-- Read, Write, Sponge, Graph Group listing  privileges on 'world' named graphs for users
--- VAL_SPARQL_ADMIN_G_CTX

DB.DBA.RDF_DEFAULT_USER_PERMS_SET ('VAL_SPARQL_ADMIN_G_CTX', 15, 1);

-- Graph Security Integrity Check

RDF_GRAPH_SECURITY_AUDIT ( 0 ) ;


-- Goal:

-- Restrict access to a specific named graph. In this case you have a named
-- graph IRI derived from each turtle document url in your RDF dump.

-- ACL Rules Declaration Script run via Virtuosos iSQL interface:

-- Cleanup

DB.DBA.RDF_GRAPH_GROUP_DEL
('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','urn:acl:qa:test:berlin') ;

DB.DBA.RDF_GRAPH_GROUP_DEL
('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','urn:acl:qa:test:paris') ;

-- DB.DBA.RDF_GRAPH_GROUP_DEL
-- ('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','file:urn:acl:qa:test:berlin') ;

-- DB.DBA.RDF_GRAPH_GROUP_DEL
-- ('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','file:urn:acl:qa:test:paris') ;


DB.DBA.RDF_GRAPH_GROUP_DEL
('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','urn:acl:qa:readonly:test') ;

DB.DBA.RDF_GRAPH_GROUP_DEL
('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','urn:acl:qa:read:write:test') ;


-- Make Public Graph Private by adding it to Private Named Graph Group

DB.DBA.RDF_GRAPH_GROUP_INS
('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','urn:acl:qa:test:berlin') ;

DB.DBA.RDF_GRAPH_GROUP_INS
('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','urn:acl:qa:test:paris') ;

-- DB.DBA.RDF_GRAPH_GROUP_INS
-- ('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','file:urn:acl:qa:test:berlin') ;

-- DB.DBA.RDF_GRAPH_GROUP_INS
-- ('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','file:urn:acl:qa:test:paris') ;

DB.DBA.RDF_GRAPH_GROUP_INS
('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','urn:acl:qa:readonly:test') ;

DB.DBA.RDF_GRAPH_GROUP_INS
('http://www.openlinksw.com/schemas/virtrdf#PrivateGraphs','urn:acl:qa:read:write:test') ;

-- Data Generation for Test Named Graph

SPARQL 

PREFIX dbpedia: <http://dbpedia.org/resource/> 
PREFIX dbo: <http://dbpedia.org/ontology/> 

INSERT { 
		GRAPH <urn:acl:qa:readonly:test> 
		    { 
			  dbpedia:Paris a dbo:Place .
			}
	   } ;
	   
SPARQL 

PREFIX dbpedia: <http://dbpedia.org/resource/> 
PREFIX dbo: <http://dbpedia.org/ontology/> 

INSERT { 
	GRAPH <urn:acl:qa:test:berlin> 
	    { 
		  dbpedia:Berlin a dbo:Place .
		}
   } ;
	   
SPARQL 

PREFIX dbpedia: <http://dbpedia.org/resource/> 
PREFIX dbo: <http://dbpedia.org/ontology/> 

INSERT { 
GRAPH <urn:acl:qa:test:paris> 
    { 
	  dbpedia:Paris a dbo:Place .
	}
  } ;
-- Conditional Group HTTP (Default Realm)

SPARQL
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

WITH <http://linkeddata.uriburner.com/acl/graph/groups/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm>
DELETE { 
         <#groupBasicNetID> ?p ?o .
       }
WHERE { 
         <#groupBasicNetID> ?p ?o .
       } ;

