docs: def ApprovalCreateRaw(aff4_path,
                        reason="",
                        expire_in=60 * 60 * 24 * 7,
                        token=None,
                        approval_type="ClientApproval"):
    """Creates an approval with raw access.
  
    This method requires raw datastore access to manipulate approvals directly.
    This currently doesn't work for hunt or cron approvals, because they check
    that each approver has the admin label.  Since the fake users don't exist the
    check fails.
  
    Args:
      aff4_path: The aff4_path or client id the approval should be created for.
      reason: The reason to put in the token.
      expire_in: Expiry in seconds to use in the token.
      token: The token that will be used. If this is specified reason and expiry
        are ignored.
      approval_type: The type of the approval to create.
  
    Returns:
      The token.
  
    Raises:
      RuntimeError: On bad token.
    """
    if approval_type in ["ClientApproval", security.ClientApproval]:
      urn = rdf_client.ClientURN(aff4_path)
    else:
      urn = rdfvalue.RDFURN(aff4_path)
  
    if not token:
      expiry = time.time() + expire_in
      token = access_control.ACLToken(reason=reason, expiry=expiry)
  
    if not token.reason:
      raise RuntimeError("Cannot create approval with empty reason")
    if not token.username:
      token.username = getpass.getuser()
    approval_urn = security.ApprovalRequestor.ApprovalUrnBuilder(
        urn.Path(), token.username, token.reason)
    super_token = access_control.ACLToken(username="raw-approval-superuser")
    super_token.supervisor = True
  
    if isinstance(approval_type, string_types):
      approval_type_cls = aff4.AFF4Object.classes[approval_type]
    else:
      approval_type_cls = approval_type
  
    approval_request = aff4.FACTORY.Create(
        approval_urn, approval_type_cls, mode="rw", token=super_token)
  
    # Add approvals indicating they were approved by fake "raw" mode users.
    approval_request.AddAttribute(
        approval_request.Schema.APPROVER("%s1-raw" % token.username))
    approval_request.AddAttribute(
        approval_request.Schema.APPROVER("%s-raw2" % token.username))
    approval_request.Close()