Skip to content

fix(api): keep anonymous package reads in the public view - #116

Open
aleksUIX wants to merge 1 commit into
IABTechLab:mainfrom
aleksUIX:fix/public-package-reads
Open

aleksUIX wants to merge 1 commit into
IABTechLab:mainfrom
aleksUIX:fix/public-package-reads

Conversation

@aleksUIX

Copy link
Copy Markdown

GET /packages and /packages/{package_id} currently return exact prices, floors, placements and audience segment lists to anonymous callers who supply a non-public buyer_tier. Select the public view whenever no validated API key is present.

Valid buyer and operator keys keep the authenticated view. Claimed anonymous tiers now receive public price ranges and audience summaries. Package filters and missing-package responses stay intact.

Validation: 38 route regressions use real header validation and pricing, covering forged identities, both key headers, valid roles, rejected keys, filters and 404s. Twelve regressions fail on unchanged main. Locked Python 3.12 unit tests passed 1,708 cases; integration tests passed 39 with 28 existing skips. Ruff checks passed. The repository Dockerfile built, and the isolated default container reached healthy status. No deployed seller was tested.

Fixes #114.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

# GET /packages and GET /packages/{package_id} return exact_price and floor_price to an anonymous caller who adds ?buyer_tier=agency

1 participant