def CheckApproversForLabel(self, token, client_urn, requester, approvers,
                             label):
    auth = self.reader.GetAuthorizationForSubject(label)
    if not auth:
      # This label isn't listed in approvers.yaml
      return True

    if auth.requester_must_be_authorized:
      if not self.CheckPermissions(requester, label):
        raise access_control.UnauthorizedAccess(
            "User %s not in %s or groups:%s for %s" % (requester, auth.users,
                                                       auth.groups, label),
            subject=client_urn, requested_access=token.requested_access)

    approved_count = 0
    for approver in approvers:
      if self.CheckPermissions(approver, label) and approver != requester:
        approved_count += 1

    if approved_count < auth.num_approvers_required:
      raise access_control.UnauthorizedAccess(
          "Found %s approvers for %s, needed %s" % (
              approved_count, label, auth.num_approvers_required),
          subject=client_urn, requested_access=token.requested_access)
    return True
Checks if requester and approvers have approval privileges for labels.
dataset/ETHPy150Open google/grr/grr/lib/authorization/client_approval_auth.py/ClientApprovalAuthorizationManager.CheckApproversForLabel