-- Conditional Group Definition

SPARQL

PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/groups/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm>
INSERT {
<#groupBasicNetID> 
a <http://www.openlinksw.com/ontology/acl#ConditionalGroup> ;
<http://xmlns.com/foaf/0.1/name> "Identities Denoted using a NetID based Identifier" ;
<http://www.openlinksw.com/ontology/acl#hasCondition> [
							    a <http://www.openlinksw.com/ontology/acl#GroupCondition>, 
								          <http://www.openlinksw.com/ontology/acl#GenericCondition> ;
							    <http://www.openlinksw.com/ontology/acl#hasCriteria> 
								                 <http://www.openlinksw.com/ontology/acl#NetID> ;
							    <http://www.openlinksw.com/ontology/acl#hasComparator>         
								                 <http://www.openlinksw.com/ontology/acl#IsNotNull> ;
							    <http://www.openlinksw.com/ontology/acl#hasValue> 1
							  ] .
	} ;

-- Clear ACL Cache

-- VAL.DBA.clear_graph_acl_cache() ;
VAL.DBA.clear_graph_acl_cache (null, null, 1) ;
		

	
-- Declare DeaultRealm (HTTP) ACL
-- Cleanup 

SPARQL
PREFIX  oplacl:  <http://www.openlinksw.com/ontology/acl#>
PREFIX     acl:  <http://www.w3.org/ns/auth/acl#>

WITH 
<http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm>
DELETE
   { 
     <#HttpTLSPrivateNamedGraphRule1>  ?p ?o . 
  }

WHERE    { 
     <#HttpTLSPrivateNamedGraphRule1>  ?p ?o . 
  };
  

-- ACL Definition 
-- Protection of Private Named Graph identified by IRI: <urn:acl:qa:test:berlin> 
  
SPARQL
PREFIX  oplacl:  <http://www.openlinksw.com/ontology/acl#>
PREFIX     acl:  <http://www.w3.org/ns/auth/acl#>

WITH 
<http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm>
INSERT
   {
    <#HttpTLSPrivateNamedGraphRule1>  
	 a  acl:Authorization ;
	 rdfs:label "Private Named Graph ACL (HTTP Realm) for Named Graph Identified by IRI: <urn:acl:qa:test:berlin>" ;
	 foaf:maker <http://kingsley.idehen.net/dataspace/person/kidehen#this> ;
	 oplacl:hasAccessMode  oplacl:Read ;
	 acl:accessTo <urn:acl:qa:test:berlin> ;
	 acl:agent <#groupBasicNetID> ;
     oplacl:hasScope  oplacl:PrivateGraphs ;
     oplacl:hasRealm  oplacl:DefaultRealm .
  };

-- Cleanup 

SPARQL
PREFIX  oplacl:  <http://www.openlinksw.com/ontology/acl#>
PREFIX     acl:  <http://www.w3.org/ns/auth/acl#>

WITH 
<http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm>
DELETE
	 	{
		  <#HttpTLSPrivateNamedGraphRule2> ?p ?o .
		}

WHERE  {
  			<#HttpTLSPrivateNamedGraphRule2> ?p ?o .
	   } ;

-- ACL Definition 
-- Protection of Private Named Graph identified by IRI: <urn:acl:qa:test:paris> 

SPARQL
PREFIX  oplacl:  <http://www.openlinksw.com/ontology/acl#>
PREFIX     acl:  <http://www.w3.org/ns/auth/acl#>

