docs: def _CreateQueryAccessHelper(self):
      """Creates a CheckAccessHelper for controlling query access.
  
      This function and _CreateReadAccessHelper essentially define GRR's ACL
      policy. Please refer to these 2 functions to either review or modify
      GRR's ACLs.
  
      Query access gives you the ability to find objects in the tree without
      knowing their URN, using ListChildren.  If you grant query access,
      you will also need read access.
  
      Returns:
        CheckAccessHelper for controlling query access.
      """
      h = CheckAccessHelper("query")
  
      # User is allowed to do anything in their home dir.
      h.Allow("aff4:/users/*", self._IsHomeDir)
  
      # Querying is allowed for aff4:/cron/*, as GUI renders list of current
      # cron jobs. Also, links to flows executed by every cron job are stored
      # below cron job object,
      h.Allow("aff4:/cron")
      h.Allow("aff4:/cron/*")
  
      # Hunts and data collected by hunts are publicly available and thus can
      # be queried.
      h.Allow("aff4:/hunts")
      h.Allow("aff4:/hunts/*")
  
      # ACLs have to be queried to search for proper approvals. As a consequence,
      # any user can query for all approval objects and get a list of all
      # possible reasons. At the moment we assume that it's ok.
      h.Allow("aff4:/ACL")
      h.Allow("aff4:/ACL/*")
  
      # Querying contents of the client is allowed, as we have to browse VFS
      # filesystem.
      h.Allow(self.CLIENT_URN_PATTERN)
      h.Allow(self.CLIENT_URN_PATTERN + "/*")
  
      # Namespace for indexes. Client index is stored there and users need to
      # query the index for searching clients.
      h.Allow("aff4:/index")
      h.Allow("aff4:/index/*")
  
      # Configuration namespace used for reading drivers, python hacks etc. The
      # GUI needs to be able to list these paths.
      h.Allow("aff4:/config")
      h.Allow("aff4:/config/*")
  
      # We do not allow querying for all flows with empty client id, but we do
      # allow querying for particular flow's children. This is needed, in
      # particular, for cron jobs, whose flows end up in aff4:/flows and we
      # have to query them for children flows.
      # NOTE: Allow(aff4:/flows/*) does not allow querying of aff4:/flows
      #       children. But, on the other hand, it will allow querying for
      #       anything under aff4:/flows/W:SOMEFLOW, for example.
      h.Allow("aff4:/flows/*")
  
      # Querying the index of filestore objects is allowed since it reveals the
      # clients which have this file.
      h.Allow("aff4:/files/hash/generic/sha256/" + "[a-z0-9]" * 64)
  
      # Allow everyone to query the artifact store.
      h.Allow("aff4:/artifact_store")
      h.Allow("aff4:/artifact_store/*")
  
      # Users are allowed to query the artifact store.
      h.Allow("aff4:/artifact_store")
      h.Allow("aff4:/artifact_store/*")
  
      # Namespace for audit data. Required to display usage statistics.
      h.Allow("aff4:/audit/logs")
      h.Allow("aff4:/audit/logs/*")
  
      return h