_statement(abac_yy_role_expression_t *,
-           abac_yy_role_expression_t *);
-extern abac_yy_role_expression_t *make_yy_role_expression(int,
-           abac_yy_principal_t *, abac_yy_role_t *, abac_yy_role_t *);
+extern abac_list_t *make_role_statement(abac_yy_expression_t *,
+           abac_yy_expression_t *);
+extern abac_list_t *make_oset_statement(abac_yy_expression_t *,
+           abac_yy_expression_t *);
+extern abac_yy_expression_t *make_yy_expression(int,
+           void *, void *, abac_yy_role_t *);
 extern abac_yy_principal_t *make_yy_principal(char *, char *, int);
-extern abac_yy_role_t *make_yy_role(char *, abac_yy_dterm_t *);
-extern abac_yy_param_data_t *make_yy_param_data(char*, int);
-extern abac_yy_param_principal_t *make_yy_param_principal(char*);
-extern abac_yy_dterm_t *make_yy_dterm_anonymous();
-extern abac_yy_dterm_t *make_yy_dterm_principal(abac_yy_param_principal_t *);
-extern abac_yy_dterm_t *make_yy_dterm_named(abac_yy_principal_t *);
-extern abac_yy_dterm_t *make_yy_dterm_data(abac_yy_param_data_t *);
+extern abac_yy_role_t *make_yy_role(char *, abac_yy_term_t *);
+extern abac_yy_term_data_t *make_yy_term_data(char*);
+extern abac_yy_term_principal_t *make_yy_term_principal(char*);
+extern abac_yy_term_t *make_yy_term_dterm_anonymous();
+extern abac_yy_term_t *make_yy_term_dterm_principal(abac_yy_term_principal_t *);
+extern abac_yy_term_t *make_yy_term_dterm_named(abac_yy_principal_t *);
+extern abac_yy_term_t *make_yy_term_dterm_data(abac_yy_term_data_t *);
 extern char *abac_cn_with_sha(char*);
-extern abac_yy_dterm_t *add_yy_dterm(abac_yy_dterm_t *, abac_yy_dterm_t *);
-extern abac_yy_role_expression_t *add_yy_role_expression(
-                abac_yy_role_expression_t *, abac_yy_role_expression_t *);
-extern void set_yy_param_data_is_variable(abac_yy_param_data_t *);
+extern abac_yy_term_t *add_yy_term(abac_yy_term_t *, abac_yy_term_t *);
+extern abac_yy_expression_t *add_yy_expression(
+                abac_yy_expression_t *, abac_yy_expression_t *);
+extern void set_yy_term_data_is_variable(abac_yy_term_data_t *);
+extern void set_yy_term_data_type(abac_yy_term_data_t *,char*);
 extern void abac_init_yy_id_certs();
+extern void abac_init_yy_constraints();
+extern void make_yy_range_constraint(abac_yy_term_data_t *ptr, char*);
+extern char *make_yy_oset_constraint(abac_yy_term_data_t *ptr, char*);
+extern char *make_yy_role_constraint(abac_yy_term_principal_t *ptr, char*);
+
+
 
