fix(xui): a client with no token yet sent a bare Bearer and failed early

Caught the moment the import ran against a real box. The client sets
`Authorization: Bearer <token>` unconditionally, so the bootstrap client —
the one that logs in precisely BECAUSE it has no token — sent `Bearer ` with
nothing after it. httpx refuses to encode that, so the request died as an
illegal header before reaching the panel, and the error mentioned a header
rather than the missing token.

The header is now set only when there is a token to put in it.

The failure underneath was also unreadable: httpx leaves `str(exc)` empty on
a plain connect failure, so the message read "transport error: " and stopped.
That is the error an operator gets when the port or the base path is wrong,
which is most of the time — it now names the exception and the URL it could
not reach.

Author: DaveBugg

backend/app/core/xui_api.py

@@ -182,14 +182,22 @@ def _ensure_client(self) -> httpx.AsyncClient:
             # api/inbounds/list` collapses to `https://h:port/panel/...`,
             # missing the basepath and getting a 307 redirect back from
             # the panel. Building full URLs in `_request` instead.
+            headers: Dict[str, str] = {
+                # The panel responds JSON either way, but being explicit
+                # avoids any future content-negotiation surprises if
+                # upstream adds an HTML fallback.
+                "Accept": "application/json",
+            }
+            # Only when there is one. A client that has yet to obtain a token
+            # — the bootstrap that logs in to fetch it — would otherwise send
+            # a bare `Bearer `, which httpx refuses to encode at all: the
+            # request fails as an illegal header before it reaches the panel,
+            # and the error says nothing about the missing token.
+            if self.api_token:
+                headers["Authorization"] = f"Bearer {self.api_token}"
+
             client_kwargs: Dict[str, Any] = dict(
-                headers={
-                    "Authorization": f"Bearer {self.api_token}",
-                    # The panel responds JSON either way, but being
-                    # explicit avoids any future content-negotiation
-                    # surprises if upstream adds an HTML fallback.
-                    "Accept": "application/json",
-                },
+                headers=headers,
                 verify=self.verify_tls,
                 timeout=self.timeout,
                 # Follow 307/308 redirects belt-and-suspenders — if a
@@ -318,8 +326,14 @@ async def _ensure_cookie_session(self) -> str:
         try:
             r = await client.get(url, headers={"X-Requested-With": "XMLHttpRequest"})
         except httpx.HTTPError as exc:
+            # httpx leaves `str(exc)` empty on a plain connect failure, and
+            # "transport error: " with nothing after it tells the operator
+            # nothing — this is the error they hit when the port or the base
+            # path is wrong, which is most of the time.
             raise XuiAPIError(
-                f"csrf-token transport error: {exc}", kind="transport",
+                f"csrf-token transport error: "
+                f"{str(exc) or type(exc).__name__} ({url})",
+                kind="transport",
             ) from exc
         if not r.is_success:
             raise XuiAPIError(

backend/tests/test_xui_api.py

@@ -812,3 +812,22 @@ def test_neither_mount_answering_is_an_error(self, monkeypatch):
         client, _ = self._client(monkeypatch, {})
         with pytest.raises(XuiAPIError, match="Could not obtain an API token"):
             asyncio.run(client.ensure_api_token())
+
+
+class TestClientWithoutAToken:
+    """The bootstrap client that logs in to FETCH the token has none yet."""
+
+    def test_no_authorization_header_when_there_is_no_token(self):
+        from app.core.xui_api import XuiClient
+        c = XuiClient(base_url="http://198.51.100.7:2053/abc", api_token="",
+                      panel_user="admin", panel_pass="pw")
+        http = c._ensure_client()
+        # httpx refuses to encode a bare `Bearer `: the request fails as an
+        # illegal header before it leaves the process, and the error says
+        # nothing about a missing token.
+        assert "Authorization" not in http.headers
+
+    def test_the_header_is_there_once_a_token_is(self):
+        from app.core.xui_api import XuiClient
+        c = XuiClient(base_url="http://198.51.100.7:2053/abc", api_token="tok")
+        assert c._ensure_client().headers["Authorization"] == "Bearer tok"