'Test accessible query with policy 8'

def testPolicy8(self):

    s3db = current.s3db
    auth = current.auth
    current.deployment_settings.security.policy = 8
    auth.permission = S3Permission(auth)
    accessible_query = auth.s3_accessible_query
    c = 'org'
    f = 'permission_test'
    table = current.s3db.org_permission_test
    assertEqual = self.assertEqual
    ALL = (table.id > 0)
    NONE = (table.id == 0)
    auth.s3_impersonate(None)
    query = accessible_query('read', table, c=c, f=f)
    assertEqual(query, NONE)
    auth.s3_impersonate('normaluser@example.com')
    query = accessible_query('read', table, c=c, f=f)
    assertEqual(query, NONE)
    record = None
    user = auth.s3_user_pe_id(auth.s3_get_user_id('normaluser@example.com'))
    s3db.pr_add_affiliation(self.org[2], user, role='TestStaff')
    auth.s3_assign_role(auth.user.id, self.editor, for_pe=self.org[2])
    expected = (((table.realm_entity == self.org[2]) | (table.realm_entity == None)) | ((((table.owned_by_user == None) & (table.owned_by_group == None)) & (table.realm_entity == None)) | table.owned_by_group.belongs([2, 3])))
    query = accessible_query('read', table, c=c, f=f)
    assertEqual(query, expected)
    query = accessible_query('update', table, c=c, f=f)
    assertEqual(query, expected)
    s3db.pr_add_affiliation(self.org[1], self.org[2], role='TestOrgUnit')
    auth.s3_delegate_role(self.reader, self.org[0], receiver=self.org[1])
    auth.s3_impersonate('normaluser@example.com')
    query = accessible_query('read', table, c=c, f=f)
    expected = ((table.realm_entity.belongs([self.org[0], self.org[2]]) | (table.realm_entity == None)) | ((((table.owned_by_user == None) & (table.owned_by_group == None)) & (table.realm_entity == None)) | table.owned_by_group.belongs([2, 3])))
    assertEqual(query, expected)
    query = accessible_query('update', table, c=c, f=f)
    expected = (((table.realm_entity == self.org[2]) | (table.realm_entity == None)) | ((((table.owned_by_user == auth.user.id) & ((table.realm_entity == self.org[0]) | (table.realm_entity == None))) | (((table.owned_by_user == None) & (table.owned_by_group == None)) & (table.realm_entity == None))) | table.owned_by_group.belongs([2, 3])))
    assertEqual(query, expected)
    s3db.pr_remove_affiliation(self.org[1], self.org[2], role='TestOrgUnit')
    auth.s3_impersonate('normaluser@example.com')
    query = accessible_query('read', table, c=c, f=f)
    expected = (((table.realm_entity == self.org[2]) | (table.realm_entity == None)) | ((((table.owned_by_user == None) & (table.owned_by_group == None)) & (table.realm_entity == None)) | table.owned_by_group.belongs([2, 3])))
    assertEqual(query, expected)
    query = accessible_query('update', table, c=c, f=f)
    assertEqual(query, expected)
    s3db.pr_remove_affiliation(self.org[2], user, role='TestStaff')
    s3db.pr_remove_affiliation(self.org[1], self.org[2], role='TestOrgUnit')
    auth.s3_withdraw_role(user, self.reader, for_pe=self.org[2])