 %}
@@ -67,27 +62,46 @@
 %union {
 struct _abac_yy_principal_t *pstruct;
-struct _abac_yy_param_principal_t *ppstruct;
-struct _abac_yy_param_data_t *pdstruct;
+struct _abac_yy_term_principal_t *ppstruct;
+struct _abac_yy_term_data_t *pdstruct;
 struct _abac_yy_role_t *rstruct;
-struct _abac_yy_dterm_t *dstruct;
-struct _abac_yy_role_expression_t *estruct;
+struct _abac_yy_oset_t *ostruct;
+struct _abac_yy_term_t *dstruct;
+struct _abac_yy_expression_t *estruct;
 struct abac_list_t *lstruct;
 char *string;   /* For returning char strings */
+int intval; /* for returning some value */
 }
+
+%start input
+
 %type <lstruct> stmt
 %type <rstruct> rolepart 
-%type <estruct> left 
-%type <estruct> right 
+%type <estruct> roleleft 
+%type <estruct> roleright 
 %type <estruct> roleterm 
+%type <ostruct> osetpart 
+%type <estruct> osetleft 
+%type <estruct> osetright 
+%type <estruct> osetterm 
 %type <pstruct> keypart
-%type <dstruct> dterms
-%type <dstruct> dterm
+%type <dstruct> terms
+%type <dstruct> term
 %type <pdstruct> typedpart
+%type <pdstruct> otypetail
 %type <ppstruct> principalpart
-
-%token <string> IDEN            /* keyname or rolename */
-%token <string> ROLE            /* the word, role */
-%token <string> PRINCIPAL       /* the word, principal */
-%token <string> KEYTYPE         /* keyid | or something else */
+%type <lstruct> rangetype
+%type <lstruct> values
+
+%token <string> IDEN                /* keyname or rolename */
+%token <string> CAPIDEN             /* variable name */
+%token <string> ROLE                /* the word, role */
+%token <string> OSET                /* the word, oset */
+%token <string> PRINCIPAL           /* the word, principal */
+%token <string> OTYPE               /* integer,boolean,urn,time,string,float */
+%token <string> OTYPE_CONSTANT      
+%token <string> VARIABLE_CONSTANT   /* constant for ?AAA */
+%token <string> KEYTYPE             /* keyid | or something else */
+%token <string> KEYID_CONSTANT      /* keyid | or something else */
+%token <string> VALUE               /* range value in static constraint */
 
 %token  <operator>  DERIVE    "<-"
@@ -98,4 +112,6 @@
 %token  <operator>  LSQUARE   "["
 %token  <operator>  RSQUARE   "]"
+%token  <operator>  LWIGGLE   "{"
+%token  <operator>  RWIGGLE   "}"
 %token  <operator>  LANGLE    "<"
 %token  <operator>  RANGLE    ">"
@@ -103,4 +119,5 @@
 %token  <operator>  COMMA     ","
 %token  <operator>  QMARK     "?"
+%token  <operator>  DOTDOT    ".."
 
 %%
@@ -109,17 +126,18 @@
 input:      /* empty */
              { }
-        | stmt 
+     | stmt 
              {  
                set_yap_clauses($1);
              }
+     ;
  
 /* generate/concate prolog credentials clauses */
-stmt : left DERIVE right
-             { 
-               abac_yy_role_expression_t *headexpr=$1;
-               abac_yy_role_expression_t *tailexpr=$3;
-               abac_list_t *ret=make_statement(headexpr, tailexpr);
+stmt : roleleft DERIVE roleright
+             { 
+               abac_yy_expression_t *headexpr=$1;
+               abac_yy_expression_t *tailexpr=$3;
+               abac_list_t *ret=make_role_statement(headexpr, tailexpr);
                if(ret == NULL) {
-                   panic("unable to parse the rule statment");
+                   panic("unable to parse the role rule statment");
                    YYERROR;
                    } else {
@@ -127,24 +145,42 @@
                }
              }
+     | osetleft DERIVE osetright
+             { 
+               abac_yy_expression_t *headexpr=$1;
+               abac_yy_expression_t *tailexpr=$3;
+               abac_list_t *ret=make_oset_statement(headexpr, tailexpr);
+               if(ret == NULL) {
+                   panic("unable to parse the oset rule statment");
+                   YYERROR;
+                   } else {
+                       $$=ret;
+               }
+             }
+     ;
 /*
    [keyid:isi].role:modifyBy([keyid:mike])
    [keyid:acme].role:preferred
 */
-left : keypart DOT rolepart
+roleleft : keypart DOT rolepart
              { 
                abac_yy_principal_t *keypart=$1;
                abac_yy_role_t *rolepart=$3;
-               abac_yy_role_expression_t *expr=
-                         make_yy_role_expression(EXPR_ROLE,keypart,rolepart,NULL);
-               $$=expr;
-             }
+               abac_yy_expression_t *expr=
+                    make_yy_expression(e_yy_EXPR_ROLE,keypart,rolepart,NULL);
+               $$=expr;
+             }
+     ;
 
