from wagtail.core.models import Page, PageViewRestriction

def filter_pages(user):
    pages = Page.objects.live()

    # Unauthenticated users can only see public pages
    if not user.is_authenticated:
        pages = pages.public()
    # Superusers can implicitly view all pages. No further filtering required
    elif not user.is_superuser:
        # Get all page ids where the user's groups do NOT have access to
        disallowed_ids = PageViewRestriction.objects.exclude(groups__id=user.groups.all()).values_list("page", flat=True)
        # Exclude all pages with disallowed ids
        pages = pages.exclude(id__in=disallowed_ids)

    return pages