The way this method is framed currently, the access checks on the library itself should not be part of this method (it's kind of stated in the summary as well). But I can see why it's useful to have them together. I would prefer:

a) This method be renamed to something like `resolveTargetLibraryAccess`, which returns a boolean stating if the user can access the target library, and a string stating what visibility of the library should be returned (visibility is `undefined` if the boolean access param is `false`)

b) Pass in a full principal (accessed from the DAO preferably not the util, since access / privacy check on the principal itself is encapsulated in this method)