'Test permission check with policy 4'

def testPolicy4(self):

    auth = current.auth
    current.deployment_settings.security.policy = 4
    auth.permission = S3Permission(auth)
    has_permission = auth.s3_has_permission
    c = 'org'
    f = 'permission_test'
    tablename = 'org_permission_test'
    assertTrue = self.assertTrue
    assertFalse = self.assertFalse
    auth.s3_impersonate(None)
    permitted = has_permission('read', c=c, f=f, table=tablename)
    assertFalse(permitted)
    auth.s3_impersonate('normaluser@example.com')
    permitted = has_permission('read', c=c, f=f, table=tablename)
    assertFalse(permitted)
    auth.s3_assign_role(auth.user.id, self.reader)
    permitted = has_permission('read', c=c, f=f, table=tablename)
    assertTrue(permitted)
    permitted = has_permission('create', c=c, f=f, table=tablename)
    assertTrue(permitted)
    permitted = has_permission('update', c=c, f=f, table=tablename, record_id=self.record1)
    assertFalse(permitted)
    permitted = has_permission('delete', c=c, f=f, table=tablename, record_id=self.record1)
    assertFalse(permitted)
    auth.s3_withdraw_role(auth.user.id, self.reader)
    auth.s3_assign_role(auth.user.id, self.editor)
    permitted = has_permission('read', c=c, f=f, table=tablename)
    assertTrue(permitted)
    permitted = has_permission('create', c=c, f=f, table=tablename)
    assertTrue(permitted)
    permitted = has_permission('update', c=c, f=f, table=tablename, record_id=self.record1)
    assertTrue(permitted)
    permitted = has_permission('delete', c=c, f=f, table=tablename, record_id=self.record1)
    assertFalse(permitted)
    auth.s3_withdraw_role(auth.user.id, self.editor)
