{
  "filename": "src/routes/orders/+page.server.ts",
  "rule": "- name: private-ssr-cache-header\n  where: \"src/routes/orders/+page.server.ts\"\n  ensure: >-\n    The authenticated orders load must set cache-control to private, no-store and must not advertise public caching.",
  "corrected": "import { error } from \"@sveltejs/kit\";\nimport { db } from \"$lib/server/db\";\n\nexport async function load({locals,setHeaders}) {\n  if (!locals.user) error(401, \"Sign in required\");\n  setHeaders({\"cache-control\":\"private, no-store\"});\n  const orders = await db.listOwnedOrders(locals.user.tenantId, locals.user.id);\n  return {orders};\n}\n",
  "broken": "import { error } from \"@sveltejs/kit\";\nimport { db } from \"$lib/server/db\";\n\nexport async function load({locals,setHeaders}) {\n  if (!locals.user) error(401, \"Sign in required\");\n  setHeaders({\"cache-control\":\"public, max-age=300\"});\n  const orders = await db.listOwnedOrders(locals.user.tenantId, locals.user.id);\n  return {orders};\n}\n",
  "regression": [
    "\"private, no-store\"",
    "\"public, max-age=300\""
  ],
  "test_scenarios": [
    [
      "Authenticated load",
      "Tenant/owner query and private response"
    ],
    [
      "Two users on same path",
      "No data shared"
    ],
    [
      "Signed out",
      "No data returned"
    ],
    [
      "CDN configuration change",
      "Private policy preserved at origin and edge"
    ]
  ],
  "test_source": null,
  "test_command": "npx vitest run tests/private-load.test.ts"
}