WITH 
<http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm>
INSERT
 {
   <#HttpTLSPrivateNamedGraphRule2> 
  	 a  acl:Authorization ;
	 rdfs:label "Private Named Graph ACL (HTTP Realm) for Named Graph Identified by IRI: <urn:acl:qa:test:paris>" ;
  	 foaf:maker <http://kingsley.idehen.net/dataspace/person/kidehen#this> ;
  	 oplacl:hasAccessMode  oplacl:Read ;
  	 acl:accessTo <urn:acl:qa:test:paris> ;
     acl:agent <https://id.myopenlink.net/DAV/home/KingsleyUyiIdehen/Public/kingsley.ttl#this>,
	          <http://kingsley.idehen.net/dataspace/person/kidehen#this>,
			  <https://s3.amazonaws.com/webid-sandbox/Profile/Basic-Identity-Claims-And-Profile-Document.ttl#i>,
			  <http://kingsley.idehen.net/public_home/kidehen/profile.ttl#i>, 
			  <https://www.dropbox.com/s/m5sdy9nn0qi15hk/profile.ttl?dl=1#identity>,
			  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i>,
			  <https://dbfff61d85d4da9b5aefce09723385e78a93f731.googledrive.com/host/0B-Mx14cLTEsaczdJdk96UVQ0aVE/profile.ttl#identity>,
			  <http://id.myopenlink.net/DAV/home/hwilliams/YouID/Hugh_Williams_id_myopenlink_net_1/profile.ttl#identity>,
			  <http://id.myopenlink.net/DAV/home/danielhm/profile.ttl#i>, <http://kingsley.idehen.net/DAV/home/kidehen/onno_profile.ttl#i> ;
       oplacl:hasScope  oplacl:PrivateGraphs ;
       oplacl:hasRealm  oplacl:DefaultRealm .
};

-- ReadOnly ACL

-- Cleanup 


SPARQL
PREFIX  oplacl:  <http://www.openlinksw.com/ontology/acl#>
PREFIX     acl:  <http://www.w3.org/ns/auth/acl#>

WITH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm>
DELETE 
 { <#HTTPSPrivateNamedGraphReadWriteTest> ?p ?o . }
WHERE 
 { <#HTTPSPrivateNamedGraphReadWriteTest> ?p ?o . } ;


-- Read-Write ACL Description

SPARQL
PREFIX  oplacl:  <http://www.openlinksw.com/ontology/acl#>
PREFIX     acl:  <http://www.w3.org/ns/auth/acl#>

WITH 
<http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm>
INSERT
 {
   <#HTTPSPrivateNamedGraphReadWriteTest>
   a acl:Authorization ;
   rdfs:label "Private Named Graph ACL (SQL Realm) for Named Graph Identified by IRI: <urn:acl:qa:read:write:test> " ;
   foaf:maker <http://kingsley.idehen.net/dataspace/person/kidehen#this> ;
   oplacl:hasAccessMode  oplacl:Read, oplacl:Write ;
   acl:accessTo <urn:acl:qa:read:write:test> ;
   # acl:agent <#SQLTLSgroupBasicNetID>, <#SQLTLSstaticGroup>  ;
   acl:agent <#groupBasicNetID>  ;
   oplacl:hasScope  oplacl:PrivateGraphs ;
   oplacl:hasRealm oplacl:DefaultRealm .
};

	
--- End of Default (HTTP) Realm ACLs for Protected Named Graphs --- 
	
	
---- Start of SQLRealm ACLs ----

-- Static Group Description

-- Cleanup 

SPARQL
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/groups/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
DELETE  {
			<#SQLTLSstaticGroup> 
			?p ?o
		} 
WHERE {
			<#SQLTLSstaticGroup> 
			?p ?o
		};

-- Group Definition
	
SPARQL
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/groups/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
INSERT {
			<#SQLTLSstaticGroup> 
			a foaf:Group ;
			foaf:name  "Conventional Group" ;
			rdfs:comment """Conventional group to which a collection of WebIDs (in the form of a list) belong.""" ;
			foaf:member <https://id.myopenlink.net/DAV/home/KingsleyUyiIdehen/Public/kingsley.ttl#this>,
				          <http://kingsley.idehen.net/dataspace/person/kidehen#this>,
						  <https://s3.amazonaws.com/webid-sandbox/Profile/Basic-Identity-Claims-And-Profile-Document.ttl#i>,
						  <http://kingsley.idehen.net/public_home/kidehen/profile.ttl#i>, 
						  <https://www.dropbox.com/s/m5sdy9nn0qi15hk/profile.ttl?dl=1#identity>,
						  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i>, 						 
						  <https://dbfff61d85d4da9b5aefce09723385e78a93f731.googledrive.com/host/0B-Mx14cLTEsaczdJdk96UVQ0aVE/profile.ttl#identity>,
						  <http://id.myopenlink.net/DAV/home/hwilliams/YouID/Hugh_Williams_id_myopenlink_net_1/profile.ttl#identity>,
						  <http://id.myopenlink.net/DAV/home/danielhm/profile.ttl#i>, 
						  <http://kingsley.idehen.net/DAV/home/kidehen/onno_profile.ttl#i>, 
						  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i> . 
	} ;
	
