From 0f14ce755140d248682f3bc939dd467e3339848e Mon Sep 17 00:00:00 2001
From: Dan Liutko <44175332+CaMeDoZa@users.noreply.github.com>
Date: Sat, 15 Aug 2026 19:40:22 +0500
Subject: [PATCH] fix(web): fallback to default secret when database setting is
 empty (#6189)

* fix(web): fallback to default secret when database setting is empty

* style(web): format setting_security_test.go with gofumpt
---
 internal/web/service/setting.go               | 11 +++++---
 internal/web/service/setting_security_test.go | 25 +++++++++++++++++++
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/internal/web/service/setting.go b/internal/web/service/setting.go
index aea096b2f..8e105ebd5 100644
--- a/internal/web/service/setting.go
+++ b/internal/web/service/setting.go
@@ -664,10 +664,13 @@ func (s *SettingService) GetSubShowIdentityOnAllLinks() (bool, error) {
 
 func (s *SettingService) GetSecret() ([]byte, error) {
 	secret, err := s.getString("secret")
-	if secret == defaultValueMap["secret"] {
-		err := s.saveSetting("secret", secret)
-		if err != nil {
-			logger.Warning("save secret failed:", err)
+	if secret == "" || secret == defaultValueMap["secret"] {
+		if secret == "" {
+			secret = defaultValueMap["secret"]
+		}
+		saveErr := s.saveSetting("secret", secret)
+		if saveErr != nil {
+			logger.Warning("save secret failed:", saveErr)
 		}
 	}
 	return []byte(secret), err
diff --git a/internal/web/service/setting_security_test.go b/internal/web/service/setting_security_test.go
index 9f7b1aaa6..d65894cf9 100644
--- a/internal/web/service/setting_security_test.go
+++ b/internal/web/service/setting_security_test.go
@@ -169,3 +169,28 @@ func TestVerifyTwoFactorCode(t *testing.T) {
 		t.Fatal("invalid code accepted")
 	}
 }
+
+func TestGetSecret_FallbacksOnEmptyDatabaseSetting(t *testing.T) {
+	setupSettingTestDB(t)
+	s := &SettingService{}
+	if err := s.saveSetting("secret", ""); err != nil {
+		t.Fatal(err)
+	}
+
+	secretBytes, err := s.GetSecret()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	secret := string(secretBytes)
+	if len(secret) != 32 {
+		t.Fatalf("secret length = %d, want 32-byte non-empty string", len(secret))
+	}
+
+	persisted, err := s.getString("secret")
+	if err != nil {
+		t.Fatalf("failed to retrieve persisted secret: %v", err)
+	}
+	if persisted != secret {
+		t.Fatalf("persisted secret = %q, want %q", persisted, secret)
+	}
+}