From bc5d0fb498faab946e35f1f2d7afb3c801ce4a24 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20FAMIBELLE-PRONZOLA?= <c.pronzola@tuta.io>
Date: Sat, 4 Jul 2026 11:35:41 +0400
Subject: [PATCH] =?UTF-8?q?fix:=20refuser=20par=20d=C3=A9faut=20is-payload?=
 =?UTF-8?q?-owner=20sans=20en-t=C3=AAte=20Authorization?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/policies/__tests__/is-payload-owner.test.js | 4 ++--
 src/policies/is-payload-owner.js                | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/policies/__tests__/is-payload-owner.test.js b/src/policies/__tests__/is-payload-owner.test.js
index a13cd84..1fc909e 100644
--- a/src/policies/__tests__/is-payload-owner.test.js
+++ b/src/policies/__tests__/is-payload-owner.test.js
@@ -26,11 +26,11 @@ function buildPolicyContext({authorization, payloadUserId}) {
 }
 
 describe('is-payload-owner policy', () => {
-  it("autorise quand aucun en-tête d'autorisation n'est présent", async () => {
+  it("refuse quand aucun en-tête d'autorisation n'est présent", async () => {
     const strapi = buildStrapi(999)
     const policyContext = buildPolicyContext({authorization: undefined, payloadUserId: 1})
 
-    await expect(isPayloadOwner(policyContext, {}, {strapi})).resolves.toBe(true)
+    await expect(isPayloadOwner(policyContext, {}, {strapi})).rejects.toThrow('Opération non autorisée')
   })
 
   it('autorise quand le user du JWT correspond au user du payload', async () => {
diff --git a/src/policies/is-payload-owner.js b/src/policies/is-payload-owner.js
index 76db9e4..aa5cac5 100644
--- a/src/policies/is-payload-owner.js
+++ b/src/policies/is-payload-owner.js
@@ -6,7 +6,7 @@ module.exports = async (policyContext, config, {strapi}) => {
   const {request} = policyContext
 
   if (!request?.header?.authorization) {
-    return true
+    throw new UnauthorizedError('Opération non autorisée')
   }
 
   try {