From 2533a928737028798fd8b271e9e80200b611625e Mon Sep 17 00:00:00 2001
From: forehalo <forehalo@gmail.com>
Date: Thu, 3 Apr 2025 12:57:29 +0000
Subject: [PATCH] chore(server): avoid config object been modified (#11452)

---
 .docker/selfhost/schema.json                        |  2 +-
 .../server/src/base/config/__tests__/config.spec.ts | 11 +++++++++++
 packages/backend/server/src/base/config/factory.ts  | 13 ++++++++-----
 .../backend/server/src/plugins/payment/config.ts    |  2 +-
 packages/frontend/admin/src/config.json             |  2 +-
 5 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/.docker/selfhost/schema.json b/.docker/selfhost/schema.json
index fd61542d1..b66928626 100644
--- a/.docker/selfhost/schema.json
+++ b/.docker/selfhost/schema.json
@@ -866,7 +866,7 @@
         },
         "stripe": {
           "type": "object",
-          "description": "Stripe API keys\n@default {}\n@link https://docs.stripe.com/api",
+          "description": "Stripe sdk options\n@default {}\n@link https://docs.stripe.com/api",
           "default": {}
         }
       }
diff --git a/packages/backend/server/src/base/config/__tests__/config.spec.ts b/packages/backend/server/src/base/config/__tests__/config.spec.ts
index 20001c4b7..c90dfe9cb 100644
--- a/packages/backend/server/src/base/config/__tests__/config.spec.ts
+++ b/packages/backend/server/src/base/config/__tests__/config.spec.ts
@@ -174,3 +174,14 @@ test('should override correctly', t => {
     },
   });
 });
+
+test('should clone from original config without modifications', t => {
+  const config = module.get(Config);
+  const configFactory = module.get(ConfigFactory);
+
+  config.auth.allowSignup = !config.auth.allowSignup;
+
+  const newConfig = configFactory.clone();
+
+  t.not(newConfig.auth.allowSignup, config.auth.allowSignup);
+});
diff --git a/packages/backend/server/src/base/config/factory.ts b/packages/backend/server/src/base/config/factory.ts
index 82f2673d2..2443f13bc 100644
--- a/packages/backend/server/src/base/config/factory.ts
+++ b/packages/backend/server/src/base/config/factory.ts
@@ -7,7 +7,11 @@ export const OVERRIDE_CONFIG_TOKEN = Symbol('OVERRIDE_CONFIG_TOKEN');
 
 @Injectable()
 export class ConfigFactory {
+  #original: AppConfig;
   readonly #config: AppConfig;
+  get config() {
+    return this.#config;
+  }
 
   constructor(
     @Inject(OVERRIDE_CONFIG_TOKEN)
@@ -15,18 +19,17 @@ export class ConfigFactory {
     private readonly overrides: DeepPartial<AppConfig> = {}
   ) {
     this.#config = this.loadDefault();
-  }
-
-  get config() {
-    return this.#config;
+    this.#original = structuredClone(this.#config);
   }
 
   clone() {
-    return structuredClone(this.#config);
+    // we did not freeze the #config object, it might be modified
+    return structuredClone(this.#original);
   }
 
   override(updates: DeepPartial<AppConfig>) {
     override(this.#config, updates);
+    this.#original = structuredClone(this.#config);
   }
 
   validate(updates: Array<{ module: string; key: string; value: any }>) {
diff --git a/packages/backend/server/src/plugins/payment/config.ts b/packages/backend/server/src/plugins/payment/config.ts
index 90abc672d..e234d4cfc 100644
--- a/packages/backend/server/src/plugins/payment/config.ts
+++ b/packages/backend/server/src/plugins/payment/config.ts
@@ -47,7 +47,7 @@ defineModuleConfig('payment', {
     env: 'STRIPE_WEBHOOK_KEY',
   },
   stripe: {
-    desc: 'Stripe API keys',
+    desc: 'Stripe sdk options',
     default: {},
     link: 'https://docs.stripe.com/api',
   },
diff --git a/packages/frontend/admin/src/config.json b/packages/frontend/admin/src/config.json
index 0da788480..c2be4bc64 100644
--- a/packages/frontend/admin/src/config.json
+++ b/packages/frontend/admin/src/config.json
@@ -293,7 +293,7 @@
     },
     "stripe": {
       "type": "Object",
-      "desc": "Stripe API keys",
+      "desc": "Stripe sdk options",
       "link": "https://docs.stripe.com/api"
     }
   },