 /* [keyid:mike] */
-keypart : LSQUARE KEYTYPE COLON IDEN RSQUARE 
-             { 
-               char *cn=abac_cn_with_sha($4);
+keypart : LSQUARE KEYTYPE COLON
+             { abac_yy_push_keyid_state(); }
+          KEYID_CONSTANT
+             { abac_yy_pop_state(); }
+          RSQUARE 
+             { 
+               char *cn=abac_cn_with_sha($5);
                int idtype=abac_verify_keyid_type($2);
                if(cn && idtype)  {
-                 $$=make_yy_principal($4, cn, idtype);
+                 $$=make_yy_principal($5, cn, idtype);
                  } else {
                    panic("encountered an invalid SHA id");
@@ -152,4 +188,5 @@
                }
              }
+     ;
 /* 
    role:modifyBy([keyid:mike],[keyid:ted])
@@ -157,12 +194,13 @@
    role:preferred
 */
-rolepart : ROLE COLON IDEN LPAREN dterms RPAREN
+rolepart : ROLE COLON IDEN LPAREN terms RPAREN
              { 
                $$=make_yy_role($3,$5);
              }
-       | ROLE COLON IDEN
+     | ROLE COLON IDEN
              { 
                $$=make_yy_role($3,NULL);
              }
+     ;
 
 /*
@@ -175,62 +213,122 @@
    [?]
 */
-dterms : dterm COMMA dterms
-             {
-               abac_yy_dterm_t *nterm=$1;
-               abac_yy_dterm_t *dterms=$3;
-               $$=add_yy_dterm(nterm, dterms);
-             }
-      | dterm
+terms : term COMMA terms
+             {
+               abac_yy_term_t *nterm=$1;
+               abac_yy_term_t *terms=$3;
+               $$=add_yy_term(nterm, terms);
+             }
+     | term
              {
                $$=$1;
              }
-
-/* XX need to handdle principal:?X dterm ??? */
-dterm : LSQUARE QMARK RSQUARE 
-             { $$= make_yy_dterm_anonymous(); }
-      | keypart 
-             { $$= make_yy_dterm_named($1); }
-      | principalpart
-             { $$= make_yy_dterm_principal($1); }
-      | typedpart
-             { $$= make_yy_dterm_data($1); }
-
-typedpart : LSQUARE IDEN COLON IDEN RSQUARE 
-             {
-               int type=abac_verify_dterm_type($2); 
-               if (type) {
-                 $$ = make_yy_param_data($4, type); 
-                 } else {
-                   panic("wrong type in data dterm!!");
-                   YYERROR;
+     ;
+
+term : LSQUARE QMARK RSQUARE 
+             { $$= make_yy_term_dterm_anonymous(); }
+     | keypart 
+             { $$= make_yy_term_dterm_named($1); }
+     | principalpart
+             { $$= make_yy_term_dterm_principal($1); }
+     | typedpart
+             { $$= make_yy_term_dterm_data($1); }
+     ;
+
+values : VALUE COMMA values
+             { $$=addto_yy_val_range($3, $1); }
+       |  VALUE
+             { $$=make_yy_val_range($1); }
+       ;
+      
+
+rangetype : LSQUARE VALUE DOTDOT VALUE RSQUARE 
+             { $$=make_yy_minmax_range($2,$4); }
+          |  LSQUARE DOTDOT VALUE RSQUARE 
+             { $$=make_yy_max_range($3); }
+          |  LSQUARE VALUE DOTDOT RSQUARE 
+             { $$=make_yy_min_range($2); }
+          |  LSQUARE values RSQUARE
+             { $$=$2; }
+          ;
+
+/* [otype:?Z:{oset-constraint}] */
+/* [int:?I:[10 .. 20] */
+otypetail : | VARIABLE_CONSTANT COLON 
+             { 
+               abac_yy_pop_state();
+               abac_yy_push_range_state();
+             }
+            rangetype 
+            {
+              abac_yy_pop_state();
+              abac_yy_term_data_t *ptr=make_yy_term_data($1);
+              set_yy_term_data_is_variable(ptr);
+              set_yy_term_data_cond_range(ptr,$4);
+              $$=ptr;
+            }
+     | VARIABLE_CONSTANT 
+            { abac_yy_pop_state(); }
+            osetleft 
+            {
+              abac_yy_term_data_t *ptr=make_yy_term_data($1);
+              set_yy_term_data_cond_head_expr(ptr,$3);
+              set_yy_term_data_is_variable(ptr);
+              $$=ptr;
+            }
+     | VARIABLE_CONSTANT
+            {
+              abac_yy_pop_state();
+              abac_yy_term_data_t *ptr=make_yy_term_data($1);
+              set_yy_term_data_is_variable(ptr);
+              $$=ptr;
+            }
+     | OTYPE_CONSTANT
+            {
+              abac_yy_pop_state();
+              abac_yy_term_data_t *ptr=make_yy_term_data($1);
+              $$=ptr;
+            }
+     ;
+
+typedpart  : LSQUARE OTYPE COLON 
+             { abac_yy_push_state($2); }
+             otypetail RSQUARE
+             { 
+               abac_yy_term_data_t *ptr=$5;
+               char *tail_string=get_yy_term_data_name(ptr);
+               set_yy_term_data_type(ptr,$2);
+               if(is_yy_term_data_has_constraint(ptr)) {
+                  make_yy_oset_constraint(ptr,tail_string);
+                  make_yy_range_constraint(ptr,tail_string);
                }
-             }
-       | LSQUARE IDEN COLON QMARK IDEN RSQUARE 
-             {
-               int type=abac_verify_dterm_type($2); 
-               if (type) {
-                 abac_yy_param_data_t *ptr=make_yy_param_data($5, type); 
-                 set_yy_param_data_is_variable(ptr);
-                 $$=ptr;
-                 } else {
-                   panic("wrong type in data dterm!!");
-                   YYERROR;
-               }
-             }
+               $$=$5;
+             }
+     ; 
+
 
