Who is calling: current_principal

A route reads the signed-in caller as current_principal, and passes it to the action it runs like any other argument. current_principal.user says the route is for users only: it is a Principal.user, and a service calling the route is refused with 403 before the action runs. current_principal.service works the same way for services.

// domains/planning/actions/create_todo.jadpoaction create_todo(input: CreateTodo, caller: Principal.user) fails DueDateInPast -> TodoView {    var owner: User.id = caller.id    ...}// domains/planning/routes/todos.jadpoPOST / {    input: CreateTodo    output: TodoView    run: create_todo(input, current_principal.user)}

The route is written as HTTP describes.

• current_principal exists only in routes that need a signed-in caller. Actions, queries and functions get the caller as a parameter, so their signatures say they need one, and tests pass one in.
• An action that only needs policy's checks takes no caller. Policy reads the caller from the request itself.
• A schedule or a subscriber has no caller, so an action it runs can't ask for one (Jobs and events).
• A caller can never be returned to a client, read from request input or put in a failure's fields (type.auth_principal_*), however deeply a field holds it: in a list, a map or an option, or in an object's field or a variant's data.