Repository: kestra-io/kestra (java)

Issue:
Secret function never fails even with non existing properties being entered
### Describe the issue

to reproduce, type: `{{ secret('NON_EXISTING', errorOnMissing=false, badProp=true, mynr=42, anotherProp='hello there from debugging window') }}`


![image](https://github.com/user-attachments/assets/b33b6e15-11bc-4289-8614-362672bbc233)

test the secret function fallback in case of empty in a flow, there is a regex parser to detect if a secret is used in eval and just replaced by "*" instead of evaluating it:
![image](https://github.com/user-attachments/assets/20206384-78f6-4941-8558-1c7b3e121c1b)


### Environment

- Kestra Version: develop


Pull request:
fix(webserver): first eval without masking secret function to error in case of missing secret
closes #8094


Patch:
diff --git a/webserver/src/main/java/io/kestra/webserver/controllers/api/ExecutionController.java b/webserver/src/main/java/io/kestra/webserver/controllers/api/ExecutionController.java
index 6959b0258..a30550511 100644
--- a/webserver/src/main/java/io/kestra/webserver/controllers/api/ExecutionController.java
+++ b/webserver/src/main/java/io/kestra/webserver/controllers/api/ExecutionController.java
@@ -309,6 +309,8 @@ public class ExecutionController {
 
     private String runContextRender(Flow flow, Task task, Execution execution, TaskRun taskRun, String expression) throws IllegalVariableEvaluationException {
         RunContext runContext = runContextFactory.of(flow, task, execution, taskRun, false);
+        String baseRender = runContext.render(expression);
+
         if (expression.contains("{")) { // fast backoff from regex
             Matcher matcher = SECRET_FUNCTION.matcher(expression);
             String maskedExpression = expression;
@@ -318,7 +320,8 @@ public class ExecutionController {
             }
             return runContext.render(maskedExpression);
         }
-        return runContext.render(expression);
+
+        return baseRender;
     }
 
     @SuperBuilder


Test patch:
diff --git a/webserver/src/test/java/io/kestra/webserver/controllers/api/ExecutionControllerRunnerTest.java b/webserver/src/test/java/io/kestra/webserver/controllers/api/ExecutionControllerRunnerTest.java
index 91522e789..5aa2ab9e9 100644
--- a/webserver/src/test/java/io/kestra/webserver/controllers/api/ExecutionControllerRunnerTest.java
+++ b/webserver/src/test/java/io/kestra/webserver/controllers/api/ExecutionControllerRunnerTest.java
@@ -1488,11 +1488,23 @@ class ExecutionControllerRunnerTest {
     void shouldMaskSecretWhenEvalPebbleExpression(Execution execution) {
         ExecutionController.EvalResult evalResult = client.toBlocking().retrieve(
             HttpRequest
-                .POST("/api/v1/executions/" + execution.getId() + "/eval/" + execution.getTaskRunList().getFirst().getId(), "{{ secret('KEY') }}")
+                .POST("/api/v1/executions/" + execution.getId() + "/eval/" + execution.getTaskRunList().getFirst().getId(), "{{ secret('MY_SECRET') }}")
                 .contentType(MediaType.TEXT_PLAIN),
             ExecutionController.EvalResult.class
         );
+        assertThat(evalResult.getError(), nullValue());
+        assertThat(evalResult.getStackTrace(), nullValue());
         assertThat(evalResult.getResult(), is("******"));
+
+        evalResult = client.toBlocking().retrieve(
+            HttpRequest
+                .POST("/api/v1/executions/" + execution.getId() + "/eval/" + execution.getTaskRunList().getFirst().getId(), "{{ secret('NON_EXISTING_KEY') }}")
+                .contentType(MediaType.TEXT_PLAIN),
+            ExecutionController.EvalResult.class
+        );
+        assertThat(evalResult.getError(), is("io.pebbletemplates.pebble.error.PebbleException: Cannot find secret for key 'NON_EXISTING_KEY'. ({{ secret('NON_EXISTING_KEY') }}:1)"));
+        assertThat(evalResult.getStackTrace(), startsWith("io.kestra.core.exceptions.IllegalVariableEvaluationException: io.pebbletemplates.pebble.error.PebbleException: Cannot find secret for key 'NON_EXISTING_KEY'. ({{ secret('NON_EXISTING_KEY') }}:1)"));
+        assertThat(evalResult.getResult(), is(nullValue()));
     }
 
     private ExecutionController.EvalResult eval(Execution execution, String expression, int index) {