[PATCH pve-access-control v6 4/8] permission: add helper to check for active permissions

[David Riley <d.riley@proxmox.com>]

Add recursive helper to determine if a specific node or any of its
descendants in the ACL tree contain configured permissions.

This is in preparation for subsequent SDN VNet ACL migration changes.

Signed-off-by: David Riley <d.riley@proxmox.com>
Reviewed-by: Stefan Hanreich <s.hanreich@proxmox.com>
Tested-by: Stefan Hanreich <s.hanreich@proxmox.com>
---

 src/PVE/AccessControl.pm | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm
index 9ad7c40..475c7b5 100644
--- a/src/PVE/AccessControl.pm
+++ b/src/PVE/AccessControl.pm
@@ -977,6 +977,25 @@ sub iterate_acl_tree {
     }
 }
 
+# recursively checks a node and all its children for active permissions
+sub acl_tree_has_permissions {
+    my ($node) = @_;
+
+    for my $key (keys %$node) {
+        if ($key ne 'children') {
+            return 1;
+        }
+    }
+
+    for my $child_key (keys $node->{children}->%*) {
+        if (acl_tree_has_permissions($node->{children}->{$child_key})) {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
 # find ACL node corresponding to normalized $path under $root
 sub find_acl_tree_node {
     my ($root, $path) = @_;
-- 
2.47.3