\chapter{Ausgew"ahlte Schnittstellen der Autorisierungsbibliothek}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\label{Progs}

Die nachfolgenden Schnittstellen bilden eine kleine Auswahl der implementierten Module zur Zugriffskontrolle. Es handelt sich hierbei um die vier Komponenten der Zugriffskontrollbibliothek, aus denen sich der Anwender selbst"andig eigene Applikationen zusammenstellen kann.

\section{Die Modulschnittstelle GroupStructure}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\label{GroupProg}
Die Modulschnittstelle {\it GroupStructure} bietet Funktionen zum Aufbau und zur Verwaltung einer Subjekthierarchie beliebiger Komplexit"at an. Die Subjekthierarchie ist in Form eines abstrakten Datentyps implementiert; der Typ der verwalteten Subjekte ist frei w"ahlbar.
\begin{xple}
\ke{interface} GroupStructure
\ke{import} iter  group  nameDB  :GroupTypes
\ke{export
  Let} Classification = 
    \ke{Tuple
      case} deepDisjunct
      \ke{case} disjunct
    \ke{end} 
  (* defines a group policy for nested groups *) 
  \ke{Let} T(E $<$:\ke{Ok}) = \ke{Tuple}
    Nested $<$:\ke{Ok}
    Bottom $<$:\ke{Ok}
    error :\ke{Exception}
    \ke{Let} Member = \ke{Tuple
      case} bottom \ke{with} member :Bottom
      \ke{case} nested \ke{with} member :Nested
    \ke{end} 
    (* type for an arbitrary group (Bottom or Nested) *)
    setEqual(equalE(:Member  :Member) :Bool) :\ke{Ok}
    newNested(name :String  kind :Classification) :Nested
    (* creates a new empty group which can be filled with other groups *)
    newBottom(name :String  equalE(:E  :E) :Bool) :Bottom
    (* returns a new empty bottom group *)
    addNested(nestedGroup :Nested  newMember :Member) :\ke{Ok}
    (* adds an element to a nested group *)
    addNestedElements(nestedGroup :Nested  elements :iter.T(Member)) :\ke{Ok}
    (* adds a list of groups to a nested group *)
    addBottom(bottomGroup :Bottom  newMember :E) :\ke{Ok}
    (* adds an element to a bottom group *)
    addBottomElements(bottomGroup :Bottom  elements :iter.T(E)) :\ke{Ok}
    (* adds a list of elements to a bottom group *)
    subExisting(element :E) :Bool
    (* returns true if element is member of at least one bottom group *)
    groupsWithElement(element :E) :iter.T(Bottom)
    (* returns all bottom groups of which element is member *)
    memberNested(element :Member  nestedGroup :Nested) :Bool
    (* tests if element is member of group *)
    memberBottom(element :E  bottomGroup :Bottom) :Bool
    (* tests if element is member of group *)
    deepMember(element :E  nestedGroup :Nested) :Bool
    (* tests if element of base type is member of any recursively reachable
       bottom group *)
    deepGroups(nestedGroup :Nested) :iter.T(Member)
    (* returns all bottom groups of group *)
    deleteNested(element :Member  nestedGroup :Nested) :\ke{Ok}
    (* deletes an element from group *)
    deleteNestedElements(elements :iter.T(Member)  nestedGroup :Nested): \ke{Ok}
    (* deletes a list of elements from a bottom group *)
    deleteBottom(element :E  bottomGroup :Bottom) :\ke{Ok}
    (* deletes an element from a bottom group *)
    deleteBottomElements(elements :iter.T(E)  bottomGroup :Bottom) :\ke{Ok}
    (* deletes a list of elements from a bottom group *)
    nestedElements(nestedGroup :Nested) :iter.T(Member)
    (* returns all members of group *)
    bottomElements(bottomGroup :Bottom) :iter.T(E)
    (* returns all deep members of a bottom group *)
    deepElements(nestedGroup :Nested) :iter.T(E)
    (* returns all deep members of group *)
    getName(nestedGroup :Nested) :String
    (* returns the name of a group *)
    getBottomName(bottomGroup :Bottom) :String
    (* returns the name of a bottom group *)
    getByName(name :String): Member
    (* checks if any member with name exists and returns it. Raises error
       if no such member exists *)
