'Multi-label client approval test.
This client requires one legal and two prod admin approvals. The requester
must also be in the prod admin group.'

def testClientApprovalMultiLabel(self):

    self.token.username = 'prod1'
    webauth.WEBAUTH_MANAGER.SetUserName(self.token.username)
    self.assertRaises(grr_api_errors.AccessForbiddenError, self.api.Client(self.client_prod_id).File('fs/os/foo').Get)
    self.RequestAndGrantClientApproval(self.client_prod, self.token)
    self.assertRaises(grr_api_errors.AccessForbiddenError, self.api.Client(self.client_prod_id).File('fs/os/foo').Get)
    self.GrantClientApproval(self.client_prod, self.token.username, reason=self.token.reason, approver='legal1')
    self.assertRaises(grr_api_errors.AccessForbiddenError, self.api.Client(self.client_prod_id).File('fs/os/foo').Get)
    self.GrantClientApproval(self.client_prod, self.token.username, reason=self.token.reason, approver='prod2')
    self.assertRaises(grr_api_errors.AccessForbiddenError, self.api.Client(self.client_prod_id).File('fs/os/foo').Get)
    self.GrantClientApproval(self.client_prod, self.token.username, reason=self.token.reason, approver='prod3')
    self.api.Client(self.client_prod_id).File('fs/os/foo').Get()
