# `Arc.Authorization`
[🔗](https://github.com/Cratis/Arc.Elixir/blob/main/lib/arc/authorization.ex#L4)

Authorization declarations and checks for commands and queries.

Declare requirements on the artifact:

    authorize roles: ["admin"]      # at least one role
    authorize :authenticated        # any signed-in caller
    authorize policy: :can_publish  # a named `Arc.Policy`
    allow_anonymous()

With no declaration an artifact is open. A query declaration (`@query authorize: [...]`)
replaces the module-level declaration for that query.

# `requirement`

```elixir
@type requirement() :: %{
  roles: [String.t()],
  policy: atom() | nil,
  allow_anonymous: boolean(),
  authenticated?: boolean()
}
```

# `check`

```elixir
@spec check(requirement(), Arc.Context.t(), term()) ::
  :ok | {:error, :unauthenticated | {:forbidden, String.t()}}
```

Checks a requirement against the caller. Returns `:ok`, `{:error, :unauthenticated}` or
`{:error, {:forbidden, reason}}`.

# `open`

```elixir
@spec open() :: requirement()
```

An empty requirement.

---

*Consult [api-reference.md](api-reference.md) for complete listing*