UI: Fix settings precedence, Factory < Admin (--ui-config-file) < Users (Settings panel) (#26002)

tools/ui/src/lib/utils/api-headers.ts

@@ -2,9 +2,11 @@ import { config } from '$lib/stores/settings.svelte';
 import {
 	AUTHORIZATION_HEADER,
 	BEARER_PREFIX,
+	CONTENT_TYPE_HEADER,
 	CORS_PROXY_HEADER_PREFIX,
 	REDACTED_HEADERS
 } from '$lib/constants';
+import { MimeTypeApplication } from '$lib/enums';
 import { redactValue } from './redact';
 
 /**
@@ -23,7 +25,7 @@ export function getAuthHeaders(): Record<string, string> {
  */
 export function getJsonHeaders(): Record<string, string> {
 	return {
-		'Content-Type': 'application/json',
+		[CONTENT_TYPE_HEADER]: MimeTypeApplication.JSON,
 		...getAuthHeaders()
 	};
 }

tools/ui/src/lib/utils/api-key-validation.ts

@@ -1,7 +1,8 @@
 import { base } from '$app/paths';
 import { error } from '@sveltejs/kit';
 import { browser } from '$app/environment';
-import { AUTHORIZATION_HEADER, BEARER_PREFIX } from '$lib/constants';
+import { AUTHORIZATION_HEADER, BEARER_PREFIX, CONTENT_TYPE_HEADER } from '$lib/constants';
+import { MimeTypeApplication } from '$lib/enums';
 import { config } from '$lib/stores/settings.svelte';
 
 /**
@@ -15,19 +16,18 @@ export async function validateApiKey(fetch: typeof globalThis.fetch): Promise<vo
 
 	const apiKey = config().apiKey;
 
-	// No API key configured — server doesn't require auth, skip the request entirely.
-	// The /props endpoint is only protected when the server has API keys configured,
-	// and in that case the client always has one set (from settings).
-	if (!apiKey) {
-		return;
-	}
-
 	try {
 		const headers: Record<string, string> = {
-			'Content-Type': 'application/json',
-			[AUTHORIZATION_HEADER]: `${BEARER_PREFIX}${apiKey}`
+			[CONTENT_TYPE_HEADER]: MimeTypeApplication.JSON
 		};
 
+		// Probe /props even without a stored key: on a server started with
+		// --api-key the unauthenticated request returns 401 and surfaces the
+		// API key splash, which is the onboarding path for entering the key.
+		if (apiKey) {
+			headers[AUTHORIZATION_HEADER] = `${BEARER_PREFIX}${apiKey}`;
+		}
+
 		const response = await fetch(`${base}/props`, { headers });
 
 		if (!response.ok) {