Generally working.

src/bud06.c

@@ -204,14 +204,7 @@ void handle_head_upload_request(void) {
         return;
     }
     
-    // Check if blob already exists (duplicate detection)
-    if (check_blob_exists(sha256)) {
-        send_upload_error_response(409, "blob_exists", "Blob with this hash already exists", XREASON_BLOB_EXISTS);
-        log_request("HEAD", "/upload", "none", 409);
-        return;
-    }
-    
-    // Check for optional authorization
+    // Check for authorization first (before duplicate detection)
     const char* auth_header = getenv("HTTP_AUTHORIZATION");
     const char* auth_status = "none";
     
@@ -220,6 +213,18 @@ void handle_head_upload_request(void) {
         // This handler receives pre-validated requests, so if we reach here with auth_header,
         // the authentication was already successful
         auth_status = "authenticated";
+    } else {
+        // Check if server requires authorization for uploads
+        // If auth is required but not provided, return 401 before checking for duplicates
+        // TODO: This should check server configuration for auth requirements
+        // For now, assume auth is optional unless configured otherwise
+    }
+    
+    // Check if blob already exists (duplicate detection - after auth validation)
+    if (check_blob_exists(sha256)) {
+        send_upload_error_response(409, "blob_exists", "Blob with this hash already exists", XREASON_BLOB_EXISTS);
+        log_request("HEAD", "/upload", auth_status, 409);
+        return;
     }
     
     // All validations passed - return success