Index: examples/python_tests/balltime_rt2/README
===================================================================
--- examples/python_tests/balltime_rt2/README	(revision 669b4810acfbeee6bdec4a2443a99b2994efedc8)
+++ examples/python_tests/balltime_rt2/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,4 +1,2 @@
-#!/bin/sh
-#
 #####################################################################
 # This example demonstrates using an oset (object set) to control access
@@ -15,5 +13,5 @@
 # [keyid:League].oset:players(string:'north'))
 # 
-# The example below lays out the policy that players of a given team can
+# The file, attr.py, lays out the policy that players of a given team can
 # go to the stadium when it is their team's gametime -- credential 1.
 # or any player of a team that is controlled by the League principal can
@@ -25,97 +23,33 @@
 # a player for team(south)
 #
-# The attached ./run_query file runs 3 queries.  First it confirms that John can 
+# The query.py file runs 3 queries.  First it confirms that John can 
 # go to stadium at his team's gametime, then it confirms that Mark cannot
 # go because it is not his gametime, but Mark can go to the stadium during
 # stadium's free-for-all early morning time
 
-# balltime_rt2_typed
+# balltime_rt2
 
-creddy --generate --cn League
-creddy --generate --cn John
-creddy --generate --cn Mark
-
-league_keyid=`creddy --keyid --cert League_ID.pem`
-john_keyid=`creddy --keyid --cert John_ID.pem`
-mark_keyid=`creddy --keyid --cert Mark_ID.pem`
-
-stadium_qFqT="stadium([string:'access'],[boolean:true],[time:?F[keyid:$league_keyid].oset:gametime([string:?T])])"
-stadium_qR="stadium([string:'access'],[boolean:?B:[true]],[time:?F:[20120228T080000..20120228T090000]])"
-
-players_qT="players([string:?T])" 
-
+# Credential 1
 #[keyid:league].role:stadium([string:'access'],[boolean:true],
 #          [time:?F:[keyid:league].oset.gametime([string:?T])])
 #                <-[keyid:league].role:players([string:?T])
-# Credential 1
-creddy --attribute \
-       --issuer League_ID.pem --key League_private.pem --role "$stadium_qFqT" \
-       --subject-cert League_ID.pem --subject-role "$players_qT" \
-       --out League_access_qFqT__League_players_qT_attr.der
 
+# Credential 2 
 #[keyid:league].role:stadium([string:'access'],[boolean:?B:[true],
 #              [time:?F:[20120228T080000..20120228T090000]])
 #               <- [keyid:league].role:players(string:?T) 
-# Credential 2 
-creddy --attribute \
-       --issuer League_ID.pem --key League_private.pem --role "$stadium_qR" \
-       --subject-cert League_ID.pem --subject-role "$players_qT" \
-       --out League_access_qR__League_players_qT_attr.der
 
-
+# Credential 3
 # [keyid:league].oset:gametime([time:20120228T130000])
 #                    <- [keyid:league].oset:players([string:'north') 
-# Credential 3
-creddy --attribute \
-        --issuer League_ID.pem --key League_private.pem \
-        --oset "gametime([string:'north'])" \
-        --subject-obj "[time:20120228T130000]" \
-        --out League_gametime_north__timeT_attr.der
 
+# Credential 4 
 # [keyid:league].oset:gametime([time:20120228T140000])
 #                    <- [keyid:league].oset:players([string:'south') 
-# Credential 4 
-creddy --attribute \
-        --issuer League_ID.pem --key League_private.pem \
-        --oset "gametime([string:'south'])" \
-        --subject-obj "[time:20120228T140000]" \
-        --out League_gametime_south__time2T_attr.der
 
+# Credential 5 
 # [keyid:league].role:players([string:'north'])<-[keyid:John]
-creddy --attribute \
-        --issuer League_ID.pem --key League_private.pem \
-        --role "players([string:'north'])" \
-        --subject-cert John_ID.pem \
-        --out League_players_north__John_attr.der
 
+# Credential 6 
 # [keyid:league].role:players([string:'south'])<-[keyid:Mark]
-creddy --attribute \
-        --issuer League_ID.pem --key League_private.pem \
-        --role "players([string:'south'])" \
-        --subject-cert Mark_ID.pem \
-        --out League_players_south__Mark_attr.der
 
