#!/bin/sh

rm -rf *.der *.pem

# alpha.read(fileA) <-?- Bob
#[keyid:Alpha].role:read([urn:'file://fileA']) <-?- [keyid:Bob] (yes)
#[keyid:Alpha].role:read([urn:'file://fileA']) <-?- [keyid:Maryann] (yes)

creddy --generate --cn Alpha
creddy --generate --cn Bob
creddy --generate --cn Maryann
creddy --generate --cn Joe

alpha_keyid=`creddy --keyid --cert Alpha_ID.pem`
bob_keyid=`creddy --keyid --cert Bob_ID.pem`
maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
joe_keyid=`creddy --keyid --cert Joe_ID.pem`

read_fileA="read([urn:'file://fileA'])"
managerof_joe="managerOf([keyid:$joe_keyid])"
ownerof_fileA="ownerOf([urn:'file://fileA'])"
managerof_qE="managerOf([principal:?E[keyid:$alpha_keyid].role:ownerOf([urn:?F])])"

# alpha.read(?F) <- alpha.managerOf(?E:alpha.ownerOf(?F))
# [keyid:alpha].role:read([urn:?F])<-
#    [keyid:alpha].role:managerOf([principal:?E[keyid:alpha].role:ownerOf([urn:?F])]
creddy --attribute \
       --issuer Alpha_ID.pem --key Alpha_private.pem --role "read([urn:?F])" \
       --subject-cert Alpha_ID.pem --subject-role "$managerof_qE" \
       --out Alpha_read_qF__alpha_managerof_qE_attr.der

#[keyid:Alpha].role:managerOf([Keyid:Joe]) <- [keyid:Bob]
creddy --attribute \
        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$managerof_joe" \
        --subject-cert Bob_ID.pem \
        --out Alpha_managerof_Joe__Bob_attr.der

#[keyid:Alpha].role:ownerOf([urn:'file://fileA']) <- [keyid:Joe]
creddy --attribute \
        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$ownerof_fileA" \
        --subject-cert Joe_ID.pem \
        --out Alpha_ownerof_fileA__Joe_attr.der

####################################################################################
# note:
# 
# alpha.read(?F) <- alpha.manager(?E:alpha.owner(?F))
# [keyid:alpha].role:read([urn:?F])<-
#       #[keyid:alpha].role:manager([principal:?E[keyid:alpha].role:owner([urn:?F])])
# 
# alpha.read(?F) <- alpha.manager(?E) 
# and alpha.owner(?F) <- ?E
# 
# [keyid:alpha].role:read([urn:?F])<-[keyid:?M]
#     [keyid:alpha].role:manager([principal:?E])<-[keyid:?M]
#     [keyid:alpha].role:owner([urn:?F])<-[keyid:?E]
# 
# isMember(M,role(alpha,read,F)) :-
#       isMember(M, role(alpha,manager,E)),
#       isMember(E, role(alpha,owner,F))  <-- constraining rule
# 
# alpha.read(?F) <- alpha.manager(?E)
# alpha.owner(?F) <- ?E
# 
# condition like this,
#          ?E:A.r  needs to be translate into constraining rule,  A.r<-?E
# 
# query,
# alpha.read(fileA) <-?- Bob
# needs
# alpha.manager(Joe)<-Bob
# alpha.owner(fileA)<-Joe