# `Arc.Principal`
[🔗](https://github.com/Cratis/Arc.Elixir/blob/main/lib/arc/principal.ex#L4)

The authenticated caller of a command or query.

Built by an `Arc.Authentication` handler from whatever your application already uses to
authenticate (`phx.gen.auth`, a token plug, a reverse proxy). Arc never invents a second
authentication system.

# `t`

```elixir
@type t() :: %Arc.Principal{
  actor: t() | nil,
  authenticated?: boolean(),
  claims: %{optional(String.t()) => String.t() | [String.t()]},
  id: String.t() | nil,
  name: String.t() | nil,
  roles: [String.t()]
}
```

# `acted_on_behalf_of?`

```elixir
@spec acted_on_behalf_of?(t()) :: boolean()
```

Whether another identity is acting on behalf of this principal.

In an on-behalf session the principal is the represented user (who decides what the request may
do) and `actor` is who is actually acting. `roles` never include the actor's roles.

# `actor`

```elixir
@spec actor(t()) :: t() | nil
```

The identity acting on behalf of this principal, or `nil`.

# `anonymous`

```elixir
@spec anonymous() :: t()
```

The anonymous principal.

# `in_any_role?`

```elixir
@spec in_any_role?(t(), [String.t()]) :: boolean()
```

Whether the principal has at least one of the given roles.

# `new`

```elixir
@spec new(String.t(), String.t(), keyword()) :: t()
```

Builds an authenticated principal.

---

*Consult [api-reference.md](api-reference.md) for complete listing*