                         err:"unknown option '#{name}'"
         return {db_query:db_query, err:err, limit:limit}
 
+    _primary_key_query: (primary_key, query) =>
+        if query[primary_key]? and query[primary_key] != null
+            # primary key query
+            x = query[primary_key]
+            if misc.is_array(x)
+                get_all = x
+            else
+                if typeof(x) != 'object'
+                    x = {'==':x}
+                for k, v of x
+                    if k == '=='
+                        get_all = [v]
+                        break
+                    else
+                        return {err:"invalid primary key query: '#{k}'"}
+        return {get_all:get_all}
+
+
     user_get_query: (opts) =>
         opts = defaults opts,
             account_id : required

                        sub = false
                        break
                if sub
                    selector[k] = @_query_to_field_selector(v)
        return selector

    _query_get: (table, query, account_id) =>
        x = {}
        switch table
            when 'server_settings', 'central_log', 'client_error_log'
                x.require_admin = true
            when 'accounts'
                x.get_all = [account_id]
            when 'stats'
                if query.timestamp != null
                    # TODO
                    x.error = "TODO -- timestamp range query"
            when 'blobs'
                if query.uuid
                    x.get_all = [query.uuid]
                else
                    x.error = "must specify uuid"
            when 'file_use', 'projects', 'file_access_log'
                if query.project_id? and query.project_id != null
                    single = false
                    if typeof(query.project_id) == 'object'
                        for k, v of query.project_id
                            if k == '=='
                                query.project_id = v
                                single = true
                                break
                    if single
                        x.get_all = x.require_project_ids_read_access = [query.project_id]
                    else
                        x.get_all = 'all_projects'
                else
                    x.get_all = 'all_projects'
            else
                x.error = "unknown table '#{table}'"
        return x

    _require_is_admin: (account_id, cb) =>

            last_name : true
            terminal  : true
            autosave  : true
        user_set_all : 'account_id'
        user_get:
            account_id : true
            email_address : true
            editor_settings : true
            other_settings : true
            first_name : true
            last_name : true
            terminal  : true
            autosave  : true
        user_get_all : 'account_id'
        passports     : ["that.r.row('passports').keys()", {multi:true}]
        created_by    : ["[that.r.row('created_by'), that.r.row('created')]"]
        email_address : []

    account_creation_actions :
        email_address : ["[that.r.row('email_address'), that.r.row('expire')]"]
        expire : []  # only used by delete_expired
    blobs :
        expire : []
        user_get :
            uuid : true
            blob : true
    central_log :
        time : []
        event : []
