/*----------------------------------------------------------------------
--  User rules for package AdminToken.
--
--  File name: admintoken.rlu
--
--  Description:
--    Package rule file.
--
--  Author: Phil Thornley, April 2009.  See www.sparksure.com
--
-- Copyright (c) 2009, Phil Thornley
-- All rights reserved.
--
-- Redistribution and use in source and binary forms, with or without
-- modification, are permitted provided that the following conditions
-- are met:
--
--  * Redistributions of source code must retain the above copyright
--    notice, this list of conditions and the following disclaimer.
--
--  * Redistributions in binary form must reproduce the above copyright
--    notice, this list of conditions and the following disclaimer in
--    the documentation and/or other materials provided with the distribution.
--
-- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-- "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-- LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-- PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER
-- OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-- EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-- PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-- PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-- LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-- NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
----------------------------------------------------------------------*/


/*----------------------------------------------------------------------
--  Rule 1, 2
--
--  Justification:
--    The proof function prf_isGood models the Valid component of IDCert,
--    which is a component of the refinement of the abstract own
--    variable State.
----------------------------------------------------------------------*/
admintoken_user(1): fld_valid(fld_idcert(S)) & prf_isgood(S)
                      are_interchangeable.

admintoken_user(2): prf_isgood(S) <-> prf_isgood(S2)
                      may_be_deduced_from
                    [ fld_idcert(S) = fld_idcert(S2) ] .


/*----------------------------------------------------------------------
--  Rule 3, 4
--
--  Justification:
--    The proof function prf_authcertvalid models the Valid component
--    of AuthCert, which is a component of the refinement of the abstract
--    own variable State.
----------------------------------------------------------------------*/
admintoken_user(3): fld_valid(fld_authcert(S)) & prf_authcertvalid(S)
                      are_interchangeable.

admintoken_user(4): prf_authcertvalid(S) <-> prf_authcertvalid(S2)
                      may_be_deduced_from
                    [ fld_authcert(S) = fld_authcert(S2) ] .


/*----------------------------------------------------------------------
--  Rule 5, 6
--
--  Justification:
--    AuthCert is a component of the refinement of the abstract
--    own variable State.
--
--    The proof function:
--      TheAuthCertRole(State)
--    models the value of:
--      AuthCert.Contents.Role
--    which is returned by the function:
--      Cert.Attr.Auth.TheRole(Contents : ContentsT);
----------------------------------------------------------------------*/
admintoken_user(5): theauthcertrole(S) &
                      cert__attr__auth__therole(fld_contents(fld_authcert(S)))
                    are_interchangeable.

admintoken_user(6): theauthcertrole(S) = R <-> theauthcertrole(S2) = R
                      may_be_deduced_from
                    [ fld_authcert(S) = fld_authcert(S2) ] .


/*----------------------------------------------------------------------
--  Rule 7
--
--  Justification:
--    The three replacements in rules 1, 3, and 5, above, combined.
----------------------------------------------------------------------*/
admintoken_user(7):
   fld_valid(fld_idcert(S)) and
   (fld_valid(fld_authcert(S)) and
    (PT_1 <= cert__attr__auth__therole(fld_contents(fld_authcert(S))) and
     cert__attr__auth__therole(fld_contents(fld_authcert(S))) <= PT_2))
   &
   prf_isgood(S) and
   (prf_authcertvalid(S) and
    (PT_1 <= theauthcertrole(S) and
    theauthcertrole(S) <= PT_2))
   are_interchangeable .
