#####################################################################
# This example demonstrates using an oset (object set) to control access
# to files based on the attributes of the principals.  The script creates
# three principals League, John and Mark and sets out the access policy.
# 
# files are named by URNs and are not principals.
# 
# A principal's access rights are controlled by the League principal.  If a 
# principal has the role role::stadium(string:'access',boolean:true,time:now)
# that  principal can go into stadium if principal's team has a scheduled 
# gametime.  A principal is in team's roster if it is in
# the oset of players(team) defined by League, written
# [keyid:League].oset:players(string:'north'))
# 
# The file, attr.py, lays out the policy that players of a given team can
# go to the stadium when it is their team's gametime -- credential 1.
# or any player of a team that is controlled by the League principal can
# go to the stadium during stadium's free for all time -- credential 2.
#
# Credentials 3 & 4 establish the afernoon gametimes for team(north) 
# and for team(south)
# Credentials 5 & 6 establish John as player of team(north) and Mark as
# a player for team(south)
#
# The query.py file runs 3 queries.  First it confirms that John can 
# go to stadium at his team's gametime, then it confirms that Mark cannot
# go because it is not his gametime, but Mark can go to the stadium during
# stadium's free-for-all early morning time

# balltime_rt2

# Credential 1
#[keyid:league].role:stadium([string:'access'],[boolean:true],
#          [time:?F:[keyid:league].oset.gametime([string:?T])])
#                <-[keyid:league].role:players([string:?T])

# Credential 2 
#[keyid:league].role:stadium([string:'access'],[boolean:?B:[true],
#              [time:?F:[20120228T080000..20120228T090000]])
#               <- [keyid:league].role:players(string:?T) 

# Credential 3
# [keyid:league].oset:gametime([time:20120228T130000])
#                    <- [keyid:league].oset:players([string:'north') 

# Credential 4 
# [keyid:league].oset:gametime([time:20120228T140000])
#                    <- [keyid:league].oset:players([string:'south') 

# Credential 5 
# [keyid:league].role:players([string:'north'])<-[keyid:John]

# Credential 6 
# [keyid:league].role:players([string:'south'])<-[keyid:Mark]