    getSuperGroups(nestedGroup :Nested) :iter.T(Nested)
    (* returns an iteration over all groups which have nestedGroup as a 
       subgroup *)
    transitiveSuperGroups(nestedGroup :Nested) :iter.T(Nested)
    (* returns an iteration over all groups which have nestedGroup as a
       transitive reachable subgroup *)
    getBottomSuperGroups(bottomGroup :Bottom) :iter.T(Nested)
    (* returns an iteration over all groups which have bottomGroup as a
       subgroup *)
    transitiveBottomSuperGroups(bottomGroup :Bottom) :iter.T(Nested)
    (* returns an iteration over all groups which have bottomGroup as a
       transitive reachable subgroup *)
    getClassification(nestedGroup :Nested) :Classification
    (* returns the classification of a group *)
    changeClassification(nestedGroup :Nested
       newClassification :Classification) :\ke{Ok}
    (* changes the classification of a group if possible *)
    size(nestedGroup :Nested) :Int
    (* returns the number of elements in group *)
    bottomSize(bottomGroup :Bottom) :Int
    (* returns the number of elements in a bottom group *)
    deepSize(nestedGroup :Nested) :Int
    (* returns the number of all base elements, transitiv reachable *)
    numberOfSubGroups(nestedGroup :Nested) :Int
    (* returns the number of all subGroups that are transitive reachable *)
    cyclesExisting() :Bool
    (* returns true if group structure contains a least one circle *)
    depth(nestedGroup :Nested) :Int
    (* returns the maximum depth of group, i.e. the number of hierachy levels *)
    empty(nestedGroup :Nested) :Bool
    (* checks if group is empty *)
    emptyBottom(bottomGroup :Bottom) :Bool
    (* checks if bottom group is empty *)
    clear(nestedGroup :Nested) :\ke{Ok}
    (* deletes all elements in group *)
    clearBottom(bottomGroup :Bottom) :\ke{Ok}
    (* deletes all elements in a bottom group *)
    copy(nestedGroup :Nested  name :String) :Nested
    (* returns a group with exactly all elements of group *)
    copyBottom(bottomGroup :Bottom  name :String) :Bottom
    (* returns a bottom group with exactly all elements of group *)
    disjunct(groupA, groupB :Nested) :Bool
    (* returns true if both groups don't have a common element *)
    disjunctBottom(groupA, groupB :Bottom) :Bool
    (* returns true if both bottom groups don't have a common element *)
    overlapping(groupA, groupB :Nested) :Bool
    (* returns true if both groups have a least one common element *)
    overlappingBottom(groupA, groupB :Bottom) :Bool
    (* returns true if both bottom groups have a least one common element *)
    included(minGroup, maxGroup :Nested) :Bool
    (* returns true if all elements of minbGroup are in maxGroup too *)
    includedBottom(minGroup, maxGroup :Bottom) :Bool
    (* returns true if all elements of minGroup are in maxGroup too *)
    isomorph(groupA, groupB :Nested) :Bool
    (* checks, if all subgroups of groupA and groupB are equal and have the
       same structure. Equality of groupA and groupB is not tested *)
    baseDisjunct(groupA, groupB :Nested) :Bool
    (* returns true if groupA and groupB do not have a common base element *)
    intermediateDisjunct(groupA, groupB :Nested) :Bool
    (* returns true if all subgroups of groupA and groupB are equal. Bottom-
       Groups and their elements are not tested for equality *)
    baseEqual(groupA, groupB :Nested) :Bool
    (* returns true if both groups have the same number and type of bottom
       groups *)
    intermediateEqual(groupA, groupB :Nested) :Bool
    (* returns true if all nested subgroups of groupA and groupB are equal *)
    visualize(groups :iter.T(Member)  file :String) :\ke{Ok}
    (* opens a daVinci graph editor and visualizes the groupStructure with
       groups as the root nodes of the tree. A textual representation is written
       to file. This function can be used for cyclic and acyclic graphs. *)
  \ke{end}  

