Pricing and news endpoints require authentication despite being public reference data #23

New issue

Closed

opened 2026-05-14 14:30:15 +00:00 by Mark · 1 comment

Mark commented

2026-05-14 14:30:15 +00:00

Owner

Bug

GET /api/pricing and GET /api/news are public-facing endpoints for reference data (comparison pricing, news about service changes) but they require authentication via authMiddleware.

Without a valid JWT:

curl -s http://localhost:3001/api/pricing
→ {"error":"Authentication required. Provide a valid Bearer token..."}

With a valid JWT:

curl -s -H "Authorization: Bearer $TOKEN" http://localhost:3001/api/pricing
→ [5 entries of pricing data]

Expected

These endpoints should be accessible without authentication since they contain public reference data (prices for Netflix, Spotify, etc.). The README and app.yml imply they are public.

Severity

YELLOW Medium — Users browsing pricing comparisons or news must log in first, which is unnecessary friction. 2/2 endpoints affected.

Fix

Remove authMiddleware from the pricing and news route declarations in app.ts.

## Bug `GET /api/pricing` and `GET /api/news` are public-facing endpoints for reference data (comparison pricing, news about service changes) but they require authentication via `authMiddleware`. Without a valid JWT: ``` curl -s http://localhost:3001/api/pricing → {"error":"Authentication required. Provide a valid Bearer token..."} ``` With a valid JWT: ``` curl -s -H "Authorization: Bearer $TOKEN" http://localhost:3001/api/pricing → [5 entries of pricing data] ``` ## Expected These endpoints should be accessible without authentication since they contain public reference data (prices for Netflix, Spotify, etc.). The README and app.yml imply they are public. ## Severity YELLOW **Medium** — Users browsing pricing comparisons or news must log in first, which is unnecessary friction. 2/2 endpoints affected. ## Fix Remove `authMiddleware` from the pricing and news route declarations in `app.ts`.