W-AUTH-CONTENT-NOT-GATED
Security footgun. An <auth role="X"> element gates JS mount/behaviour only — it does NOT withhold served HTML content. The gated markup ships verbatim to every viewer.
What it means
<auth role>
is a code-splitting / JS-mount optimization, NOT a content-secrecy
control. Under --emit-per-route
the per-role JS chunk omits the gated subtree's mount/wiring for roles
that fail the gate — but the served HTML still carries the gated
markup verbatim. In default compile mode it withholds nothing at all.
Either way, any viewer who reads the response body (view-source) sees
the gated content. The compiler emits this warning once per
<auth role=>
site so the footgun surfaces at compile time.
How to fix
To withhold sensitive content, gate it server-side:
place the sensitive content, data, and mutations behind a
server function
that resolves the authenticated role server-side and returns / performs
them only for admitted roles, so non-admitted markup and values never
enter the response body. Keep
<auth role>
for the JS-mount / bundle-size optimization it is. This is correct on
every deployment target, including static hosting. (A server-render-time
role-gating runtime is a ratified future direction; until it ships,
server-side omission is the canonical answer.)
Related
Specification
Normative text: compiler/SPEC.md §40.9.5 (content-visibility scope) + §34 (catalogue).