'Checks for access to given subject with a given token.
CheckAccess runs given subject through all "allow" clauses that
were previously registered with Allow() calls. It returns True on
first match and raises access_control.UnauthorizedAccess if there
are no matches or if any of the additional checks fails.
Args:
subject: RDFURN of the subject that will be checked for access.
token: User credentials token.
Returns:
True if access is granted.
Raises:
access_control.UnauthorizedAccess if access is rejected.'

def CheckAccess(self, subject, token):

    subject = rdfvalue.RDFURN(subject)
    subject_str = subject.SerializeToString()
    for check_tuple in self.checks:
        (regex_text, regex, require, require_args, require_kwargs) = check_tuple
        match = regex.match(subject_str)
        if (not match):
            continue
        if require:
            require(subject, token, *require_args, **require_kwargs)
        logging.debug(u'Datastore    access    granted    to    %s    on    %s    by    pattern:    %s    with    reason:    %s    (require=%s,    require_args=%s,    require_kwargs=%s,    helper_name=%s)', utils.SmartUnicode(token.username), utils.SmartUnicode(subject_str), utils.SmartUnicode(regex_text), utils.SmartUnicode(token.reason), require, require_args, require_kwargs, self.helper_name)
        return True
    logging.warn('Datastore    access    denied    to    %s    (no    matched    rules)', subject_str)
    raise access_control.UnauthorizedAccess(('Access    to    %s    rejected:    (no    matched    rules).' % subject), subject=subject)