  new(E $<$:\ke{Ok}  extractName(:E) :String  cyclic :Bool) :T(E)
  (* creates a new group structure. Cyclic denotes whether the groups of
     the group structure are allowed to be composed with cycles *)

\ke{end};
\end{xple}

\newpage
\section{Die Modulschnittstelle Authorization}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\label{AuthProg}
Die Modulschnittstelle {\it Authorization} stellt Zugriffskontrollabstraktionen f"ur die Modellierung gesch"utzter Werte und deren Vererbungsbeziehungen zueinander bereit.

\begin{xple}
\ke{interface} Authorization

\ke{import}
  iter
\ke{export
  Let} Element = \ke{Ok}
  (* Identity of an Object that will be controlled by the security policy
     (normally a function) *)
  AuthStrategy $<$:\ke{Ok}
  (* Strategy that is used iff there is neither a permission nor a prohibition
     for a user to access a function. Optimistic denotes that in such cases
     the access is allowed; pessimistic means to forbid the access. *)
  optimistic,
  pessimistic :AuthStrategy
  error :\ke{Exception}
  \ke{Let} T(Subject $<$:\ke{Ok}) $<$:\ke{Ok} = 
    \ke{Tuple}
      Template(E $<$:\ke{Ok}) $<$:\ke{Ok} 
      Instance(E $<$:\ke{Ok}) $<$:\ke{Ok} 
      Node(E $<$:\ke{Ok}) $<$:\ke{Ok} (* Type for Source-Valueguard *)
      Edge (E $<$:\ke{Ok}) $<$:\ke{Ok} (* Type for Implication *)
      CrossRef $<$:\ke{Ok}
      InnerRef, IntraRef, InterRef $<$:\ke{Ok}
      newTemplate(E $<$:\ke{Ok}  auth :AuthStrategy) :Template(E)
      (* creates a new template *)
      isNodeOf(E $<$:\ke{Ok}  t :Template(E)  node :Node(E)) :Bool
      (* checks, if node was created by template t *)
      getTemplate(E $<$:\ke{Ok}  node :Node(E)) :Template(E)
      (* returns the template to which node (source valueguard) belongs *)
      getAuthStrategy(E $<$:\ke{Ok}  node :Node(E)) :AuthStrategy
      (* returns the authorization strategy which is valid for node *)
      instances(E $<$:\ke{Ok}  t :Template(E)) :iter.T(Instance(E))
      (* returns all instances that belong to t *)
      addInstance(E $<$:\ke{Ok}  t :Template(E)  inst :E  name :String) :Instance(E)
      (* adds an instance to a template *)
      deleteInstance(E $<$:\ke{Ok}  i :Instance(E)) :\ke{Ok}
      (* deletes an instance from a template *)
      getInst(E $<$:\ke{Ok}  i :Instance(E)) :E
      (* returns the element inst added with addInstance *)
      addElement(E $<$:\ke{Ok}  t :Template(E)  e :Element  name :String
        owner :Subject) :Node(E)
      (* adds an element to a template and returns a handle for a source 
         valueguard *)
      deleteElement(E $<$:\ke{Ok}  node :Node(E)  owner :Subject) :\ke{Ok}
      (* deletes a node (sourve valueguard) and all its refernces and 
         invalidates the users handle *)
      addImplication(E $<$:\ke{Ok}  source, destination :Node(E)
       name :String  pos :Bool) :Edge(E)
      (* connects two nodes (source valueguards) of a template, raises error if such a 
         connection already exists. If pos is true only positive rights are inherited
         via this implication; otherwise only negative rights are inherited *)
      deleteImplication(E $<$:\ke{Ok}  impl :Edge(E)) :\ke{Ok}  
      (* removes an implication an invalidates the user's handle *)
      insert,
      insertWeak,
      insertWeakNeg,
      insertNeg(E $<$:\ke{Ok}  node :Node(E)  s :Subject  owner :Subject) :\ke{Ok}
      (* inserts a subject into the (positive or negative) ACL of a template
         node (source valueguard). Its rights are valid for all corresponding 
         nodes in the instances *)
      deleteWeakNeg, 
      deleteNeg, 
      deleteWeak, 
      delete(E $<$:\ke{Ok}  node :Node(E)  s :Subject  owner :Subject) :\ke{Ok}
      (* deletes a subject from the ACL of a template node (source valueguard) *)
      exists,
      existsWeak,
      existsWeakNeg,
      existsNeg(E $<$:\ke{Ok}  node :Node(E)  s :Subject) :Bool
      (* checks if an explicit right for a template node (source valueguard) exists *)
