scrml.dev v0.7.1
Reference › Errors

W-AUTH-PAGE-INFERRED

A <page> has no explicit auth= under <program auth="required">.

Info Compile-time SPEC §40.1.1 (normative)

The lint is file-scoped: it fires only where the <page> sits in the same file as the <program auth="required"> that establishes the auth config. A <page> in its own file under pages/ does not fire it. Despite the W- prefix the compiler assigns severity info.

What it means

Page-level auth is not inherited from <program> for closure analysis. The program-level middleware still enforces at the request boundary — the page is not unprotected — but without an explicit per-page auth= the closure analysis has no gate to feed into per-role traversal, so the page reads as ungated when bundles are computed. The lint nudges you to state the intent explicitly.

Minimal reproducer

This is the exact source compiled against the linked compiler and verified to produce W-AUTH-PAGE-INFERRED. 

<program title="p" auth="required">
    type Role:enum = { Admin, Member }
    <page>
        <auth role="Admin">
            <p>admin</p>
        </>
    </>
</>

How to fix

  1. Add an explicit auth= to the <page>. The page then participates in per-role chunking.
  2. Leave it if request-boundary enforcement is enough. This is informational. The page is still protected; it just does not contribute to per-role bundle splitting.

Related

Specification

Normative text: §40.1.1, §34. Spec lives at compiler/SPEC.md .

← Reference