use a custom SQL query to expose the role_mask attribute of the join table