'Test accessible query with policy 6'

def testPolicy6(self):

    auth = current.auth
    current.deployment_settings.security.policy = 6
    auth.permission = S3Permission(auth)
    accessible_query = auth.s3_accessible_query
    c = 'org'
    f = 'permission_test'
    table = current.s3db.org_permission_test
    assertEqual = self.assertEqual
    ALL = (table.id > 0)
    NONE = (table.id == 0)
    auth.s3_impersonate(None)
    query = accessible_query('read', table, c=c, f=f)
    assertEqual(query, NONE)
    auth.s3_impersonate('normaluser@example.com')
    query = accessible_query('read', table, c=c, f=f)
    assertEqual(query, NONE)
    auth.s3_assign_role(auth.user.id, self.reader, for_pe=self.org[0])
    expected = (((table.realm_entity == self.org[0]) | (table.realm_entity == None)) | ((((table.owned_by_user == None) & (table.owned_by_group == None)) & (table.realm_entity == None)) | table.owned_by_group.belongs([2, 3])))
    query = accessible_query('read', 'org_permission_test', c=c, f=f)
    assertEqual(query, expected)
    query = accessible_query('update', table, c=c, f=f)
    expected = ((((table.owned_by_user == auth.user.id) & ((table.realm_entity == self.org[0]) | (table.realm_entity == None))) | (((table.owned_by_user == None) & (table.owned_by_group == None)) & (table.realm_entity == None))) | (((table.owned_by_group == self.reader) & table.realm_entity.belongs([self.org[0]])) | table.owned_by_group.belongs([2, 3])))
    assertEqual(query, expected)
    query = accessible_query('delete', table, c=c, f=f)
    assertEqual(query, NONE)
    auth.s3_withdraw_role(auth.user.id, self.reader)
    auth.s3_assign_role(auth.user.id, self.editor, for_pe=self.org[0])
    query = accessible_query('read', table, c=c, f=f)
    expected = (((table.realm_entity == self.org[0]) | (table.realm_entity == None)) | ((((table.owned_by_user == None) & (table.owned_by_group == None)) & (table.realm_entity == None)) | table.owned_by_group.belongs([2, 3])))
    assertEqual(query, expected)
    query = accessible_query('update', table, c=c, f=f)
    assertEqual(query, expected)
    query = accessible_query('delete', table, c=c, f=f)
    assertEqual(query, NONE)
    auth.s3_withdraw_role(auth.user.id, self.editor)
    auth.s3_impersonate(None)
