Route registration log prints auth=required for @noauth() routes (induces false security bug reports)

[andrevanzuydam]

CLI 3.8.58, tina4-python 3.13.87.

Actual

A route generated by tina4 generate auth:

@noauth()
@post("/api/auth/register")
async def register(request, response): ...

logs at startup:

Route registered: POST /api/auth/register (auth=required)
Route registered: POST /api/auth/login (auth=required)

Expected

auth=public (or similar) for @noauth() routes.

Behaviour is correct, the log is not

Real requests confirm the routes ARE public:

POST /api/auth/register  (no token)  ->  201 {"message":"Registered","id":1}
POST /api/auth/login     (no token)  ->  200 {"token":"eyJ..."}

The log is emitted before the @noauth() decorator applies (it sits above the verb decorator, which is the documented and required order).

Why it matters

This is actively misleading. In two separate validation runs an AI assistant read this log and concluded register/login were unreachable (a "chicken-and-egg auth deadlock") and started to "fix" a non-bug. One of them drafted a false critical security finding and only caught itself by curling the endpoint. Anyone reading startup logs, human or AI, will draw the same wrong conclusion.

Fix: emit the log after decorator application, or have @noauth() update the recorded state.