@flow.StateHandler()
  def Start(self):
    """Create the Approval object and notify the Approval Granter."""
    approval_urn = self.BuildApprovalUrn()
    subject_title = self.BuildSubjectTitle()
    access_urn = self.BuildAccessUrl()

    # This object must already exist.
    try:
      approval_request = aff4.FACTORY.Open(approval_urn, mode="rw",
                                           aff4_type=self.approval_type,
                                           token=self.token)
    except __HOLE__:
      raise access_control.UnauthorizedAccess("Approval object does not exist.",
                                              requested_access="rw")

    # We are now an approver for this request.
    approval_request.AddAttribute(
        approval_request.Schema.APPROVER(self.token.username))
    email_msg_id = utils.SmartStr(approval_request.Get(
        approval_request.Schema.EMAIL_MSG_ID))
    email_cc = utils.SmartStr(approval_request.Get(
        approval_request.Schema.EMAIL_CC))

    approval_request.Close(sync=True)

    # Notify to the user.
    fd = aff4.FACTORY.Create(
        aff4.ROOT_URN.Add("users").Add(self.args.delegate),
        "GRRUser", mode="rw", token=self.token)

    fd.Notify("ViewObject", self.args.subject_urn,
              "%s has granted you access to %s."
              % (self.token.username, subject_title), self.session_id)
    fd.Close()

    if not config_lib.CONFIG.Get("Email.send_approval_emails"):
      return

    reason = self.CreateReasonHTML(self.args.reason)

    template = u"""
<html><body><h1>Access to
<a href='%(admin_ui)s#%(subject_urn)s'>%(subject_title)s</a> granted.</h1>

The user %(username)s has granted access to
<a href='%(admin_ui)s#%(subject_urn)s'>%(subject_title)s</a> for the
purpose of "%(reason)s".

Please click <a href='%(admin_ui)s#%(subject_urn)s'>here</a> to access it.

<p>Thanks,</p>
<p>%(signature)s</p>
</body></html>"""

    body = template % dict(
        subject_title=subject_title,
        username=self.token.username,
        reason=reason,
        admin_ui=config_lib.CONFIG["AdminUI.url"],
        subject_urn=access_urn,
        signature=config_lib.CONFIG["Email.signature"]
    )

    # Email subject should match approval request, and we add message id
    # references so they are grouped together in a thread by gmail.
    subject = u"Approval for %s to access %s." % (
        utils.SmartStr(self.args.delegate), subject_title)
    headers = {"In-Reply-To": email_msg_id, "References": email_msg_id}
    email_alerts.EMAIL_ALERTER.SendEmail(
        utils.SmartStr(self.args.delegate),
        utils.SmartStr(self.token.username), subject,
        utils.SmartStr(body), is_html=True,
        cc_addresses=email_cc,
        headers=headers)
dataset/ETHPy150Open google/grr/grr/lib/aff4_objects/security.py/GrantApprovalWithReasonFlow.Start