diff --git a/packages/api/src/__tests__/project-router.test.ts b/packages/api/src/__tests__/project-router.test.ts
index fefffff..8f6d928 100644
--- a/packages/api/src/__tests__/project-router.test.ts
+++ b/packages/api/src/__tests__/project-router.test.ts
@@ -110,6 +110,14 @@ function createProtectedCaller(db: Record<string, unknown>) {
   });
 }
 
+function createUnauthenticatedCaller(db: Record<string, unknown>) {
+  return createCaller({
+    session: null,
+    db: db as never,
+    dbUser: null,
+  });
+}
+
 function createProtectedCallerWithOverrides(
   db: Record<string, unknown>,
   overrides: { granted?: PermissionKey[]; denied?: PermissionKey[] } | null,
@@ -157,6 +165,57 @@ describe("project router", () => {
     vi.clearAllMocks();
   });
 
+  describe("configuration checks", () => {
+    it("requires authentication for image generation configuration checks", async () => {
+      const findUnique = vi.fn();
+      const caller = createUnauthenticatedCaller({
+        systemSettings: {
+          findUnique,
+        },
+      });
+
+      await expect(caller.isImageGenConfigured()).rejects.toMatchObject({
+        code: "UNAUTHORIZED",
+        message: "Authentication required",
+      });
+      await expect(caller.isDalleConfigured()).rejects.toMatchObject({
+        code: "UNAUTHORIZED",
+        message: "Authentication required",
+      });
+
+      expect(findUnique).not.toHaveBeenCalled();
+    });
+
+    it("returns only narrow readiness data for authenticated callers", async () => {
+      const findUnique = vi.fn().mockResolvedValue({
+        id: "singleton",
+        imageProvider: "dalle",
+      });
+      const caller = createProtectedCaller({
+        systemSettings: {
+          findUnique,
+        },
+      });
+
+      const imageGen = await caller.isImageGenConfigured();
+      const dalle = await caller.isDalleConfigured();
+
+      expect(imageGen).toEqual({
+        configured: false,
+        provider: "dalle",
+      });
+      expect(dalle).toEqual({
+        configured: false,
+      });
+      expect(findUnique).toHaveBeenNthCalledWith(1, {
+        where: { id: "singleton" },
+      });
+      expect(findUnique).toHaveBeenNthCalledWith(2, {
+        where: { id: "singleton" },
+      });
+    });
+  });
+
   // ─── create ───────────────────────────────────────────────────────────────
 
   describe("create", () => {