[FIX] 补充修复上一次提交隐藏问题：原来的 default_factory 确实会在配置缺失且未及时持久化时生成新密钥，导致重启后旧 JWT 失效。

现在改为：
WebConfig.secret_key 默认保持为空。
应用启动时仅在密钥为空时生成 64 字符随机密钥。
立即通过现有 ConfigLoader 写入 data/config.yaml。
后续启动直接复用已有密钥，不再轮换。
已存在的非空密钥不会被覆盖。

Author: 436and251

kirara_ai/config/global_config.py

@@ -1,4 +1,3 @@
-import secrets
 from typing import Any, Dict, List, Optional
 
 from pydantic import BaseModel, ConfigDict, Field, model_validator
@@ -109,10 +108,7 @@ class MemoryConfig(BaseModel):
 class WebConfig(BaseModel):
     host: str = Field(default="127.0.0.1", description="Web服务绑定的IP地址")
     port: int = Field(default=8080, description="Web服务端口号")
-    secret_key: str = Field(
-        default_factory=lambda: secrets.token_hex(32),
-        description="Web服务的密钥，用于JWT等加密",
-    )
+    secret_key: str = Field(default="", description="Web服务的密钥，用于JWT等加密")
     password_file: str = Field(
         default="./data/web/password.hash", description="密码哈希存储路径"
     )

kirara_ai/entry.py

@@ -1,11 +1,12 @@
 import asyncio
 import os
+import secrets
 import signal
 import time
 
 from packaging import version
 
-from kirara_ai.config.config_loader import ConfigLoader
+from kirara_ai.config.config_loader import CONFIG_FILE, ConfigLoader
 from kirara_ai.config.global_config import GlobalConfig
 from kirara_ai.database import DatabaseManager
 from kirara_ai.events.application import ApplicationStarted, ApplicationStopping
@@ -112,30 +113,35 @@ def init_tracing_system(container: DependencyContainer):
     logger.info("Tracing system initialized")
     return tracing_manager
 
+
+def _ensure_web_secret(config: GlobalConfig, config_path: str) -> None:
+    if config.web.secret_key and os.path.exists(config_path):
+        return
+    if not config.web.secret_key:
+        config.web.secret_key = secrets.token_hex(32)
+    ConfigLoader.save_config_with_backup(config_path, config)
+
+
 def init_application() -> DependencyContainer:
     """初始化应用程序"""
     logger.info("Initializing application...")
 
     # 配置文件路径
-    config_path = "./data/config.yaml"
+    config_path = CONFIG_FILE
 
     # 加载配置文件
     logger.info(f"Loading configuration from {config_path}")
-    # check data directory
-    if not os.path.exists("./data"):
-        os.makedirs("./data")
     if os.path.exists(config_path):
         config: GlobalConfig = ConfigLoader.load_config(config_path, GlobalConfig)
         logger.info("Configuration loaded successfully")
     else:
         logger.warning(
-            f"Configuration file {config_path} not found, using default configuration"
-        )
-        logger.warning(
-            "Please create a configuration file by copying config.yaml.example to config.yaml and modify it according to your needs"
+            f"Configuration file {config_path} not found, creating default configuration"
         )
         config = GlobalConfig()
 
+    _ensure_web_secret(config, config_path)
+
     # 设置时区
     os.environ["TZ"] = config.system.timezone
     if hasattr(time, "tzset"):

tests/web/api/im/test_im.py

@@ -170,14 +170,15 @@ async def test_get_adapter(self, test_client, auth_headers):
         assert adapter.get("config") == TEST_ADAPTER_CONFIG
 
     @pytest.mark.asyncio
-    async def test_create_adapter(self, test_client, auth_headers):
+    async def test_create_adapter(self, test_client, auth_headers, monkeypatch):
         """测试创建适配器"""
         adapter_data = IMAdapterConfig(
             name="new-adapter", adapter=TEST_ADAPTER_TYPE, config=TEST_ADAPTER_CONFIG
         )
 
         # Mock 配置文件保存
-        ConfigLoader.save_config_with_backup = MagicMock()
+        mock_save = MagicMock()
+        monkeypatch.setattr(ConfigLoader, "save_config_with_backup", mock_save)
         response = test_client.post(
             "/backend-api/api/im/adapters",
             headers=auth_headers,
@@ -192,10 +193,10 @@ async def test_create_adapter(self, test_client, auth_headers):
         assert adapter.get("config") == TEST_ADAPTER_CONFIG
 
         # 验证配置保存
-        ConfigLoader.save_config_with_backup.assert_called_once()
+        mock_save.assert_called_once()
 
     @pytest.mark.asyncio
-    async def test_update_adapter(self, test_client, auth_headers):
+    async def test_update_adapter(self, test_client, auth_headers, monkeypatch):
         """测试更新适配器"""
         adapter_data = IMAdapterConfig(
             name=TEST_ADAPTER_ID,
@@ -204,7 +205,8 @@ async def test_update_adapter(self, test_client, auth_headers):
         )
 
         # Mock 配置文件保存
-        ConfigLoader.save_config_with_backup = MagicMock()
+        mock_save = MagicMock()
+        monkeypatch.setattr(ConfigLoader, "save_config_with_backup", mock_save)
         response = test_client.put(
             f"/backend-api/api/im/adapters/{TEST_ADAPTER_ID}",
             headers=auth_headers,
@@ -220,7 +222,7 @@ async def test_update_adapter(self, test_client, auth_headers):
         assert adapter.get("config").get("name") == "Updated Bot"
 
