Checks if requester and approvers have approval privileges for labels.

    Checks against list of approvers for each label defined in approvers.yaml to
    determine if the list of approvers is sufficient.

    Args:
      token: user token
      client_urn: ClientURN object of the client
      requester: username string of person requesting approval.
      approvers: list of username strings that have approved this client.
      label: label strings to check approval privs for.
    Returns:
      True if access is allowed, raises otherwise.

def CheckApproversForLabel(self, token, client_urn, requester, approvers,
                             label):
    """Checks if requester and approvers have approval privileges for labels.

    Checks against list of approvers for each label defined in approvers.yaml to
    determine if the list of approvers is sufficient.

    Args:
      token: user token
      client_urn: ClientURN object of the client
      requester: username string of person requesting approval.
      approvers: list of username strings that have approved this client.
      label: label strings to check approval privs for.
    Returns:
      True if access is allowed, raises otherwise.
    """
    auth = self.reader.GetAuthorizationForSubject(label)
    if not auth:
      # This label isn't listed in approvers.yaml
      return True

    if auth.requester_must_be_authorized:
      if not self.CheckPermissions(requester, label):
        raise access_control.UnauthorizedAccess(
            "User %s not in %s or groups:%s for %s" % (requester, auth.users,
                                                       auth.groups, label),
            subject=client_urn,
            requested_access=token.requested_access)

    approved_count = 0
    for approver in approvers:
      if self.CheckPermissions(approver, label) and approver != requester:
        approved_count += 1

    if approved_count < auth.num_approvers_required:
      raise access_control.UnauthorizedAccess(
          "Found %s approvers for %s, needed %s" %
          (approved_count, label, auth.num_approvers_required),
          subject=client_urn,
          requested_access=token.requested_access)
    return True