-- Conditional Group Description SQL Realm

-- Cleanup 

SPARQL
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/groups/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
DELETE  {
			<#SQLTLSgroupBasicNetID> 
			?p ?o
	} 
WHERE {
			<#SQLTLSgroupBasicNetID> 
			?p ?o
	} ;


-- Conditional Group Definition

SPARQL
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/groups/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
INSERT {
<#SQLTLSgroupBasicNetID> 
a <http://www.openlinksw.com/ontology/acl#ConditionalGroup> ;
<http://xmlns.com/foaf/0.1/name> "Identities Denoted using a NetID based Identifier" ;
<http://www.openlinksw.com/ontology/acl#hasCondition> [
							    a <http://www.openlinksw.com/ontology/acl#GroupCondition>, 
								          <http://www.openlinksw.com/ontology/acl#GenericCondition> ;
							    <http://www.openlinksw.com/ontology/acl#hasCriteria> 
								                 <http://www.openlinksw.com/ontology/acl#NetID> ;
							    <http://www.openlinksw.com/ontology/acl#hasComparator>         
								                 <http://www.openlinksw.com/ontology/acl#IsNotNull> ;
							    <http://www.openlinksw.com/ontology/acl#hasValue> 1
							  ] .
	} ;
	
--  Grant NetID Group Access to SQL Realm 
-- Cleanup

SPARQL
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#> 
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
DELETE {
	    <#NetIDTLSSQLAccessRule1> ?p ?o .
    }
WHERE {
	    <#NetIDTLSSQLAccessRule1> ?p ?o .
    };

-- ACL Definition

SPARQL
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#> 
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
INSERT {
	    <#NetIDTLSSQLAccessRule1> a acl:Authorization ;
	    foaf:maker <http://kingsley.idehen.net/dataspace/person/kidehen#this> ;
		rdfs:label "SQL Realm Access Authorization ACL for NetIDs" ;
		rdfs:comment """Conditional Group based ACL that provides NetIDs with SQL Realm Access.""" ;
	    oplacl:hasAccessMode oplacl:Read, oplacl:Write ;
	    acl:accessTo <urn:virtuoso:access:sql> ;
	    acl:agent <#groupBasicNetID>, <#staticGroup>  ;
	    oplacl:hasScope oplacl:Query ;
	    oplacl:hasRealm oplacl:SqlRealm .
    };
		
		
-- SPASQL Access in SQL Realm Privileges Grant to a Specific WebID (this is required for LOD Connectivity Licenses )--
-- Cleanup

SPARQL
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#> 
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
DELETE {
	    <#WebIDTLSPASQLAccessRule1> ?p ?o.
    }
WHERE {
    <#WebIDTLSPASQLAccessRule1> ?p ?o.
} ;