         # 验证配置保存
-        ConfigLoader.save_config_with_backup.assert_called_once()
+        mock_save.assert_called_once()
 
     @pytest.mark.asyncio
     async def test_stop_adapter(self, test_client, auth_headers):
@@ -260,7 +262,7 @@ async def test_start_adapter(self, test_client, auth_headers):
         assert data.get("adapter").get("is_running") is True
 
     @pytest.mark.asyncio
-    async def test_delete_adapter(self, test_client, auth_headers):
+    async def test_delete_adapter(self, test_client, auth_headers, monkeypatch):
         """测试删除适配器"""
         # 先启动适配器
         test_client.post(
@@ -269,7 +271,8 @@ async def test_delete_adapter(self, test_client, auth_headers):
         )
 
         # Mock 配置文件保存
-        ConfigLoader.save_config_with_backup = MagicMock()
+        mock_save = MagicMock()
+        monkeypatch.setattr(ConfigLoader, "save_config_with_backup", mock_save)
         response = test_client.delete(
             f"/backend-api/api/im/adapters/{TEST_ADAPTER_ID}", headers=auth_headers
         )
@@ -279,7 +282,7 @@ async def test_delete_adapter(self, test_client, auth_headers):
         assert data.get("message") == "Adapter deleted successfully"
 
         # 验证配置保存
-        ConfigLoader.save_config_with_backup.assert_called_once()
+        mock_save.assert_called_once()
 
     @pytest.mark.asyncio
     async def test_get_adapter_config_schema(self, test_client, auth_headers):

tests/web/api/llm/test_llm.py

@@ -177,7 +177,7 @@ async def test_create_backend(self, test_client, auth_headers):
             mock_save.assert_called_once()
 
     @pytest.mark.asyncio
-    async def test_update_backend(self, test_client, auth_headers):
+    async def test_update_backend(self, test_client, auth_headers, monkeypatch):
         """测试更新后端"""
         updated_config = LLMBackendConfig(
             name=TEST_BACKEND_NAME,
@@ -188,7 +188,8 @@ async def test_update_backend(self, test_client, auth_headers):
         )
 
         # Mock 配置文件保存
-        ConfigLoader.save_config_with_backup = MagicMock()
+        mock_save = MagicMock()
+        monkeypatch.setattr(ConfigLoader, "save_config_with_backup", mock_save)
         response = test_client.put(
             f"/backend-api/api/llm/backends/{TEST_BACKEND_NAME}",
             headers=auth_headers,
@@ -203,12 +204,13 @@ async def test_update_backend(self, test_client, auth_headers):
         assert backend.get("config").get("api_key") == "updated-key"
 
         # 验证配置保存
-        ConfigLoader.save_config_with_backup.assert_called_once()
+        mock_save.assert_called_once()
 
     @pytest.mark.asyncio
-    async def test_delete_backend(self, test_client, auth_headers):
+    async def test_delete_backend(self, test_client, auth_headers, monkeypatch):
         """测试删除后端"""
-        ConfigLoader.save_config_with_backup = MagicMock()
+        mock_save = MagicMock()
+        monkeypatch.setattr(ConfigLoader, "save_config_with_backup", mock_save)
         response = test_client.delete(
             f"/backend-api/api/llm/backends/{TEST_BACKEND_NAME}", headers=auth_headers
         )
@@ -218,7 +220,7 @@ async def test_delete_backend(self, test_client, auth_headers):
         assert "data" in data
         backend = data.get("data")
         assert backend.get("name") == TEST_BACKEND_NAME
-        ConfigLoader.save_config_with_backup.assert_called_once()
+        mock_save.assert_called_once()
 
         # 验证后端已被删除
         response = test_client.get(

tests/web/auth/test_auth.py

@@ -2,7 +2,9 @@
 import pytest_asyncio
 from fastapi.testclient import TestClient
 
+from kirara_ai.config.config_loader import ConfigLoader
 from kirara_ai.config.global_config import GlobalConfig, WebConfig
+from kirara_ai.entry import _ensure_web_secret
 from kirara_ai.ioc.container import DependencyContainer
 from kirara_ai.web.app import WebServer
 from kirara_ai.web.auth.services import AuthService
@@ -32,11 +34,13 @@ def test_client(app):
     return TestClient(app)
 
 
-def test_first_login_with_default_secret(tmp_path):
+def test_first_login_with_persisted_default_secret(tmp_path):
     container = DependencyContainer()
+    config_path = tmp_path / "config.yaml"
     config = GlobalConfig(
         web=WebConfig(password_file=str(tmp_path / "password.hash"))
     )
+    _ensure_web_secret(config, str(config_path))
     container.register(GlobalConfig, config)
     web_server = WebServer(container)
 
@@ -47,6 +51,10 @@ def test_first_login_with_default_secret(tmp_path):
     assert response.status_code == 200
     token = response.json()["access_token"]
     assert container.resolve(AuthService).verify_token(token)
+    saved = ConfigLoader.load_config(str(config_path), GlobalConfig)
+    assert saved.web.secret_key == config.web.secret_key
+    _ensure_web_secret(saved, str(config_path))
+    assert saved.web.secret_key == config.web.secret_key
 
 
 @pytest_asyncio.fixture