def CheckAccess(self, token):
    """Enforce a dual approver policy for access."""
    namespace, _ = self.urn.Split(2)

    if namespace != "ACL":
      raise access_control.UnauthorizedAccess(
          "Approval object has invalid urn %s." % self.urn,
          subject=self.urn, requested_access=token.requested_access)

    user, subject_urn = self.InferUserAndSubjectFromUrn()
    if user != token.username:
      raise access_control.UnauthorizedAccess(
          "Approval object is not for user %s." % token.username,
          subject=self.urn, requested_access=token.requested_access)

    now = rdfvalue.RDFDatetime().Now()

    # Is this an emergency access?
    break_glass = self.Get(self.Schema.BREAK_GLASS)
    if break_glass and now < break_glass:
      # This tags the token as an emergency token.
      token.is_emergency = True
      return True

    # Check that there are enough approvers.
    approvers = self.GetNonExpiredApprovers()
    if len(approvers) < config_lib.CONFIG["ACL.approvers_required"]:
      msg = ("Requires %s approvers for access." %
             config_lib.CONFIG["ACL.approvers_required"])
      raise access_control.UnauthorizedAccess(
          msg, subject=subject_urn, requested_access=token.requested_access)

    # Check User labels
    if self.checked_approvers_label:
      approvers_with_label = []

      # We need to check labels with high privilege since normal users can
      # inspect other user's labels.
      for approver in approvers:
        try:
          user = aff4.FACTORY.Open("aff4:/users/%s" % approver,
                                   aff4_type="GRRUser",
                                   token=token.SetUID())
          if self.checked_approvers_label in user.GetLabelsNames():
            approvers_with_label.append(approver)
        except __HOLE__:
          pass

      if len(approvers_with_label) < self.min_approvers_with_label:
        raise access_control.UnauthorizedAccess(
            "At least %d approver(s) should have '%s' label." % (
                self.min_approvers_with_label,
                self.checked_approvers_label),
            subject=subject_urn,
            requested_access=token.requested_access)

    return True
dataset/ETHPy150Open google/grr/grr/lib/aff4_objects/security.py/ApprovalWithApproversAndReason.CheckAccess