      existsNegInstTemp,
      existsInstTemp,
      existsNegInst,
      existsInst(E $<$:\ke{Ok}  node :Node(E)  s :Subject  i :Instance(E)) :Bool
      (* checks if an explicit or implicit right for an instance node 
         (valueguard) exists; suffix -Temp denotes that this right was inherited
         from the ACL of a template node (source valueguard); suffix -Inst means
         that it was inherited by the ACL of an instance node (valueguard)*) 
     existsWeakInst,
     existsWeakInstNeg,
     existsWeakTemp,
     existsWeakTempNeg(E $<$:\ke{Ok}  node :Node(E)  s :Subject  i :Instance(E)) :Bool
      addLink(E,F $<$:\ke{Ok}  nodeFrom :Node(E)  nodeTo :Node(F)  pos :Bool) :CrossRef
      (* adds a crossreference between two nodes (source valueguards) of 
         different templates, raises error if such a link already exists. If pos
         is true only positive rights are inherited via this crossreference; 
         otherwise only negative rights are inherited *)
      deleteLink(c :CrossRef) :\ke{Ok}
      (* removes a crossreference and invalidates the users handle *)
      allowed(E $<$:\ke{Ok}  node :Node(E)  s :Subject  i :Instance(E)) :Bool
      (* important function that checks if a subject has a positive right (permission)
         to access the object associated with an instance node (valueguard) *)
      insertInstACL(E $<$:\ke{Ok}  node :Node(E)  s:Subject  i :Instance(E)  pos :Bool
        owner :Subject) :\ke{Ok}
      (* inserts a subject into the ACL of an instance node (valueguard) *)
      deleteInstACL(E $<$:\ke{Ok}  node :Node(E)  s:Subject  i :Instance(E)
        owner :Subject) :\ke{Ok}
      (* deletes a subject from the ACL of an instance node (valueguard) *)
      insertWeakInst(E $<$:\ke{Ok}  node :Node(E)  s:Subject  i :Instance(E) 
        pos :Bool  owner :Subject) :\ke{Ok}
      (* inserts a subject into the ACL for weak rights of an instance node (valueguard) *)
      deleteWeakInst(E $<$:\ke{Ok}  node :Node(E)  s:Subject  i :Instance(E)
        owner :Subject) :\ke{Ok}
      (* deletes a subject from the ACL for weak rights of an instance node (valueguard) *)
      addInter(E,F $<$:\ke{Ok}  nodeFrom :Node(E)  nodeTo :Node(F)  instFrom :Instance(E)
        instTo :Instance(F)  pos :Bool) :InterRef
      (* adds an inter-instance reference, i.e. a connection between two instance nodes
         (valueguards) belonging to different templates, raises error if such a
         connection already exists. If pos is true only positive rights are inherited 
         via this instreference; otherwise only negative rights are inherited *)
      addIntra(E $<$:\ke{Ok}  nodeFrom,nodeTo :Node(E)
        instFrom, instTo :Instance(E)  pos :Bool) :IntraRef
      (* adds an intra-instance reference, i.e. a connection between two
         instance nodes (valueguards) belonging to the same template but 
         different instances. If pos is true only positive rights are inherited 
         via this instreference; otherwise only negative rights are inherited *)
      addInner(E $<$:\ke{Ok}  nodeFrom, nodeTo :Node(E)  inst :Instance(E) 
        pos :Bool) :InnerRef
      (* adds an inner-instance reference, i.e. a connection between two
         instance nodes (valueguards) belonging to the same instance. If pos is 
         true only positive rights are inherited via this instreference; 
         otherwise only negative rights are inherited *)
      deleteInter(i :InterRef) :\ke{Ok}
      (* deletes an inter-instance reference and invalidates the users handle *)
      deleteIntra(i :IntraRef) :\ke{Ok}
      (* deletes an intra-instance reference and invalidates the users handle *)
      deleteInner(i :InnerRef) :\ke{Ok}
      (* deletes an inner-instance reference and invalidates the users handle *)
      visualizeInstances(E $<$:\ke{Ok}  t:Template(E)  file :String) :\ke{Ok}
      (* opens a daVinci graph editor and shows the instances of t *) 
  \ke{end}

