class Stytch::PolicyCache

def perform_authorization_check(

authorization_check is an object with keys 'action', 'resource_id', and 'organization_id'
subject_org_id does not match the authZ request organization_id.
will be raised. It's also possible for a TenancyError to be raised if the
check succeeds, this method will return. If the check fails, a PermissionError
Performs an authorization check against the project's policy and a set of roles. If the 
def perform_authorization_check(
  subject_roles:,
  subject_org_id:,
  authorization_check:
)
  raise Stytch::TenancyError.new(subject_org_id, authorization_check['organization_id']) if subject_org_id != authorization_check['organization_id']
  policy = get_policy
  org_policy = get_org_policy(organization_id: subject_org_id)
  all_roles = policy['roles'].concat(org_policy['roles'])
  return if all_roles.any? do |role|
    next unless subject_roles.include?(role['role_id'])
    role['permissions'].any? do |permission|
      actions = permission['actions']
      resource = permission['resource_id']
      has_matching_action = actions.include?('*') || actions.include?(authorization_check['action'])
      has_matching_resource = resource == authorization_check['resource_id']
      has_matching_action && has_matching_resource
    end
  end
  # If we get here, we didn't find a matching permission
  raise Stytch::PermissionError, authorization_check
end