-- ACL Description 

SPARQL
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#> 
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
INSERT {
	    <#WebIDTLSPASQLAccessRule1> a acl:Authorization ;
	    foaf:maker <http://kingsley.idehen.net/dataspace/person/kidehen#this> ;
		rdfs:label "SQL Realm Access Authorization ACL" ;
		rdfs:comment """Mandatory ACL for granting access to SQL Realm which then enables ODBC, JDBC, ADO.NET, OLE-DB compliant
						application access, subject to Agent & User Identity.""" ;
	    oplacl:hasAccessMode oplacl:Read ;
	    acl:accessTo <urn:virtuoso:access:sparql> ;
	    acl:agent <http://kingsley.idehen.net/public_home/kidehen/profile.ttl#i>, 
   		  		  <https://id.myopenlink.net/DAV/home/KingsleyUyiIdehen/Public/kingsley.ttl#this>,
          		  <http://kingsley.idehen.net/dataspace/person/kidehen#this>,
				  <https://s3.amazonaws.com/webid-sandbox/Profile/Basic-Identity-Claims-And-Profile-Document.ttl#i>,
				  <http://kingsley.idehen.net/public_home/kidehen/profile.ttl#i>, 
				  <https://www.dropbox.com/s/m5sdy9nn0qi15hk/profile.ttl?dl=1#identity>,
				  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i>,
				  <https://dbfff61d85d4da9b5aefce09723385e78a93f731.googledrive.com/host/0B-Mx14cLTEsaczdJdk96UVQ0aVE/profile.ttl#identity>,
				  <http://id.myopenlink.net/DAV/home/hwilliams/YouID/Hugh_Williams_id_myopenlink_net_1/profile.ttl#identity>,
				  <http://id.myopenlink.net/DAV/home/danielhm/profile.ttl#i>, <http://kingsley.idehen.net/DAV/home/kidehen/onno_profile.ttl#i>,
				  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i> ;
	    oplacl:hasScope oplacl:Query ;
	    oplacl:hasRealm oplacl:SqlRealm .
    };


-- SQL Realm Authorizations (enables execution of SQL queries via SQL+TLS connections)

-- Cleanup

SPARQL
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#> 
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
DELETE {
	    <#WebIDTLSSQLAccessRule1> ?p ?o.
    }
WHERE {
	    <#WebIDTLSSQLAccessRule1> ?p ?o.
    } ;

-- ACL Description 

SPARQL
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#> 
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
INSERT {
	    <#WebIDTLSSQLAccessRule1> a acl:Authorization ;
	    foaf:maker <http://kingsley.idehen.net/dataspace/person/kidehen#this> ;
		rdfs:label "SQL Realm Access Authorization ACL" ;
		rdfs:comment """Mandatory ACL for granting access to SQL Realm which then enables ODBC, JDBC, ADO.NET, OLE-DB compliant
						application access, subject to Agent & User Identity.""" ;
	    oplacl:hasAccessMode oplacl:Read ;
	    acl:accessTo <urn:virtuoso:access:sql> ;
	    acl:agent <http://kingsley.idehen.net/public_home/kidehen/profile.ttl#i>, 
   		  		  <https://id.myopenlink.net/DAV/home/KingsleyUyiIdehen/Public/kingsley.ttl#this>,
          		  <http://kingsley.idehen.net/dataspace/person/kidehen#this>,
				  <https://s3.amazonaws.com/webid-sandbox/Profile/Basic-Identity-Claims-And-Profile-Document.ttl#i>,
				  <http://kingsley.idehen.net/public_home/kidehen/profile.ttl#i>, 
				  <https://www.dropbox.com/s/m5sdy9nn0qi15hk/profile.ttl?dl=1#identity>,
				  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i>,
				  <https://dbfff61d85d4da9b5aefce09723385e78a93f731.googledrive.com/host/0B-Mx14cLTEsaczdJdk96UVQ0aVE/profile.ttl#identity>,
				  <http://id.myopenlink.net/DAV/home/hwilliams/YouID/Hugh_Williams_id_myopenlink_net_1/profile.ttl#identity>,
				  <http://id.myopenlink.net/DAV/home/danielhm/profile.ttl#i>, <http://kingsley.idehen.net/DAV/home/kidehen/onno_profile.ttl#i>,
				  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i> ;
	    oplacl:hasScope oplacl:Query ;
	    oplacl:hasRealm oplacl:SqlRealm .
    };

-- Private Graph ACL Private Named Graph identified by IRI: <urn:acl:qa:test:berlin>
-- Cleanup 


SPARQL
PREFIX  oplacl:  <http://www.openlinksw.com/ontology/acl#>
PREFIX     acl:  <http://www.w3.org/ns/auth/acl#>

