Would it be worth moving some of this out to the authz API? There might be some use in having a function that aggregates all direct and indirect members for a set of groups?