fix(web): fallback to default secret when database setting is empty (#6189)

* fix(web): fallback to default secret when database setting is empty

* style(web): format setting_security_test.go with gofumpt

internal/web/service/setting.go

@@ -664,10 +664,13 @@ func (s *SettingService) GetSubShowIdentityOnAllLinks() (bool, error) {
 
 func (s *SettingService) GetSecret() ([]byte, error) {
 	secret, err := s.getString("secret")
-	if secret == defaultValueMap["secret"] {
+	if secret == "" || secret == defaultValueMap["secret"] {
-		err := s.saveSetting("secret", secret)
+		if secret == "" {
-		if err != nil {
+			secret = defaultValueMap["secret"]
-			logger.Warning("save secret failed:", err)
+		}
+		saveErr := s.saveSetting("secret", secret)
+		if saveErr != nil {
+			logger.Warning("save secret failed:", saveErr)
 		}
 	}
 	return []byte(secret), err

internal/web/service/setting_security_test.go

@@ -169,3 +169,28 @@ func TestVerifyTwoFactorCode(t *testing.T) {
 		t.Fatal("invalid code accepted")
 	}
 }
+
+func TestGetSecret_FallbacksOnEmptyDatabaseSetting(t *testing.T) {
+	setupSettingTestDB(t)
+	s := &SettingService{}
+	if err := s.saveSetting("secret", ""); err != nil {
+		t.Fatal(err)
+	}
+
+	secretBytes, err := s.GetSecret()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	secret := string(secretBytes)
+	if len(secret) != 32 {
+		t.Fatalf("secret length = %d, want 32-byte non-empty string", len(secret))
+	}
+
+	persisted, err := s.getString("secret")
+	if err != nil {
+		t.Fatalf("failed to retrieve persisted secret: %v", err)
+	}
+	if persisted != secret {
+		t.Fatalf("persisted secret = %q, want %q", persisted, secret)
+	}
+}