WITH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
DELETE 
 { <#TLSSQLPrivateNamedGraphRule1> ?p ?o . }
WHERE 
 { <#TLSSQLPrivateNamedGraphRule1> ?p ?o . } ;


-- ACL Description

SPARQL
PREFIX  oplacl:  <http://www.openlinksw.com/ontology/acl#>
PREFIX     acl:  <http://www.w3.org/ns/auth/acl#>

WITH 
<http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
INSERT
 {
    <#TLSSQLPrivateNamedGraphRule1> 
   a  acl:Authorization ;
   rdfs:label "Private Named Graph ACL (SQL Realm) for Named Graph Identified by IRI: <urn:acl:qa:test:berlin>" ;
   foaf:maker <http://kingsley.idehen.net/dataspace/person/kidehen#this> ;
   oplacl:hasAccessMode  oplacl:Read ;
   acl:accessTo <urn:acl:qa:test:berlin> ;
   # acl:agent <#SQLTLSgroupBasicNetID>, <#SQLTLSstaticGroup>  ;
   acl:agent <#SQLTLSstaticGroup> ;
   oplacl:hasScope  oplacl:PrivateGraphs ;
   oplacl:hasRealm oplacl:SqlRealm .
};


-- ReadWrite ACL

-- Private Graph ACL Private Named Graph identified by IRI: <urn:acl:qa:test:paris>
-- Cleanup 

SPARQL
PREFIX  oplacl:  <http://www.openlinksw.com/ontology/acl#>
PREFIX     acl:  <http://www.w3.org/ns/auth/acl#>

WITH 
<http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
DELETE 
 {
   <#TLSSQLPrivateNamedGraphRule2> ?p ?o .
}
WHERE {
   <#TLSSQLPrivateNamedGraphRule2> ?p ?o .
};

-- ACL Description

SPARQL
PREFIX  oplacl:  <http://www.openlinksw.com/ontology/acl#>
PREFIX     acl:  <http://www.w3.org/ns/auth/acl#>

WITH 
<http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
INSERT
 {
    <#TLSSQLPrivateNamedGraphRule2> 
   a  acl:Authorization ;
   rdfs:label "Private Named Graph ACL (SQL Realm) for Named Graph Identified by IRI: <urn:acl:qa:test:paris>" ;
   foaf:maker <http://kingsley.idehen.net/dataspace/person/kidehen#this> ;
   oplacl:hasAccessMode  oplacl:Read ;
   acl:accessTo <urn:acl:qa:test:paris> ;
   acl:agent <http://kingsley.idehen.net/public_home/kidehen/profile.ttl#i>, 
   		  <https://id.myopenlink.net/DAV/home/KingsleyUyiIdehen/Public/kingsley.ttl#this>,
          <http://kingsley.idehen.net/dataspace/person/kidehen#this>,
		  <https://s3.amazonaws.com/webid-sandbox/Profile/Basic-Identity-Claims-And-Profile-Document.ttl#i>,
		  <https://www.dropbox.com/s/m5sdy9nn0qi15hk/profile.ttl?dl=1#identity>,
		  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i>,
		  <https://dbfff61d85d4da9b5aefce09723385e78a93f731.googledrive.com/host/0B-Mx14cLTEsaczdJdk96UVQ0aVE/profile.ttl#identity>,
		  <http://id.myopenlink.net/DAV/home/hwilliams/YouID/Hugh_Williams_id_myopenlink_net_1/profile.ttl#identity>,
		  <http://id.myopenlink.net/DAV/home/danielhm/profile.ttl#i>, <http://kingsley.idehen.net/DAV/home/kidehen/onno_profile.ttl#i>,
		  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i> ;
   oplacl:hasScope  oplacl:PrivateGraphs ;
   oplacl:hasRealm oplacl:SqlRealm .
};


-- ReadOnly ACL

-- Cleanup 


SPARQL
PREFIX  oplacl:  <http://www.openlinksw.com/ontology/acl#>
PREFIX     acl:  <http://www.w3.org/ns/auth/acl#>

