fix(config): restore 123456 as the default WebUI key

Stop rejecting and auto-rotating the legacy management key so new configs default to 123456 and users can save that value.

src-tauri/src/core_config/settings.rs

@@ -97,9 +97,6 @@ pub(crate) fn validate_strong_management_secret_key(secret_key: &str) -> Result<
     if secret_key.trim().is_empty() {
         return Err("WebUI key cannot be empty".to_string());
     }
-    if secret_key.trim() == LEGACY_DEFAULT_MANAGEMENT_SECRET_KEY {
-        return Err("The legacy default WebUI key 123456 cannot be used".to_string());
-    }
     if is_hashed_management_secret_key(secret_key) {
         return Err("GUI configuration must save a plaintext WebUI key that can authenticate with the management interface".to_string());
     }
@@ -116,9 +113,7 @@ pub(crate) fn generate_management_secret_key() -> Result<String, String> {
 
 pub(crate) fn management_secret_requires_rotation(secret_key: &str) -> bool {
     let secret_key = secret_key.trim();
-    secret_key.is_empty()
-        || secret_key == LEGACY_DEFAULT_MANAGEMENT_SECRET_KEY
-        || is_hashed_management_secret_key(secret_key)
+    secret_key.is_empty() || is_hashed_management_secret_key(secret_key)
 }
 
 pub(crate) fn ensure_strong_management_secret(config: &mut GuiConfigFile) -> Result<bool, String> {

src-tauri/src/main.rs

@@ -911,7 +911,7 @@ impl Default for GuiConfigFile {
             auth_dir: DEFAULT_AUTH_DIR.to_string(),
             api_keys: vec![default_api_key_entry()],
             api_access_remarks: Vec::new(),
-            management_secret_key: String::new(),
+            management_secret_key: LEGACY_DEFAULT_MANAGEMENT_SECRET_KEY.to_string(),
             debug: false,
             commercial_mode: false,
             logging_to_file: false,

src-tauri/src/tests/core_config.rs

@@ -109,30 +109,40 @@ fn webui_management_secret_requires_a_non_empty_plaintext_value() {
     )
     .is_err());
     assert!(normalize_management_secret_key("bad\nsecret".to_string()).is_err());
-    assert!(normalize_management_secret_key("123456".to_string()).is_err());
+    assert_eq!(
+        normalize_management_secret_key("  123456  ".to_string()).unwrap(),
+        "123456"
+    );
 }
 
 #[test]
-fn management_secret_rotation_replaces_legacy_values_and_preserves_custom_values() {
-    let mut fresh = GuiConfigFile::default();
-    assert!(ensure_strong_management_secret(&mut fresh).unwrap());
-    assert!(fresh.management_secret_key.starts_with("wui-Aa9_"));
-    assert!(fresh.management_secret_key.len() >= 50);
+fn management_secret_rotation_replaces_empty_values_and_preserves_custom_values() {
+    let fresh = GuiConfigFile::default();
+    assert_eq!(
+        fresh.management_secret_key,
+        LEGACY_DEFAULT_MANAGEMENT_SECRET_KEY
+    );
     assert!(!management_secret_requires_rotation(
         &fresh.management_secret_key
     ));
 
-    let first_generated = fresh.management_secret_key.clone();
+    let mut empty = GuiConfigFile {
+        management_secret_key: String::new(),
+        ..GuiConfigFile::default()
+    };
+    assert!(ensure_strong_management_secret(&mut empty).unwrap());
+    assert!(empty.management_secret_key.starts_with("wui-Aa9_"));
+    assert!(empty.management_secret_key.len() >= 50);
+
     let mut legacy = GuiConfigFile {
         management_secret_key: LEGACY_DEFAULT_MANAGEMENT_SECRET_KEY.to_string(),
         ..GuiConfigFile::default()
     };
-    assert!(ensure_strong_management_secret(&mut legacy).unwrap());
-    assert_ne!(
+    assert!(!ensure_strong_management_secret(&mut legacy).unwrap());
+    assert_eq!(
         legacy.management_secret_key,
         LEGACY_DEFAULT_MANAGEMENT_SECRET_KEY
     );
-    assert_ne!(legacy.management_secret_key, first_generated);
 
     let mut hashed = GuiConfigFile {
         management_secret_key: "$2a$10$abcdefghijklmnopqrstuuuuuuuuuuuuuuuuuuuuuuuuuuuuu"

src/i18n/ja.ts

@@ -760,7 +760,6 @@ export const jaOverrides = {
   'config.webuiKey.save': 'キーを保存',
   'config.webuiKey.open': 'WebUI を開く',
   'config.webuiKey.error.empty': 'WebUI キーを入力してください',
-  'config.webuiKey.error.legacyDefault': '旧版の既定キー 123456 は使用できません',
   'config.webuiKey.error.tooLong': 'WebUI キーは 512 文字以内で入力してください',
   'config.webuiKey.error.invalid': 'WebUI キーに制御文字は使用できません',
   'config.webuiKey.error.mismatch': '入力した WebUI キーが一致しません',

src/i18n/locales/en.ts

@@ -791,7 +791,6 @@ export const en: Record<MessageKey, string> = {
   'config.webuiKey.save': 'Save key',
   'config.webuiKey.open': 'Open WebUI',
   'config.webuiKey.error.empty': 'The WebUI key cannot be empty',
-  'config.webuiKey.error.legacyDefault': 'The legacy default key 123456 is no longer allowed',
   'config.webuiKey.error.tooLong': 'The WebUI key cannot exceed 512 characters',
   'config.webuiKey.error.invalid': 'The WebUI key cannot contain control characters',
   'config.webuiKey.error.mismatch': 'The WebUI keys do not match',

src/i18n/locales/zh-CN.ts

@@ -790,7 +790,6 @@ export const zhCN = {
   'config.webuiKey.save': '保存密钥',
   'config.webuiKey.open': '打开 WebUI',
   'config.webuiKey.error.empty': 'WebUI 密钥不能为空',
-  'config.webuiKey.error.legacyDefault': '不能继续使用旧版默认密钥 123456',
   'config.webuiKey.error.tooLong': 'WebUI 密钥不能超过 512 个字符',
   'config.webuiKey.error.invalid': 'WebUI 密钥不能包含控制字符',
   'config.webuiKey.error.mismatch': '两次输入的 WebUI 密钥不一致',

src/pages/ConfigPanel.tsx

@@ -438,10 +438,6 @@ export function ConfigPanelPage() {
       setManagementSecretError(t('config.webuiKey.error.empty'));
       return;
     }
-    if (secretKey === '123456') {
-      setManagementSecretError(t('config.webuiKey.error.legacyDefault'));
-      return;
-    }
     if (secretKey.length > 512) {
       setManagementSecretError(t('config.webuiKey.error.tooLong'));
       return;