-#####################################################################
-#league allows member of a team to access stadium at their team's designed time
-#
-#[keyid:league].role:stadium([string:'access'],[boolean:true],
-#          [time:?F:[keyid:league].oset.gametime([string:?T])])
-#                <-[keyid:league].role:players([string:?T])
-#
-#[keyid:league].role:stadium([string:'access'],[time:?Tm]) <- [principal:?P]
-#[keyid:league].oset:gametime(string:?Team) <- [time:?Tm]
-#[keyid:league].role:player(string:?Team) <- [principal:?P]
-#
-#
-#league.stadium(access,?Time:league.gametime(?Team)) <- league.players(?Teams)
-#              league.player(north) <- john
-#              league.player(south) <- mark 
-#              league.gametime(north) <- [time:'20120228T130000']
-#              league.gametime(south) <- [time:'20120228T140000']
-#
-#league.statdium(access,?FreeTime:[20120228T080000..20120228T090000]) 
-#                  <- league.players(_).
-#
-#[keyid:league].role:stadium([string:'access'],[boolean:?B:[true]],
-#              [time:?F:['20120228T080000'..'20120228T090000']])
-#               <- [keyid:league].role:players(string:?T) 
Index: examples/python_tests/balltime_rt2/attr.py
===================================================================
--- examples/python_tests/balltime_rt2/attr.py	(revision 669b4810acfbeee6bdec4a2443a99b2994efedc8)
+++ examples/python_tests/balltime_rt2/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,4 +2,7 @@
 
 """
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
+
 cmd1:env keystore=`pwd` ./attr.py 
 """
@@ -8,10 +11,12 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 out = ctxt.context_principals()
@@ -27,4 +32,5 @@
 print "\n"
 
+# retrieve principals' keyid value from local credential files
 leagueID=ABAC.ID("League_ID.pem");
 leagueID.id_load_privkey_file("League_private.pem");
@@ -40,4 +46,5 @@
 
 ################################################
+# Credential 1, oset constraint on a time parameter
 #[keyid:league].role:stadium([string:'access'],[boolean:true],
 #          [time:?F:[keyid:league].oset.gametime([string:?T])])
@@ -46,8 +53,17 @@
 param2=ABAC.DataTerm("boolean","true")
 
+# setup the uninstantiated variable as the oset constraint's parameter
 param=ABAC.DataTerm("string","T")
+
+# make the oset condition
 condoset=ABAC.Oset(league,"gametime")
+
+# add the parameter for the constraint
 condoset.oset_add_data_term(param)
+
+# create the constraint with the oset condition
 cond=ABAC.Constraint(condoset)
+
+# make the data term that is being constrained
 param3=ABAC.DataTerm("time", "F", cond)
 head = ABAC.Role(league,"stadium")
@@ -55,11 +71,16 @@
 head.role_add_data_term(param2)
 head.role_add_data_term(param3)
-
 param=ABAC.DataTerm("string", "T")
 tail = ABAC.Role(league,"players")
 tail.role_add_data_term(param)
+
+# build up the attribute policy
 attr=ABAC.Attribute(head, 1800)
 attr.attribute_add_tail(tail)
+
+# finalize the policy
 attr.attribute_bake()
+
+# create the credential file for this policy
 attr.attribute_write_cert("League_access_qFqT__League_players_qT_attr.der")
 ctxt.load_attribute_file("League_access_qFqT__League_players_qT_attr.der")
@@ -69,12 +90,17 @@
 
 ################################################
-# ??? not sure if this is a valid policy
+# Credential 2, 2 different range constraints, one on a boolean and
+#               and the other is on a time
 #[keyid:league].role:stadium([string:'access'],[boolean:?B:[true],
 #              [time:?F:[20120228T080000..20120228T090000]])
 #               <- [keyid:league].role:players(string:?T)
 param1=ABAC.DataTerm("string","'access'")
+
+# generate a range constraint with a single target value
 cond=ABAC.Constraint("boolean")
 cond.constraint_add_boolean_target("true")
 param2=ABAC.DataTerm("boolean", "B", cond)
+
+# generate a range constraint with a min and a max 
 cond=ABAC.Constraint("time")
 cond.constraint_add_time_min("20120228T080000")
@@ -100,4 +126,5 @@
 
 #################################################
+# Credential 3
 # [keyid:league].oset:gametime([string:'north'])
 #                    <- [time:20120228T130000]
@@ -117,4 +144,5 @@
 