  new(Subject $<$:\ke{Ok}  null :Subject  exName(:Subject) :String
    eq(:Subject  :Subject) :Bool) :T(Subject)

\ke{end};
\end{xple}

\newpage
\section{Die Modulschnittstelle Granting}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\label{GrantProg}
Propagierungshistorien diskreter Autorisierungen werden mit Hilfe der Modulschnittstelle {\it Granting} erzeugt und verwaltet.

\begin{xple}
\ke{interface} Granting
\ke{import 
export

  Let} T(Subject, Object $<$:\ke{Ok}) = \ke{Tuple}
    Element $<$:\ke{Ok}
    Key $<$:\ke{Ok}
    grant(grantor, grantee :Subject  object :Object  grantOption :Bool) :\ke{Ok}
    (* Grantor enables access on object for grantee. GrantOption determines
       whether grantee is allowed to grant access on object to further users *)
    grantOwnership(grantor :Subject  object :Object) :\ke{Ok}
    (* grantor becomes owner of object *)
    getOwner(object :Object) :Subject
    (* returns the owner of object, raise error if no owner exists *)
    owner(subject :Subject  object :Object) :Bool
    (* returns true if subject has ownership for object *)
    revoke(grantor, grantee :Subject  object :Object) :\ke{Ok}
    (* Grantor revokes access on object for grantee. All grants that were given
       by grantee will be deleted as well *)
    revokeOwnership(owner :Subject  object :Object) :\ke{Ok}
    (* drops owner relation between owner and object and deletes all inherited
       access rights *)
    changeGrantOption(grantor, grantee :Subject  object :Object) :\ke{Ok}
    (* grantor changes  grantOption attribute for access on object by
       grantee to false for all grants that have been given so far. *)
    changeOwnership(oldOwner, newOwner :Subject  object :Object
      keepUsers :Bool) :\ke{Ok}
    (* replaces old owner of object with new owner. If keepUsers is true all
       transitive inherited access grants are kept, otherwise
       revokeOwnership(oldOwner object) and grantOwnership(newOwner object) is 
       performed *)
    accessAllowed(user :Subject  object :Object) :Bool
    (* returns true if user has grant to use object *)
    visualize(object :Object  file :String  withTimeStamps :Bool) :\ke{Ok}
    (* opens a daVinci graph editor that shows the propagation of a right on
       object.*)
  \ke{end}

  error :\ke{Exception}

  new(Subject, Object $<$:\ke{Ok}  extractName1(:Subject) :String
      extractName2(:Object) :String) :T(Subject Object)
\ke{end};
\end{xple}

\newpage
\section{Die Modulschnittstelle AuthGenerators}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\label{GenProg}
Generatorfunktionen, die aus einer ungesch"utzten Funktion und einem konkreten Autorisierungssystem eine gesch"utzte Funktion erzeugen, bietet die Modulschnittstelle {\it AuthGenerators} an. Da Funktionen verschiedener Arit"at im allgemeinen nicht in einer Subtypbeziehung zueinander stehen, mu"s je eine Generatorfunktion f"ur jede m"ogliche Anzahl von Eingabeparametern einer Funktion bereitgestellt werden.

\begin{xple}
\ke{interface} AuthGenerators

\ke{import}

  authorization

\ke{export}

  error :\ke{Exception}

  generate0(E,N,Subject $<$:\ke{Ok}  f() :E  auth :authorization.T(Subject)
    node :auth.Node(N)  convert() :N  eq(:N :N) :Bool) :\ke{Fun}(sub :Subject) :E

  generate1(E,F,N,Subject $<$:\ke{Ok}  f(:E) :F  auth :authorization.T(Subject)
    node :auth.Node(N)  convert(:E) :N  eq(:N :N) :Bool) :\ke{Fun}(:E  sub :Subject) :F

  generate2(E,F,G,N,Subject $<$:\ke{Ok}  f(:E :F) :G  auth :authorization.T(Subject)
    node :auth.Node(N)  convert(:E :F) :N
    eq(:N :N) :Bool) :\ke{Fun}(:E :F  sub :Subject) :G

  generate3(E,F,G,H,N,Subject $<$:\ke{Ok}  f(:E :F :G) :H  auth :authorization.T(Subject)
    node :auth.Node(N)  convert(:E :F :G) :N
    eq(:N :N) :Bool) :\ke{Fun}(:E :F :G  sub :Subject) :H

  generate4(E,F,G,H,I,N,Subject $<$:\ke{Ok}  f(:E :F :G :H) :I 
    auth :authorization.T(Subject)  node :auth.Node(N)  convert(:E :F :G :H) :N
    eq(:N :N) :Bool) :\ke{Fun}(:E :F :G :H  sub :Subject) :I

  generate5(E,F,G,H,I,J,N,Subject $<$:\ke{Ok}  f(:E :F :G :H :I) :J 
    auth :authorization.T(Subject)  node :auth.Node(N)  convert(:E :F :G :H :I) :N
    eq(:N :N) :Bool) :\ke{Fun}(:E :F :G :H :I  sub :Subject) :J

\ke{end};
\end{xple}
