Auth: secure routes without relying on +layout.svelte

[stephenrichter]

While the current auth_guard works for simple purposes, we should keep an eye on the following issues with using +layout.svelte for guarding the app tree most effectively.

As raised in:

• Huntabyte video - https://www.youtube.com/watch?v=UbhhJWV3bmI
• Github issue - Attack vector arising from naive developer use of the +layout.server.js tree sveltejs/kit#6315

// Everything in the app route tree is protected behind user accounts.
$effect.pre(auth_guard);

^ This is not exactly true for routes below the +layout.svelte file. I'm researching a more secure solution and will see if I can open a PR at a future date once SvelteKit 2 is more stable.

[stephenrichter]

Closing as I learned more about SvelteKit and understand this is not as much a concern for SPA/CSR. The auth_guard can run on individual +page.js files safely.