WITH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
DELETE 
 { <#TLSSQLPrivateNamedGraphReadWriteTest> ?p ?o . }
WHERE 
 { <#TLSSQLPrivateNamedGraphReadWriteTest> ?p ?o . } ;


-- Read-Write ACL Description

SPARQL
PREFIX  oplacl:  <http://www.openlinksw.com/ontology/acl#>
PREFIX     acl:  <http://www.w3.org/ns/auth/acl#>

WITH 
<http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
INSERT
 {
    <#TLSSQLPrivateNamedGraphReadWriteTest> 
   a acl:Authorization ;
   rdfs:label "Private Named Graph ACL (SQL Realm) for Named Graph Identified by IRI: <urn:acl:qa:read:write:test> " ;
   foaf:maker <http://kingsley.idehen.net/dataspace/person/kidehen#this> ;
   oplacl:hasAccessMode  oplacl:Read, oplacl:Write ;
   acl:accessTo <urn:acl:qa:read:write:test> ;
   acl:agent <#SQLTLSstaticGroup>  ;
   # acl:agent <#SQLTLSgroupBasicNetID> ;
   oplacl:hasScope  oplacl:PrivateGraphs ;
   oplacl:hasRealm oplacl:SqlRealm .
};


--- SQL Query Access Restrictions (SQLRealm re. ODBC, JDBC, ADO.NET) --- 
-- Query Request Rate
-- Cleanup

SPARQL 

PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#> 
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>
PREFIX oplrest: <http://www.openlinksw.com/ontology/restrictions#>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
DELETE {
		    <#URIBurnerTLSSQLAccessRestriction1> ?p ?o . }
WHERE {
		    <#URIBurnerTLSSQLAccessRestriction1> ?p ?o . 
};

-- Restriction Definition

SPARQL 

PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#> 
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>
PREFIX oplrest: <http://www.openlinksw.com/ontology/restrictions#>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
INSERT {
		    <#URIBurnerTLSSQLAccessRestriction1> 
			a oplrest:Restriction ;
		    foaf:maker <http://kingsley.idehen.net/dataspace/person/kidehen#this> ;
			rdfs:label "SQL Realm Query Rate Restriction" ;
			rdfs:comment """Mandatory Restriction for metering Query Request Rates per second.""" ;
		    oplacl:hasAccessMode oplacl:Read ;
		    oplrest:hasRestrictedResource <urn:virtuoso:restrictions:sql-request-rate> ;
			oplrest:hasMaxValue "100"^^xsd:integer ;
		    acl:agent <http://kingsley.idehen.net/public_home/kidehen/profile.ttl#i>, 
   		  			  <https://id.myopenlink.net/DAV/home/KingsleyUyiIdehen/Public/kingsley.ttl#this>,
                      <http://kingsley.idehen.net/dataspace/person/kidehen#this>,
					  <https://s3.amazonaws.com/webid-sandbox/Profile/Basic-Identity-Claims-And-Profile-Document.ttl#i>,
					  <http://kingsley.idehen.net/public_home/kidehen/profile.ttl#i>, 
					  <https://www.dropbox.com/s/m5sdy9nn0qi15hk/profile.ttl?dl=1#identity>,
					  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i>,
					  <https://dbfff61d85d4da9b5aefce09723385e78a93f731.googledrive.com/host/0B-Mx14cLTEsaczdJdk96UVQ0aVE/profile.ttl#identity>,
					  <http://id.myopenlink.net/DAV/home/hwilliams/YouID/Hugh_Williams_id_myopenlink_net_1/profile.ttl#identity>,
					  <http://id.myopenlink.net/DAV/home/danielhm/profile.ttl#i>, <http://kingsley.idehen.net/DAV/home/kidehen/onno_profile.ttl#i>,
					  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i> ;
		    oplacl:hasRealm oplacl:SqlRealm .
};


