Index: fedd/abac-src/ttg/credential/RtmlFrontier.java
===================================================================
--- fedd/abac-src/ttg/credential/RtmlFrontier.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/RtmlFrontier.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,301 @@
+package com.nailabs.abac.credential;
+
+import java.util.*;
+
+import com.nailabs.abac.process.FrontierManager;
+import com.nailabs.abac.process.AckPolicy;
+import com.nailabs.abac.process.AckFact;
+import com.nailabs.abac.process.ACPolicy;
+import com.nailabs.abac.process.ResourcePolicy;
+import edu.stanford.peer.rbtm.credential.Entity;
+import edu.stanford.peer.rbtm.credential.EntityExpression;
+import edu.stanford.peer.rbtm.credential.RoleName;
+import edu.stanford.peer.rbtm.credential.SimpleRoleName;
+import edu.stanford.peer.rbtm.credential.StaticCredential;
+import edu.stanford.peer.rbtm.engine.Simp;
+import edu.stanford.peer.rbtm.engine.Sens;
+import edu.stanford.peer.rbtm.engine.Oppo;
+import edu.stanford.rt.credential.*;
+import edu.stanford.rt.parser.RTParser;
+import edu.stanford.rt.util.Constants;
+
+/** 
+ * A frontier manager class which uses the application specification 
+ * domain for determining whether a rol is issuer traces all, issuer
+ * traces def, etc.
+ */
+public class RtmlFrontier extends FrontierManager implements Constants {
+    protected HashMap discoveryConfig;
+
+    protected ApplicationDomain domain;
+
+    protected CredentialStore store;
+
+    protected RTContext context;
+
+    protected HashID id  = null;
+
+    //protected HashSet issuerTracesAll = new HashSet();
+
+    protected HashSet issuerTraces = new HashSet();
+
+    //protected HashSet issuerTracesDef  = new HashSet();
+
+    protected ResourcePolicy resourcePolicy = null;
+
+    public RtmlFrontier(HashMap config) {
+        String domainName = getApplicationDomainName(config);
+	discoveryConfig = new HashMap(2); // needed for constructing a DDEngine
+        discoveryConfig.put("DDEParser", config.get("DDEParser"));
+	discoveryConfig.put("PrepInfo", config.get("PrepInfo"));
+	discoveryConfig.put("DDEContext", config.get("DDEContext"));
+	store = (CredentialStore)config.get("CredentialStore");
+	context = (RTContext)config.get("RTContext");
+	id = new HashID(HashID.APPLICATION_DOMAIN, domainName);
+        domain = context.getApplicationDomain(id);
+	init(config);
+    }
+
+    /** specialized init method for accessing the credential store backends */
+    public void init(HashMap config) {
+        // (0) get the configurations entity identifier
+        this.self =(Entity) config.get("EntityID");
+        
+        // (1) load acknowledgement(ACK) policy
+        ackPolicy = (AckPolicy)config.get("AckPolicy");
+        
+        // (2) load access control (AC) policy 
+        acPolicy = (ACPolicy)config.get("AccessControl");
+	// (2 and 1/2) load the resource policy
+	resourcePolicy = (ResourcePolicy)config.get("ResourcePolicy");
+
+        // (3) load issuer traceable roles
+        // (4) load subject traceale roles
+        parseRoleDeclarations(config);
+
+        // (5) construct sensitive roles predicate from the ack policy
+        Sens sens = new Sens(ackPolicy.getSensitiveRoles());
+
+        // (6) construct opponent predicate from the issuer traceable roles
+        Oppo oppo = new Oppo(new Vector(issuerTracesDef));
+        oppo.addSubjects(new Vector(issuerTracesAll));
+        
+        // TBD: Does this really need to be separated into two mutually 
+        //      exclusive credential sets? And in this case we have three
+        //      credential stores (the primordial, issuer-traces, and 
+        //      subject-traces).
