I'm guessing this simplifies the permission check? I was thinking you could find the puppet module via its id and then see if any of the repos are readable but that's probably a lot of work.