-- Query Results Size 
-- Cleanup

SPARQL 

PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#> 
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>
PREFIX oplrest: <http://www.openlinksw.com/ontology/restrictions#>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
DELETE {
		    <#URIBurnerTLSSQLAccessRestriction2> ?p ?o . 
}
WHERE {
		    <#URIBurnerTLSSQLAccessRestriction2> ?p ?o . 
};


-- Restriction Definition
SPARQL 

PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#> 
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>
PREFIX oplrest: <http://www.openlinksw.com/ontology/restrictions#>

WITH GRAPH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23SqlRealm>
INSERT {
		    <#URIBurnerTLSSQLAccessRestriction2> 
			a oplrest:Restriction ;
		    foaf:maker <http://kingsley.idehen.net/dataspace/person/kidehen#this> ;
			rdfs:label "SQL Realm Resultset [Query Solution] Size Restriction" ;
			rdfs:comment """Mandatory Restriction for restrictng maximum size of query resultsets [solutions].""" ;
		    oplrest:hasRestrictedResource <urn:virtuoso:restrictions:sql-result-rows> ;
			oplrest:hasMaxValue "200"^^xsd:integer ;
		    acl:agent <http://kingsley.idehen.net/public_home/kidehen/profile.ttl#i>, 
   		  			  <https://id.myopenlink.net/DAV/home/KingsleyUyiIdehen/Public/kingsley.ttl#this>,
          			  <http://kingsley.idehen.net/dataspace/person/kidehen#this>,
					  <https://s3.amazonaws.com/webid-sandbox/Profile/Basic-Identity-Claims-And-Profile-Document.ttl#i>,
					  <http://kingsley.idehen.net/public_home/kidehen/profile.ttl#i>, 
					  <https://www.dropbox.com/s/m5sdy9nn0qi15hk/profile.ttl?dl=1#identity>,
					  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i>,
					  <https://dbfff61d85d4da9b5aefce09723385e78a93f731.googledrive.com/host/0B-Mx14cLTEsaczdJdk96UVQ0aVE/profile.ttl#identity>,
					  <http://id.myopenlink.net/DAV/home/hwilliams/YouID/Hugh_Williams_id_myopenlink_net_1/profile.ttl#identity>,
					  <http://id.myopenlink.net/DAV/home/danielhm/profile.ttl#i>, <http://kingsley.idehen.net/DAV/home/kidehen/onno_profile.ttl#i>,
					  <http://id.myopenlink.net/DAV/home/cblakeley/youid_profile_160420.ttl#i> ;
		    oplacl:hasRealm oplacl:SqlRealm .
};


-- Test Query 1
-- Should only show solution for members of Group granted accesss to protected graph

SPARQL

SELECT count (*) 
FROM <urn:acl:qa:test:paris> 
WHERE {?s ?p ?o}  ;

-- Test Query 2
-- Should only show solution for authenticated NetIDs

SPARQL

SELECT count (*) 
FROM <urn:acl:qa:test:berlin>
WHERE {?s ?p ?o} ;

-- Test Query 3
-- Should show aggregate reflective of specific WebID executing query
-- Authenticated NetIDs that are members of Group with access to 
-- Graph identified by: <urn:acl:qa:test:paris> , should see the most
-- Authenticated NetIDs that are not members of the aforementioned group see the next largest total
-- Others see nothing. 

SPARQL

SELECT count (*) 
FROM <urn:acl:qa:test:paris> 
FROM <urn:acl:qa:test:berlin>
WHERE {?s ?p ?o}  ;

-- Test Query 4 
-- Count should be 1 inline with acl 

SPARQL

SELECT COUNT (*)
FROM <urn:acl:qa:readonly:test>
WHERE {?s ?p ?o} ;

-- Test Query 5 
-- Count varies subject to acls

SPARQL

SELECT COUNT (*)
FROM <urn:acl:qa:read:write:test>
WHERE {?s ?p ?o} ;





