'Creates a CheckAccessHelper for controlling query access.
This function and _CreateReadAccessHelper essentially define GRR\'s ACL
policy. Please refer to these 2 functions to either review or modify
GRR\'s ACLs.
Query access gives you the ability to find objects in the tree without
knowing their URN, using ListChildren.  If you grant query access,
you will also need read access.
Returns:
CheckAccessHelper for controlling query access.'

def _CreateQueryAccessHelper(self):

    h = CheckAccessHelper('query')
    h.Allow('aff4:/users/*', self._IsHomeDir)
    h.Allow('aff4:/cron')
    h.Allow('aff4:/cron/*')
    h.Allow('aff4:/hunts')
    h.Allow('aff4:/hunts/*')
    h.Allow('aff4:/ACL')
    h.Allow('aff4:/ACL/*')
    h.Allow(self.CLIENT_URN_PATTERN)
    h.Allow((self.CLIENT_URN_PATTERN + '/*'))
    h.Allow('aff4:/index')
    h.Allow('aff4:/index/*')
    h.Allow('aff4:/config')
    h.Allow('aff4:/config/*')
    h.Allow('aff4:/flows/*')
    h.Allow(('aff4:/files/hash/generic/sha256/' + ('[a-z0-9]' * 64)))
    h.Allow('aff4:/artifact_store')
    h.Allow('aff4:/artifact_store/*')
    h.Allow('aff4:/stats_store')
    h.Allow('aff4:/stats_store/*')
    h.Allow('aff4:/artifact_store')
    h.Allow('aff4:/artifact_store/*')
    h.Allow('aff4:/audit/logs')
    h.Allow('aff4:/audit/logs/*')
    return h
