chore(server): avoid config object been modified (#11452)

.docker/selfhost/schema.json

@@ -866,7 +866,7 @@
         },
         "stripe": {
           "type": "object",
-          "description": "Stripe API keys\n@default {}\n@link https://docs.stripe.com/api",
+          "description": "Stripe sdk options\n@default {}\n@link https://docs.stripe.com/api",
           "default": {}
         }
       }

packages/backend/server/src/base/config/__tests__/config.spec.ts

@@ -174,3 +174,14 @@ test('should override correctly', t => {
     },
   });
 });
+
+test('should clone from original config without modifications', t => {
+  const config = module.get(Config);
+  const configFactory = module.get(ConfigFactory);
+
+  config.auth.allowSignup = !config.auth.allowSignup;
+
+  const newConfig = configFactory.clone();
+
+  t.not(newConfig.auth.allowSignup, config.auth.allowSignup);
+});

packages/backend/server/src/base/config/factory.ts

@@ -7,7 +7,11 @@ export const OVERRIDE_CONFIG_TOKEN = Symbol('OVERRIDE_CONFIG_TOKEN');
 
 @Injectable()
 export class ConfigFactory {
+  #original: AppConfig;
   readonly #config: AppConfig;
+  get config() {
+    return this.#config;
+  }
 
   constructor(
     @Inject(OVERRIDE_CONFIG_TOKEN)
@@ -15,18 +19,17 @@ export class ConfigFactory {
     private readonly overrides: DeepPartial<AppConfig> = {}
   ) {
     this.#config = this.loadDefault();
-  }
+    this.#original = structuredClone(this.#config);
-
-  get config() {
-    return this.#config;
   }
 
   clone() {
-    return structuredClone(this.#config);
+    // we did not freeze the #config object, it might be modified
+    return structuredClone(this.#original);
   }
 
   override(updates: DeepPartial<AppConfig>) {
     override(this.#config, updates);
+    this.#original = structuredClone(this.#config);
   }
 
   validate(updates: Array<{ module: string; key: string; value: any }>) {

packages/backend/server/src/plugins/payment/config.ts

@@ -47,7 +47,7 @@ defineModuleConfig('payment', {
     env: 'STRIPE_WEBHOOK_KEY',
   },
   stripe: {
-    desc: 'Stripe API keys',
+    desc: 'Stripe sdk options',
     default: {},
     link: 'https://docs.stripe.com/api',
   },

packages/frontend/admin/src/config.json

@@ -293,7 +293,7 @@
     },
     "stripe": {
       "type": "Object",
-      "desc": "Stripe API keys",
+      "desc": "Stripe sdk options",
       "link": "https://docs.stripe.com/api"
     }
   },