Let's say I'm making a platform like Linkedin. The platform let you upload your business detail.
All public visitors can go to your business page and view public information such as name and description. But, if you are the owner, you can also see additional private information such as your Sales figure, Invitations, etc on that same page
To do that, I make a route which gets the detail of a particular business (GET /businesses/:id)
This API has a authorization middleware that, for example, check whether you have a valid JWT to prove your identity.
If the JWT is incorrect or absent, the API only fetches and returns public information of that business. However, if the JWT is correct, it fetches additional information including all public and private detail of that business.
So, my question is, how serious are the disadvantages of using the same API route with conditional authorization? (maintainability/testability/security?)
Do I need to separate this into two different routes?