 #################################################
+# Credential 4
 # [keyid:league].oset:gametime([string:'south']) 
 #                    <-[time:20120228T140000]
@@ -134,4 +162,5 @@
 
 #################################################
+# Credential 5
 # [keyid:league].role:players([string:'north'])<-[keyid:John]
 param=ABAC.DataTerm("string", "'north'")
@@ -149,4 +178,5 @@
 
 #################################################
+# Credential 6
 # [keyid:league].role:players([string:'south'])<-[keyid:Mark]
 param=ABAC.DataTerm("string", "'south'")
@@ -164,4 +194,2 @@
 
 
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/balltime_rt2/ball.save
===================================================================
--- examples/python_tests/balltime_rt2/ball.save	(revision 669b4810acfbeee6bdec4a2443a99b2994efedc8)
+++ examples/python_tests/balltime_rt2/ball.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,4 +1,17 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
   
+...final principal set...
+(pJohn,keyid,y) 
+(pLeague,keyid,y) 
+(pMark,keyid,y) 
+
+...final policy attribute set...
+pLeague.stadium('access',true,F:pLeague.gametime(T)) <- pLeague.players(T)
+pLeague.stadium('access',B:[true],F:[20120228T080000 .. 20120228T090000]) <- pLeague.players(T)
+pLeague.gametime('north') <- time(2012,02,28,13,00,00)
+pLeague.gametime('south') <- time(2012,02,28,14,00,00)
+pLeague.players('north') <- pJohn
+pLeague.players('south') <- pMark
+
 ===good============ league.stadium(access,true,20120128T130000)<-?-john
 YAP query succeed
@@ -14,19 +27,2 @@
 pLeague.stadium('access',B:[true],F:[20120228T080000 .. 20120228T090000]) <- pLeague.players(T)
 pLeague.players('south') <- pMark
-
-...final principal set...
-(pJohn,keyid,y) 
-(pLeague,keyid,y) 
-(pMark,keyid,y) 
-
-
-
-...final policy attribute set...
-pLeague.stadium('access',true,F:pLeague.gametime(T)) <- pLeague.players(T)
-pLeague.stadium('access',B:[true],F:[20120228T080000 .. 20120228T090000]) <- pLeague.players(T)
-pLeague.gametime('north') <- time(2012,02,28,13,00,00)
-pLeague.gametime('south') <- time(2012,02,28,14,00,00)
-pLeague.players('north') <- pJohn
-pLeague.players('south') <- pMark
-
-
Index: examples/python_tests/balltime_rt2/query.py
===================================================================
--- examples/python_tests/balltime_rt2/query.py	(revision 669b4810acfbeee6bdec4a2443a99b2994efedc8)
+++ examples/python_tests/balltime_rt2/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 leagueID=ABAC.ID("League_ID.pem");
 leagueID.id_load_privkey_file("League_private.pem");
@@ -33,4 +37,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# can john go to stadium at 1pm?
 # role=[keyid:league].role:stadium([string:'access'],[boolean:true],[time:20120228T130000]) 
 # p=[keyid:john]
@@ -49,4 +66,5 @@
 
 ##########################################################################
+# can mark go to stadium at 11am?
 # role=[keyid:league].role:stadium([string:'access'],[boolean:true],[time:20120228T110000]) 
 # p=[keyid:mark]
@@ -65,4 +83,5 @@
 
 ##########################################################################
+# can mark go to stadium at 8am then?
 # role=[keyid:league].role:stadium([string:'access'],[boolean:true],[time:20120228T080000])
 # p=[keyid:mark]
@@ -79,22 +98,2 @@
 for c in out[1]:
     print "%s <- %s" % (c.head_string(), c.tail_string())
-
-##########################################################################
-# dump the yap dB
-#
-#ctxt.dump_yap_db()
-
-##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
Index: examples/python_tests/balltime_rt2/run_test
===================================================================
--- examples/python_tests/balltime_rt2/run_test	(revision 669b4810acfbeee6bdec4a2443a99b2994efedc8)
+++ examples/python_tests/balltime_rt2/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,6 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 echo '---setup principals'
Index: examples/python_tests/balltime_rt2/setup.py
===================================================================
--- examples/python_tests/balltime_rt2/setup.py	(revision 669b4810acfbeee6bdec4a2443a99b2994efedc8)
+++ examples/python_tests/balltime_rt2/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,4 +2,6 @@
 
 """
+See README for the semantics.  This creates principals
+used by the example.
 """
 import os
