def ensure_all_targets_allowed(rolename, list_of_targets, parent_delegations):
<EOL>securesystemslib.formats.ROLENAME_SCHEMA.check_match(rolename)<EOL>securesystemslib.formats.RELPATHS_SCHEMA.check_match(list_of_targets)<EOL>securesystemslib.formats.DELEGATIONS_SCHEMA.check_match(parent_delegations)<EOL>if rolename == '<STR_LIT>':<EOL><INDENT>return<EOL><DEDENT>roles = parent_delegations['<STR_LIT>']<EOL>role_index = find_delegated_role(roles, rolename)<EOL>if role_index is not None:<EOL><INDENT>role = roles[role_index]<EOL>allowed_child_paths = role.get('<STR_LIT>')<EOL>allowed_child_path_hash_prefixes = role.get('<STR_LIT>')<EOL>actual_child_targets = list_of_targets<EOL>if allowed_child_path_hash_prefixes is not None:<EOL><INDENT>consistent = paths_are_consistent_with_hash_prefixes<EOL>if not consistent(actual_child_targets,<EOL>allowed_child_path_hash_prefixes):<EOL><INDENT>message =  repr(rolename) + '<STR_LIT>' +'<STR_LIT>'<EOL>raise securesystemslib.exceptions.ForbiddenTargetError(message)<EOL><DEDENT><DEDENT>elif allowed_child_paths is not None:<EOL><INDENT>for child_target in actual_child_targets:<EOL><INDENT>for allowed_child_path in allowed_child_paths:<EOL><INDENT>if fnmatch.fnmatch(child_target, allowed_child_path):<EOL><INDENT>break<EOL><DEDENT><DEDENT>else:<EOL><INDENT>raise securesystemslib.exceptions.ForbiddenTargetError(<EOL>'<STR_LIT>' + repr(rolename) + '<STR_LIT>'<EOL>'<STR_LIT>' + repr(child_target) + '<STR_LIT:U+002C>' + '<STR_LIT>'<EOL>'<STR_LIT>')<EOL><DEDENT><DEDENT><DEDENT>else:<EOL><INDENT>raise securesystemslib.exceptions.FormatError(repr(role) + '<STR_LIT>'<EOL>'<STR_LIT>'<EOL>'<STR_LIT>')<EOL><DEDENT><DEDENT>else:<EOL><INDENT>raise securesystemslib.exceptions.RepositoryError('<STR_LIT>'<EOL>'<STR_LIT>' + repr(rolename) + '<STR_LIT:.>')<EOL><DEDENT>
<Purpose>
  Ensure that the list of targets specified by 'rolename' are allowed; this
  is determined by inspecting the 'delegations' field of the parent role of
  'rolename'.  If a target specified by 'rolename' is not found in the
  delegations field of 'metadata_object_of_parent', raise an exception.  The
  top-level role 'targets' is allowed to list any target file, so this
  function does not raise an exception if 'rolename' is 'targets'.

  Targets allowed are either exlicitly listed under the 'paths' field, or
  implicitly exist under a subdirectory of a parent directory listed under
  'paths'.  A parent role may delegate trust to all files under a particular
  directory, including files in subdirectories, by simply listing the
  directory (e.g., '/packages/source/Django/', the equivalent of
  '/packages/source/Django/*').  Targets listed in hashed bins are also
  validated (i.e., its calculated path hash prefix must be delegated by the
  parent role).

  TODO: Should the TUF spec restrict the repository to one particular
  algorithm when calcutating path hash prefixes (currently restricted to
  SHA256)?  Should we allow the repository to specify in the role dictionary
  the algorithm used for these generated hashed paths?

<Arguments>
  rolename:
    The name of the role whose targets must be verified. This is a
    role name and should not end in '.json'.  Examples: 'root', 'targets',
    'targets/linux/x86'.

  list_of_targets:
    The targets of 'rolename', as listed in targets field of the 'rolename'
    metadata.  'list_of_targets' are target paths relative to the targets
    directory of the repository.  The delegations of the parent role are
    checked to verify that the targets of 'list_of_targets' are valid.

  parent_delegations:
    The parent delegations of 'rolename'.  The metadata object stores
    the allowed paths and path hash prefixes of child delegations in its
    'delegations' attribute.

<Exceptions>
  securesystemslib.exceptions.FormatError:
    If any of the arguments are improperly formatted.

  securesystemslib.exceptions.ForbiddenTargetError:
    If the targets of 'metadata_role' are not allowed according to
    the parent's metadata file.  The 'paths' and 'path_hash_prefixes'
    attributes are verified.

  securesystemslib.exceptions.RepositoryError:
    If the parent of 'rolename' has not made a delegation to 'rolename'.

<Side Effects>
  None.

<Returns>
  None.