+        
+        // (8) separate policy reachable credentials
+        // (9) separate self reachable credentials
+        CredentialStore store = (CredentialStore)config.get("CredentialStore");
+        CredentialStore subjectStore = null, issuerStore = null;
+        try {
+            RTParser parser = new RTParser();
+            subjectStore = new CredentialStore(parser);
+            issuerStore = new CredentialStore(parser);
+            Iterator domains = 
+                store.getCredentialDomains().values().iterator();
+            while(domains.hasNext()) {
+                CredentialDomain domain = (CredentialDomain)domains.next();
+                RoleDefinition def = 
+                    (RoleDefinition)domain.roleDefinitionIterator().next();
+                RoleName roleName = 
+                    new SimpleRoleName(def.getHead().getName());
+                if(isIssuerTraceable(roleName)) {
+                    issuerStore.addCredentialDomain(domain.getHashID(),domain);
+                } else {
+		    //if(isSubjectTraceable(roleName)) {
+                    subjectStore.addCredentialDomain(domain.getHashID(),domain);
+                }
+                // It is possible that credential may fall through to here. We 
+                // propbably just remove the second if-statement...
+            }
+        } catch (Exception ex) {
+            ex.printStackTrace();
+        }
+
+        // (7) construct the frontier functions with their predicates
+	oppoLocal = new RtmlEngine(issuerStore);
+        System.out.println("------> Sensitive Graph");
+        sensFrontier = new RtmlEngine(subjectStore, sens);
+        System.out.println("------> Opponent Graph");
+        oppoFrontier = new RtmlEngine(issuerStore, oppo);
+        System.out.println("------> Simple Graph");
+        simpFrontier = new RtmlEngine(subjectStore, new Simp());
+
+	// perform credential discovery here
+	DDEngine selfTraceable = discoverSelfTraceable();
+	DDEngine policyTraceable = discoverPolicyTraceable();
+	// TBD: add backwards compatibility check in here if necessary
+	//      which would avoid discovery
+	((RtmlEngine)oppoLocal).importDomains(policyTraceable);
+	((RtmlEngine)sensFrontier).importDomains(selfTraceable);
+	((RtmlEngine)oppoFrontier).importDomains(policyTraceable);
+	((RtmlEngine)simpFrontier).importDomains(selfTraceable);
+    }
+
+
+    protected String getApplicationDomainName(HashMap config) {
+        Properties props = (Properties)config.get("RTML");
+        return props.getProperty("ApplicationDomain");
+    }
+    
+    protected OrderedMap getRoleDeclarations() {
+        try {
+	    return domain.getRoleDeclarations();
+        } catch(Exception ex) {
+            ex.printStackTrace();
+        }
+        return null;
+    }
+
+
+    public DDEngine discoverPolicyTraceable() {
+	Iterator ackValues = ackPolicy.getRequiredRoles().iterator();
+	Iterator acValues = acPolicy.getRequiredRoles().iterator();
+	Iterator resourceValues = resourcePolicy.getRequiredRoles().iterator();
+	DDEngine discoveryEngine = new DDEngine(discoveryConfig);
+	HashSet policySet = new HashSet();
+	
+	while(ackValues.hasNext()) {
+	    AckFact ackVal = (AckFact)ackValues.next();
+	    policySet.add(ackVal.getRequirement());
+	}
+	while(acValues.hasNext()) {
+	    EntityExpression acVal = (EntityExpression)acValues.next();
+	    policySet.add(acVal);
+	}
+	while(resourceValues.hasNext()) {
+	    EntityExpression resourceVal = 
+		(EntityExpression)resourceValues.next();
+	    policySet.add(resourceVal);
+	}
+	Iterator randomRoles = policySet.iterator();
+	while(randomRoles.hasNext()) {
+	    EntityExpression random = (EntityExpression)randomRoles.next();
+	    discoveryEngine.backwardSearch(random);
+	}
+	return discoveryEngine;
+    }
+
+    public DDEngine discoverSelfTraceable() {
+	HashSet selfSet = new HashSet();
+	Iterator mySensRoles = ackPolicy.getSensitiveRoles().iterator();
+	DDEngine discoveryEngine = new DDEngine(discoveryConfig);
+	//RtmlEngine local = new RtmlEngine(store);
+
+	//find all the credentials which have roles that map directly to self
+	Iterator myRoles = oppoFrontier.findCredentialsBySubject(self);
+	while(myRoles.hasNext()) {
+	    RtmlCredential cred = (RtmlCredential)myRoles.next();
+	    EntityExpression me = cred.getDefinedRole();
+	    selfSet.add(me);
+	}
+	myRoles = sensFrontier.findCredentialsBySubject(self);
+	while(myRoles.hasNext()) {
+	    RtmlCredential cred = (RtmlCredential)myRoles.next();
+	    EntityExpression me = cred.getDefinedRole();
+	    selfSet.add(me);
+	}
+	//add the sensitive roles to the initial search set
+	while(mySensRoles.hasNext()) {
+	    EntityExpression sense = (EntityExpression)mySensRoles.next();
+	    selfSet.add(sense);
+	}
+	//perform forward searches on the pseudo-random set of roles
+	Iterator randomRoles = selfSet.iterator();
+	while(randomRoles.hasNext()) {
+	    EntityExpression random = (EntityExpression)randomRoles.next();
+		discoveryEngine.forwardSearch(random);
+	}
+	return discoveryEngine;
+    } 
+
+
+    protected void parseRoleDeclarations(HashMap config) {
+	// TBD: revisit to make this more robust in case an error occurs.
