docs: def GetApprovalForObject(object_urn, token=None, username=""):
      """Looks for approvals for an object and returns available valid tokens.
  
      Args:
        object_urn: Urn of the object we want access to.
  
        token: The token to use to lookup the ACLs.
  
        username: The user to get the approval for, if "" we get it from the
          token.
  
      Returns:
        A token for access to the object on success, otherwise raises.
  
      Raises:
        UnauthorizedAccess: If there are no valid approvals available.
  
      """
      if token is None:
        raise access_control.UnauthorizedAccess(
            "No token given, cannot authenticate.")
  
      if not username:
        username = token.username
  
      approvals_root_urn = aff4.ROOT_URN.Add("ACL").Add(
          object_urn.Path()).Add(username)
  
      children_urns = list(aff4.FACTORY.ListChildren(approvals_root_urn))
      if not children_urns:
        raise access_control.UnauthorizedAccess(
            "No approval found for user %s" % utils.SmartStr(username),
            subject=object_urn)
  
      last_error = None
      approvals = aff4.FACTORY.MultiOpen(
          children_urns,
          mode="r",
          aff4_type=Approval,
          age=aff4.ALL_TIMES,
          token=token)
      for approval in approvals:
        try:
          test_token = access_control.ACLToken(
              username=username, reason=approval.Get(approval.Schema.REASON))
          approval.CheckAccess(test_token)
  
          return test_token
        except access_control.UnauthorizedAccess as e:
          last_error = e
  
      if last_error:
        # We tried all possible approvals, but got no usable results.
        raise access_control.UnauthorizedAccess(last_error, subject=object_urn)
      else:
        # If last error is None, means that none of the URNs in children_urns
        # could be opened. This shouldn't really happen ever, but we have
        # to make sure to provide a meaningful error message.
        raise access_control.UnauthorizedAccess(
            "Couldn't open any of %d approvals "
            "for user %s" % (len(children_urns), utils.SmartStr(username)),
            subject=object_urn)