'Return the set of principals explicitly granted the
permission named ``permission`` according to the ACL directly
attached to the ``context`` as well as inherited ACLs based on
the :term:`lineage`.'

def principals_allowed_by_permission(self, context, permission):

    allowed = set()
    for location in reversed(list(lineage(context))):
        try:
            acl = location.__acl__
        except AttributeError:
            continue
        allowed_here = set()
        denied_here = set()
        if (acl and callable(acl)):
            acl = acl()
        for (ace_action, ace_principal, ace_permissions) in acl:
            if (not is_nonstr_iter(ace_permissions)):
                ace_permissions = [ace_permissions]
            if ((ace_action == Allow) and (permission in ace_permissions)):
                if (ace_principal not in denied_here):
                    allowed_here.add(ace_principal)
            if ((ace_action == Deny) and (permission in ace_permissions)):
                denied_here.add(ace_principal)
                if (ace_principal == Everyone):
                    allowed = set()
                    break
                elif (ace_principal in allowed):
                    allowed.remove(ace_principal)
        allowed.update(allowed_here)
    return allowed
