'This method must always be sent an instance of LibraryFolder().  Recursive execution produces a
comma-separated string of folder ids whose folders do NOT meet the criteria for showing.  Along
with the string, True is returned if the current user has permission to access folder. Otherwise,
cycle through all sub-folders in folder until one is found that meets this criteria, if it exists.
This method does not necessarily scan the entire library as it returns when it finds the first
folder that is accessible to user.'

def check_folder_contents(self, user, roles, folder, hidden_folder_ids=''):

    if self.can_add_library_item(roles, folder):
        return (True, '')
    action = self.permitted_actions.DATASET_ACCESS
    lddas = self.sa_session.query(self.model.LibraryDatasetDatasetAssociation).join('library_dataset').filter((self.model.LibraryDataset.folder == folder)).join('dataset').options(eagerload_all('dataset.actions')).all()
    for ldda in lddas:
        ldda_access_permissions = self.get_item_actions(action, ldda.dataset)
        if (not ldda_access_permissions):
            return (True, hidden_folder_ids)
        for ldda_access_permission in ldda_access_permissions:
            if (ldda_access_permission.role in roles):
                return (True, hidden_folder_ids)
    for sub_folder in folder.active_folders:
        (can_access, hidden_folder_ids) = self.check_folder_contents(user, roles, sub_folder, hidden_folder_ids=hidden_folder_ids)
        if can_access:
            return (True, hidden_folder_ids)
        if hidden_folder_ids:
            hidden_folder_ids = ('%s,%d' % (hidden_folder_ids, sub_folder.id))
        else:
            hidden_folder_ids = ('%d' % sub_folder.id)
    return (False, hidden_folder_ids)
