W0403: A control hidden by a permission its event doesn't check

The markup shows a control only under perms.Has("x"), and the event it sends runs a method that checks no permission x. Hiding the control changes what the visitor sees; anyone can still send the event, so the method must check: @auth.Requires("x") (or @auth.RequiresAny) on it, or perms.Has("x") in its body, returning web.Forbidden when it is false; a pattern such as orders.* covers what it matches. auth.Can counts too, though a vuka file reads perms (W0402). Reported by vuka vet.

Wrong

<script lang="go">
func (p *Placements) Approve(ctx context.Context) error { … }
</script>

if perms.Has("placements.approve") {
  <button onClick={Approve}>Approve</button>
}

Right

<script lang="go">
@auth.Requires("placements.approve")
func (p *Placements) Approve(ctx context.Context) error { … }
</script>

if perms.Has("placements.approve") {
  <button onClick={Approve}>Approve</button>
}

Or, in the method:

func (p *Placements) Approve(ctx context.Context) error {
	if !perms.Has("placements.approve") {
		return web.Forbidden
	}
	…
}

See permissions in templates.