#NEWLINE# def CheckApproversForLabel( self , token , client_urn , requester , approvers , label ) : #NEWLINE# #INDENT# 'Checks if requester and approvers have approval privileges for labels.\n\n    Checks against list of approvers for each label defined in approvers.yaml to\n    determine if the list of approvers is sufficient.\n\n    Args:\n      token: user token\n      client_urn: ClientURN object of the client\n      requester: username string of person requesting approval.\n      approvers: list of username strings that have approved this client.\n      label: label strings to check approval privs for.\n    Returns:\n      True if access is allowed, raises otherwise.\n    ' #NEWLINE# auth = self . reader . GetAuthorizationForSubject ( label ) #NEWLINE# if ( not auth ) : #NEWLINE# #INDENT# return True #NEWLINE# #UNINDENT# if auth . requester_must_be_authorized : #NEWLINE# #INDENT# if ( not self . CheckPermissions ( requester , label ) ) : #NEWLINE# #INDENT# raise access_control . UnauthorizedAccess ( ( 'User %s not in %s or groups:%s for %s' % ( requester , auth . users , auth . groups , token ) ) , subject = client_urn , requested_access = token . requested_access ) #NEWLINE# #UNINDENT# #UNINDENT# approved_count = 0 #NEWLINE# for approver in approvers : #NEWLINE# #INDENT# if ( self . CheckPermissions ( approver , label ) and ( approver != requester ) ) : #NEWLINE# #INDENT# approved_count += 1 #NEWLINE# #UNINDENT# #UNINDENT# if ( approved_count < auth . num_approvers_required ) : #NEWLINE# #INDENT# raise access_control . UnauthorizedAccess ( ( 'Found %s approvers for %s, needed %s' % ( approved_count , label , auth . num_approvers_required ) ) , subject = client_urn , requested_access = token . requested_access ) #NEWLINE# #UNINDENT# return True