+	//      it should not necessarily bail out of all role processing
+	try {
+	    OrderedMap map = getRoleDeclarations();
+	    Iterator keys = map.keyIterator();
+	    System.out.println("Frontier parsing role declaratons");
+	    while(keys.hasNext()) {
+		RoleDeclaration role = (RoleDeclaration)map.get(keys.next());
+		System.out.println("role = " + role.getName());
+		parseRoleDeclaration(role);
+		System.out.println();
+	    }
+	} catch(Exception ex) {
+	    ex.printStackTrace();
+	}
+	System.out.println("End declaration parsing!");
+	config.put("IssuerTracesAll", issuerTracesAll);
+	config.put("IssuerTracesDef", issuerTracesDef);
+	config.put("SubjectTraceable", subjectTraces);
+    }
+
+    protected void parseRoleDeclaration(RoleDeclaration declaration) {
+        int issuerValue = declaration.getIssuerTracesType();
+        int subjectValue = declaration.getSubjectTracesType();
+
+        if(issuerValue == ISSUER_TRACES_ALL) {
+            issuerTracesAll.add(declaration.getName());
+	    System.out.print("issuer_traces_all");
+        } 
+        if(issuerValue == ISSUER_TRACES_DEF) {
+            issuerTracesDef.add(declaration.getName());
+	    System.out.print("issuer_traces_def");
+        }
+        if(subjectValue == SUBJECT_TRACES_ALL) {
+            subjectTraces.add(declaration.getName());
+	    System.out.print("subject_traces_all");
+        }
+    }
+
+    private RoleDeclaration getRoleDeclaration(RoleName role) {
+        try {
+	    System.out.println("id = " + id);
+            return domain.lookupRoleDeclaration(role.getName());
+        } catch(Exception ex) {
+            ex.printStackTrace();
+        }
+        return null;
+    }
+
+    /** Is the specified credential policy traceable? */
+    public boolean isPolicyTraceable(StaticCredential cred) {
+	return isIssuerTraceable(cred.getDefinedRole().getName());
+    }
+
+    /** Can the specified credential be traced back to this negotiator? */
+    public boolean isSelfReachable(StaticCredential cred) {
+	return isSubjectTraceable(cred.getDefinedRole().getName());
+    }
+
+    public boolean isIssuerTraceable(RoleName role) {
+        int value = getRoleDeclaration(role).getIssuerTracesType();
+        return (value == ISSUER_TRACES_ALL || value == ISSUER_TRACES_DEF);
+    }
+
+    public boolean isIssuerTracesAll(RoleName role) {
+        int value = getRoleDeclaration(role).getIssuerTracesType();
+        return (value == ISSUER_TRACES_ALL);
+    }
+
+    public boolean isIssuerTracesDef(RoleName role) {
+        int value = getRoleDeclaration(role).getIssuerTracesType();
+        return (value == ISSUER_TRACES_DEF);
+    }
+
+    public boolean isSubjectTraceable(RoleName role) {
+        int value = getRoleDeclaration(role).getSubjectTracesType();
+        return (value == SUBJECT_TRACES_ALL);
+    }
+     
+    public boolean subjectTracesAll(RoleName role) {
+        int value = getRoleDeclaration(role).getSubjectTracesType();
+        return (value == SUBJECT_TRACES_ALL);
+    }
+           
+
+}
