refactor(settings): simplify settings query options and remove tenant dependency

Updated the settings query options to eliminate the tenant ID parameter, streamlining the settings retrieval process. Adjusted the TenantSettingsComponent to reflect this change, ensuring it now queries settings without relying on tenant-specific data. This refactor enhances code clarity and reduces complexity in the settings management flow.

internal/httpapi/auth.go

@@ -81,15 +81,16 @@ func authFromKeyRecord(raw string, rec apiKeyRecord) Auth {
 }
 
 // resolveAuth maps a bearer token to tenant identity.
-// For the literal token "dev", env/DB keys take precedence over the demo shortcut (devAuth).
+// For the literal token "dev", the demo shortcut (devAuth) takes precedence when demo-seed
+// is available; env/DB mapping is used only when demo tenant is absent.
 func (s *Server) resolveAuth(raw string) (Auth, bool) {
 	if raw == "dev" {
-		if rec, ok := s.keyResolver.Lookup(raw); ok {
-			return authFromKeyRecord(raw, rec), true
-		}
 		if a, ok := s.devAuth(); ok {
 			return a, true
 		}
+		if rec, ok := s.keyResolver.Lookup(raw); ok {
+			return authFromKeyRecord(raw, rec), true
+		}
 		return Auth{}, false
 	}
 	rec, ok := s.keyResolver.Lookup(raw)

internal/httpapi/auth_dev_settings_test.go

@@ -31,7 +31,7 @@ func TestBearerDevGetSettings(t *testing.T) {
 	}
 }
 
-func TestBearerDevPrefersEnvAPIKeyOverDemoTenant(t *testing.T) {
+func TestBearerDevPrefersDemoTenantOverEnvKey(t *testing.T) {
 	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
 	if err != nil {
 		t.Fatal(err)
@@ -61,7 +61,41 @@ func TestBearerDevPrefersEnvAPIKeyOverDemoTenant(t *testing.T) {
 		t.Fatal(err)
 	}
 	got, _ := body["tenant_id"].(string)
+	if got != demoTenant {
+		t.Fatalf("tenant_id=%q want demo tenant %q (env=%q)", got, demoTenant, otherTenant)
+	}
+}
+
+func TestBearerDevFallsBackToEnvKeyWithoutDemo(t *testing.T) {
+	srv, err := New(Options{SeedDemo: false, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+
+	otherTenant := "00000000-0000-4000-8000-000000000001"
+	mustSetTestAPIKeys(t, srv, "dev|"+otherTenant+"|operator")
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/auth/session", nil)
+	req.Header.Set("Authorization", "Bearer dev")
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("session status=%d body=%s", resp.StatusCode, b)
+	}
+	var body map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := body["tenant_id"].(string)
 	if got != otherTenant {
-		t.Fatalf("tenant_id=%q want env key tenant %q (demo=%q)", got, otherTenant, demoTenant)
+		t.Fatalf("tenant_id=%q want env key tenant %q", got, otherTenant)
 	}
 }