 /* [principal:?Z] */
-principalpart : LSQUARE PRINCIPAL COLON QMARK IDEN RSQUARE 
-             {
-               $$ = make_yy_param_principal($5); 
-             }
-
-right : roleterm AND right
-             { 
-               abac_yy_role_expression_t *nexpr=$1;
-               abac_yy_role_expression_t *exprs=$3;
-               $$=add_yy_role_expression(nexpr,exprs);
-             }
-      | roleterm
+/* [principal:?Z{role-constraint}] */
+principalpart : LSQUARE PRINCIPAL COLON QMARK IDEN roleleft RSQUARE 
+                { 
+                  abac_yy_expression_t *expr=$6;
+                  char *tail_string=$5;
+                  abac_yy_term_principal_t *ptr=make_yy_term_principal(tail_string);
+                  set_yy_term_principal_cond_head_expr(ptr,expr);
+                  char *string=make_yy_role_constraint(ptr,tail_string);
+                  $$=ptr;
+                }
+              | LSQUARE PRINCIPAL COLON QMARK IDEN RSQUARE 
+                { $$ = make_yy_term_principal($5); }
+     ;
+
+roleright : roleterm AND roleright
+             { 
+               abac_yy_expression_t *nexpr=$1;
+               abac_yy_expression_t *exprs=$3;
+               $$=add_yy_expression(nexpr,exprs);
+             }
+     | roleterm
              { $$=$1; }
+     ;
 
