Description

This currently uses roles as the guiding force of the permission. This should be changed to use Privileges instead. Roles are just a grouping agent for privileges. The meat of permissions checking and authorization should always be done with privileges.

The current code loops over a user's roles. This does not take into account roles inherited from other roles. If you did privilege based checking, the code would be simplified to:

 (pseudo code)
 for each privilege in tribeEditPrivileges {
   if (Context.hasPrivilege(privilege))
     authorized = true;
 }

The Context.hasPrivilege check combines the authenticated/anonymous role's privileges and all inherited privileges from roles to determine if the current user has that privilege.