From 13f97ca5c72eeb1e2edd5f9b7d881f48ef4a0843 Mon Sep 17 00:00:00 2001
From: Prateek Surana <prateeksurana3255@gmail.com>
Date: Fri, 9 Feb 2024 12:44:54 +0530
Subject: [PATCH] Hide protected config

---
 .../webserver/api/core/CoreConfigListAPI.java | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/src/main/java/io/supertokens/webserver/api/core/CoreConfigListAPI.java b/src/main/java/io/supertokens/webserver/api/core/CoreConfigListAPI.java
index e0dc3a3fc..db097f8d6 100644
--- a/src/main/java/io/supertokens/webserver/api/core/CoreConfigListAPI.java
+++ b/src/main/java/io/supertokens/webserver/api/core/CoreConfigListAPI.java
@@ -17,16 +17,19 @@
 package io.supertokens.webserver.api.core;
 
 import com.google.gson.JsonArray;
+import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
 
 import io.supertokens.Main;
 import io.supertokens.config.CoreConfig;
+import io.supertokens.storageLayer.StorageLayer;
 import io.supertokens.webserver.WebserverAPI;
 
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
+import java.util.Arrays;
 
 public class CoreConfigListAPI extends WebserverAPI {
     private static final long serialVersionUID = -4641988458637882374L;
@@ -49,6 +52,23 @@ protected boolean checkAPIKey(HttpServletRequest req) {
     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException, ServletException {
         JsonArray config = CoreConfig.getConfigFieldsJson(main);
         JsonObject result = new JsonObject();
+
+        try {
+            if (shouldProtectProtectedConfig(req)) {
+                JsonArray configWithouProtectedFields = new JsonArray();
+                String[] protectedFields = StorageLayer.getBaseStorage(main)
+                        .getProtectedConfigsFromSuperTokensSaaSUsers();
+                for (JsonElement field : config) {
+                    String fieldName = field.getAsJsonObject().get("name").getAsString();
+                    if (!Arrays.asList(protectedFields).contains(fieldName)) {
+                        configWithouProtectedFields.add(field);
+                    }
+                }
+                config = configWithouProtectedFields;
+            }
+        } catch (Exception e) {
+        }
+
         result.addProperty("status", "OK");
         result.add("config", config);
         super.sendJsonResponse(200, result, resp);