 /* role at tail/right side 
@@ -244,24 +342,93 @@
                abac_yy_role_t *linked_rolepart=$3;
                abac_yy_role_t *rolepart=$5;
-               abac_yy_role_expression_t *expr=
-                   make_yy_role_expression(EXPR_LINKED,keypart,rolepart,linked_rolepart);
-               $$=expr;
-             }
-      | keypart DOT rolepart
+               abac_yy_expression_t *expr=
+                  make_yy_expression(e_yy_EXPR_LINKED,keypart,rolepart,linked_rolepart);
+               $$=expr;
+             }
+     | keypart DOT rolepart
              { 
                abac_yy_principal_t *keypart=$1;
                abac_yy_role_t *rolepart=$3;
-               abac_yy_role_expression_t *expr=
-                   make_yy_role_expression(EXPR_ROLE,keypart,rolepart,NULL);
-               $$=expr;
-             }
-      | keypart
-             { 
-               abac_yy_principal_t *keypart=$1;
-               abac_yy_role_expression_t *expr=
-                   make_yy_role_expression(EXPR_NAMED,keypart,NULL,NULL);
-               $$=expr;
-             }
+               abac_yy_expression_t *expr=
+                   make_yy_expression(e_yy_EXPR_ROLE,keypart,rolepart,NULL);
+               $$=expr;
+             }
+     | keypart
+             { 
+               abac_yy_principal_t *keypart=$1;
+               abac_yy_expression_t *expr=
+                   make_yy_expression(e_yy_EXPR_NAMED,keypart,NULL,NULL);
+               $$=expr;
+             }
+     ;
+
+osetterm : keypart DOT rolepart DOT osetpart
+             {
+               abac_yy_principal_t *keypart=$1;
+               abac_yy_role_t *linked_rolepart=$3;
+               abac_yy_oset_t *osetpart=$5;
+               abac_yy_expression_t *expr=
+                  make_yy_expression(e_yy_EXPR_LINKED,keypart,osetpart,linked_rolepart);
+               $$=expr;
+             }
+     | keypart DOT osetpart
+             {
+               abac_yy_principal_t *keypart=$1;
+               abac_yy_oset_t *osetpart=$3;
+               abac_yy_expression_t *expr=
+                   make_yy_expression(e_yy_EXPR_OSET,keypart,osetpart,NULL);
+               $$=expr;
+             }
+     | keypart
+             {
+               abac_yy_principal_t *keypart=$1;
+               abac_yy_expression_t *expr=
+                   make_yy_expression(e_yy_EXPR_NAMED,keypart,NULL,NULL);
+               $$=expr;
+             }
+     | typedpart 
+             {
+               abac_yy_term_data_t *objpart=$1;
+               abac_yy_expression_t *expr=
+                   make_yy_expression(e_yy_EXPR_OBJECT,objpart,NULL,NULL);
+               $$=expr;
+             }
+     ;
+
+/*
+   oset:access([urn:'fileA'])
+*/
+osetpart : OSET COLON IDEN LPAREN terms RPAREN
+             {
+               $$=make_yy_oset($3,$5);
+             }
+     | OSET COLON IDEN
+             {
+               $$=make_yy_oset($3,NULL);
+             }
+     ;
+
+
+osetleft : keypart DOT osetpart
+             {
+               abac_yy_principal_t *keypart=$1;
+               abac_yy_oset_t *osetpart=$3;
+               abac_yy_expression_t *expr=
+                    make_yy_expression(e_yy_EXPR_OSET,keypart,osetpart,NULL);
+               $$=expr;
+             }
+     ;
+
+osetright : osetterm AND osetright
+             {
+               abac_yy_expression_t *nexpr=$1;
+               abac_yy_expression_t *exprs=$3;
+               $$=add_yy_expression(nexpr,exprs);
+             }
+     | osetterm
+             { $$=$1; }
+     ;
 %%
+
 
 /* Additional C code */
@@ -283,7 +450,9 @@
     abac_yyout=abac_get_yyout();
     abac_yyfptr = abac_get_yyfptr();
+    abac_yyfptr_encoded = abac_get_yyfptr_encoded();
     sz_overhead = strlen(abac_yyfptr)+2000;
     abac_init_yap_id_clauses();
     abac_init_yy_id_certs();
+    abac_init_yy_constraints();
 } 
 
