docs: def query_entity_with_permission(self, permission, user=None, Model=Entity):
          """Filter a query on an :class:`Entity` or on of its subclasses.
  
          Usage::
  
              read_q = security.query_entity_with_permission(READ, Model=MyModel)
              MyModel.query.filter(read_q)
  
          It should always be placed before any `.join()` happens in the query; else
          sqlalchemy might join to the "wrong" entity table when joining to other
          :class:`Entity`.
  
          :param user: user to filter for. Default: `current_user`.
  
          :param permission: required :class:`Permission`
  
          :param Model: An :class:`Entity` based class. Useful when there is more than
          one Entity based object in query, or if an alias should be used.
  
          :returns: a `sqlalchemy.sql.exists()` expression.
          """
          assert isinstance(permission, Permission)
          assert issubclass(Model, Entity)
          RA = sa.orm.aliased(RoleAssignment)
          PA = sa.orm.aliased(PermissionAssignment)
          # id column from entity table. Model.id would refer to 'model' table.
          # this allows the DB to use indexes / foreign key constraints.
          id_column = sa.inspect(Model).primary_key[0]
          creator = Model.creator
          owner = Model.owner
  
          if not self.running:
              return sa.sql.exists([1])
  
          if user is None:
              user = unwrap(current_user)
  
          # build role CTE
          principal_filter = RA.anonymous == True
  
          if not user.is_anonymous:
              principal_filter |= RA.user == user
  
          if user.groups:
              principal_filter |= RA.group_id.in_([g.id for g in user.groups])
  
          RA = sa.sql.select([RA], principal_filter).cte()
          permission_exists = sa.sql.exists([1]).where(
              sa.sql.and_(
                  PA.permission == permission,
                  PA.object_id == id_column,
                  (RA.c.role == PA.role) | (PA.role == AnonymousRole),
                  (RA.c.object_id == PA.object_id) | (RA.c.object_id == None),
              )
          )
  
          # is_admin: self-explanatory. It search for local or global admin
          # role, but PermissionAssignment is not involved, thus it can match on
          # entities that don't have *any permission assignment*, whereas previous
          # expressions cannot.
          is_admin = sa.sql.exists([1]).where(
              sa.sql.and_(
                  RA.c.role == Admin,
                  (RA.c.object_id == id_column) | (RA.c.object_id == None),
                  principal_filter,
              )
          )
  
          filter_expr = permission_exists | is_admin
  
          if user and not user.is_anonymous:
              is_owner_or_creator = sa.sql.exists([1]).where(
                  sa.sql.and_(
                      PA.permission == permission,
                      PA.object_id == id_column,
                      sa.sql.or_(
                          (PA.role == Owner) & (owner == user),
                          (PA.role == Creator) & (creator == user),
                      ),
                  )
              )
              filter_expr |= is_owner_or_creator
  
          return filter_expr