From 32ba3ea819553048b3cf818d0b70e11236b55e91 Mon Sep 17 00:00:00 2001
From: Aditya kumar singh <143548997+Adityakk9031@users.noreply.github.com>
Date: Sat, 22 Aug 2026 23:43:39 +0530
Subject: [PATCH] fix(auth): return clear error on missing auth header and
 support configurable tus sign path

---
 src/http/plugins/jwt.ts          | 6 ++++++
 src/http/routes/tus/lifecycle.ts | 5 ++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/http/plugins/jwt.ts b/src/http/plugins/jwt.ts
index 05319a7c7..e37db8033 100644
--- a/src/http/plugins/jwt.ts
+++ b/src/http/plugins/jwt.ts
@@ -46,6 +46,12 @@ const jwtPlugin = fastifyPlugin<JWTPluginOptions>(
         return
       }
 
+      if (!request.jwt) {
+        request.jwtPayload = { role: 'anon' }
+        request.isAuthenticated = false
+        throw ERRORS.AccessDenied('Missing authorization header')
+      }
+
       const { secret, jwks } = await getJwtSecret(request.tenantId)
 
       try {
diff --git a/src/http/routes/tus/lifecycle.ts b/src/http/routes/tus/lifecycle.ts
index 51a225e16..ec4c4a6fa 100644
--- a/src/http/routes/tus/lifecycle.ts
+++ b/src/http/routes/tus/lifecycle.ts
@@ -82,7 +82,10 @@ export async function onIncomingRequest(rawReq: Request, id: string, datastore:
   req.upload.resources = [`${uploadID.bucket}/${uploadID.objectName}`]
 
   // Handle signed url requests
-  if (req.url?.startsWith(`/upload/resumable/sign`)) {
+  if (
+    req.url?.startsWith(`${tusPath}${SIGNED_URL_SUFFIX}`) ||
+    req.url?.startsWith(`/upload/resumable${SIGNED_URL_SUFFIX}`)
+  ) {
     const signature = req.headers['x-signature']
     if (!signature || (signature && typeof signature !== 'string')) {
       throw ERRORS.InvalidSignature('Missing x-signature header')