'Returns a query to select the accessible records for method
in table.
@param method: the method as string or a list of methods (AND)
@param table: the database table or table name
@param c: controller name (falls back to current request)
@param f: function name (falls back to current request)'

def accessible_query(self, method, table, c=None, f=None, deny=True):

    if (not hasattr(table, '_tablename')):
        tablename = table
        error = AttributeError(('undefined    table    %s' % tablename))
        table = current.s3db.table(tablename, db_only=True, default=error)
    if (not isinstance(method, (list, tuple))):
        method = [method]
    ALL_RECORDS = (table._id > 0)
    NO_RECORDS = ((table._id == 0) if deny else None)
    if (self.requires_approval(table) and ('approved_by' in table.fields)):
        requires_approval = True
        APPROVED = (table.approved_by != None)
        UNAPPROVED = (table.approved_by == None)
    else:
        requires_approval = False
        APPROVED = ALL_RECORDS
        UNAPPROVED = NO_RECORDS
    approval_methods = ('review', 'approve', 'reject')
    unapproved = any([(m in method) for m in approval_methods])
    approved = (not all([(m in approval_methods) for m in method]))
    ALL_RECORDS = (ALL_RECORDS if (approved and unapproved) else (UNAPPROVED if unapproved else APPROVED))
    auth = self.auth
    if auth.override:
        return ALL_RECORDS
    sr = auth.get_system_roles()
    logged_in = auth.s3_logged_in()
    self.check_settings()
    user = auth.user
    if (not logged_in):
        realms = Storage({sr.ANONYMOUS: None})
        delegations = Storage()
    else:
        realms = user.realms
        delegations = user.delegations
    if (requires_approval and (not unapproved) and ('owned_by_user' in table.fields)):
        ALL_RECORDS = (table.approved_by != None)
        if user:
            owner_query = (table.owned_by_user == user.id)
        else:
            owner_query = self.owner_query(table, None)
        if (owner_query is not None):
            ALL_RECORDS |= owner_query
    if (sr.ADMIN in realms):
        return ALL_RECORDS
    if (len(method) > 1):
        query = None
        for m in method:
            q = self.accessible_query(m, table, c=c, f=f, deny=False)
            if (q is not None):
                if (query is None):
                    query = q
                else:
                    query |= q
        if (query is None):
            query = NO_RECORDS
        return query
    key = ('%s/%s/%s/%s/%s' % (method, table, c, f, deny))
    query_cache = self.query_cache
    if (key in query_cache):
        query = query_cache[key]
        return query
    racl = self.required_acl(method)
    if (not self.use_cacls):
        if logged_in:
            return ALL_RECORDS
        else:
            permitted = (racl == self.READ)
            if permitted:
                return ALL_RECORDS
            else:
                return NO_RECORDS
    c = (c or self.controller)
    f = (f or self.function)
    acls = self.applicable_acls(racl, realms=realms, delegations=delegations, c=c, f=f, t=table)
    if (acls is None):
        query = query_cache[key] = ALL_RECORDS
        return query
    elif (not acls):
        query = query_cache[key] = NO_RECORDS
        return query
    oacls = []
    uacls = []
    for entity in acls:
        acl = acls[entity]
        if ((acl[0] & racl) == racl):
            uacls.append(entity)
        elif (((acl[1] & racl) == racl) and (entity not in uacls)):
            oacls.append(entity)
    query = None
    no_realm = []
    check_owner_acls = True
    if ('ANY' in uacls):
        query = ALL_RECORDS
        check_owner_acls = False
    elif uacls:
        query = self.realm_query(table, uacls)
        if (query is None):
            query = ALL_RECORDS
            check_owner_acls = False
        else:
            no_realm = uacls
    if check_owner_acls:
        use_realm = ('ANY' not in oacls)
        owner_query = self.owner_query(table, user, use_realm=use_realm, realm=oacls, no_realm=no_realm)
        if (owner_query is not None):
            if (query is not None):
                query |= owner_query
            else:
                query = owner_query
        elif use_realm:
            query = self.realm_query(table, (uacls + oacls))
        if ((query is not None) and requires_approval):
            base_filter = (None if (approved and unapproved) else (UNAPPROVED if unapproved else APPROVED))
            if (base_filter is not None):
                query = (base_filter & query)
    if (query is None):
        query = NO_RECORDS
    query_cache[key] = query
    return query
