'Looks for approvals for an object and returns available valid tokens.
Args:
object_urn: Urn of the object we want access to.
token: The token to use to lookup the ACLs.
username: The user to get the approval for, if "" we get it from the
token.
Returns:
A token for access to the object on success, otherwise raises.
Raises:
UnauthorizedAccess: If there are no valid approvals available.'

@staticmethod
def GetApprovalForObject(object_urn, token=None, username=''):

    if (token is None):
        raise access_control.UnauthorizedAccess('No    token    given,    cannot    authenticate.')
    if (not username):
        username = token.username
    approvals_root_urn = aff4.ROOT_URN.Add('ACL').Add(object_urn.Path()).Add(username)
    children_urns = list(aff4.FACTORY.ListChildren(approvals_root_urn, token=token))
    if (not children_urns):
        raise access_control.UnauthorizedAccess(('No    approval    found    for    user    %s' % utils.SmartStr(username)), subject=object_urn)
    last_error = None
    approvals = aff4.FACTORY.MultiOpen(children_urns, mode='r', aff4_type=Approval, age=aff4.ALL_TIMES, token=token)
    for approval in approvals:
        try:
            test_token = access_control.ACLToken(username=username, reason=approval.Get(approval.Schema.REASON))
            approval.CheckAccess(test_token)
            return test_token
        except access_control.UnauthorizedAccess as e:
            last_error = e
    if last_error:
        raise access_control.UnauthorizedAccess(last_error, subject=object_urn)
    else:
        raise access_control.UnauthorizedAccess(("Couldn't    open    any    of    %d    approvals    for    user    %s" % (len(children_urns), utils.SmartStr(username))), subject=object_urn)
