'Returns an accessible query (and left joins, if necessary) for
records in table the user is permitted to access with method
@param method: the method (e.g. "read" or "update")
@param table: the table
@param instance_types: list of instance tablenames, if table is
a super-entity (required in this case!)
@return: tuple (query, left) where query is the query and left joins
is the list of left joins required for the query
@note: for higher security policies and super-entities with many
instance types this can give a very complex query. Try to
always limit the instance types to what is really needed'

@classmethod
def accessible_query(cls, method, table, instance_types=None):

    DEFAULT = (table._id > 0)
    left = None
    if ('instance_type' in table):
        if (not instance_types):
            return (DEFAULT, left)
        query = None
        auth = current.auth
        s3db = current.s3db
        for instance_type in instance_types:
            itable = s3db.table(instance_type)
            if (itable is None):
                continue
            join = itable.on((itable[table._id.name] == table._id))
            if (left is None):
                left = [join]
            else:
                left.append(join)
            q = ((itable._id != None) & auth.s3_accessible_query(method, itable))
            if ('deleted' in itable):
                q &= (itable.deleted != True)
            if (query is None):
                query = q
            else:
                query |= q
        if (query is None):
            query = DEFAULT
    else:
        query = current.auth.s3_accessible_query(method, table)
    return (query, left)
