refactor: config file saving and debugging

Reduce the number of dependencies and the amount of code running in a
security sensitive context.

Instead of a deep comparison, we just compare the serialized versions
of the config files.

Signed-off-by: Kristóf Marussy <kristof@marussy.com>

2 files changed, 53 insertions, 43 deletions

diff --git a/packages/main/src/reactions/__tests__/synchronizeConfig.spec.ts b/packages/main/src/reactions/__tests__/synchronizeConfig.spec.ts
index b5013ea..d3338d0 100644
--- a/packages/main/src/reactions/__tests__/synchronizeConfig.spec.ts
+++ b/packages/main/src/reactions/__tests__/synchronizeConfig.spec.ts
@@ -25,7 +25,7 @@ import type ConfigRepository from '../../infrastructure/config/ConfigRepository'
 import SharedStore from '../../stores/SharedStore';
 import type Disposer from '../../utils/Disposer';
 import { silenceLogger } from '../../utils/log';
-import synchronizeConfig from '../synchronizeConfig';
+import synchronizeConfig, { serializeConfig } from '../synchronizeConfig';
 
 let store: SharedStore;
 const repository: ConfigRepository = {
@@ -70,11 +70,11 @@ describe('when synchronizeializing', () => {
     beforeEach(() => {
       mocked(repository.readConfig).mockResolvedValueOnce({
         found: true,
-        data: {
+        contents: serializeConfig({
           // Use a default empty config file to not trigger config rewrite.
           ...store.config,
           themeSource: 'dark',
-        },
+        }),
       });
     });
 
@@ -97,12 +97,15 @@ describe('when synchronizeializing', () => {
   it('should update the config file if new details are added during read', async () => {
     mocked(repository.readConfig).mockResolvedValueOnce({
       found: true,
-      data: {
-        themeSource: 'light',
-        profile: {
-          name: 'Test profile',
-        },
-      },
+      contents: `{
+  "themeSource": "light",
+  "profiles": [
+    {
+      "name": "Test profile"
+    }
+  ]
+}
+`,
     });
     await synchronizeConfig(store, repository);
     expect(repository.writeConfig).toHaveBeenCalledTimes(1);
@@ -111,9 +114,10 @@ describe('when synchronizeializing', () => {
   it('should not apply an invalid config file but should not overwrite it', async () => {
     mocked(repository.readConfig).mockResolvedValueOnce({
       found: true,
-      data: {
-        themeSource: -1,
-      },
+      contents: `{
+  "themeSource": -1
+}
+`,
     });
     await synchronizeConfig(store, repository);
     expect(store.settings.themeSource).not.toBe(-1);
@@ -136,7 +140,7 @@ describe('when it has loaded the config', () => {
   beforeEach(async () => {
     mocked(repository.readConfig).mockResolvedValueOnce({
       found: true,
-      data: store.config,
+      contents: serializeConfig(store.config),
     });
     mocked(repository.watchConfig).mockReturnValueOnce(watcherDisposer);
     sutDisposer = await synchronizeConfig(store, repository, throttleMs);
@@ -163,11 +167,11 @@ describe('when it has loaded the config', () => {
   it('should read the config file when it has changed', async () => {
     mocked(repository.readConfig).mockResolvedValueOnce({
       found: true,
-      data: {
+      contents: serializeConfig({
         // Use a default empty config file to not trigger config rewrite.
         ...store.config,
         themeSource: 'dark',
-      },
+      }),
     });
     await configChangedCallback();
     // Do not write back the changes we have just read.
@@ -178,12 +182,15 @@ describe('when it has loaded the config', () => {
   it('should update the config file if new details are added', async () => {
     mocked(repository.readConfig).mockResolvedValueOnce({
       found: true,
-      data: {
-        themeSource: 'light',
-        profile: {
-          name: 'Test profile',
-        },
-      },
+      contents: `{
+  "themeSource": "light",
+  "profiles": [
+    {
+      "name": "Test profile"
+    }
+  ]
+}
+`,
     });
     await configChangedCallback();
     expect(repository.writeConfig).toHaveBeenCalledTimes(1);
@@ -192,9 +199,10 @@ describe('when it has loaded the config', () => {
   it('should not apply an invalid config file when it has changed but should not overwrite it', async () => {
     mocked(repository.readConfig).mockResolvedValueOnce({
       found: true,
-      data: {
-        themeSource: -1,
-      },
+      contents: `{
+  "themeSource": -1
+}
+`,
     });
     await configChangedCallback();
     expect(store.settings.themeSource).not.toBe(-1);
diff --git a/packages/main/src/reactions/synchronizeConfig.ts b/packages/main/src/reactions/synchronizeConfig.ts
index 7e366e2..247c2e2 100644
--- a/packages/main/src/reactions/synchronizeConfig.ts
+++ b/packages/main/src/reactions/synchronizeConfig.ts
@@ -18,7 +18,6 @@
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 
-import deepEqual from 'deep-equal';
 import { debounce } from 'lodash-es';
 import { reaction } from 'mobx';
 
@@ -32,36 +31,38 @@ const DEFAULT_CONFIG_DEBOUNCE_TIME_MS = 1000;
 
 const log = getLogger('synchronizeConfig');
 
+export function serializeConfig(config: Config): string {
+  return `${JSON.stringify(config, undefined, 2)}\n`;
+}
+
 export default async function synchronizeConfig(
   sharedStore: SharedStore,
   repository: ConfigRepository,
   debounceTime: number = DEFAULT_CONFIG_DEBOUNCE_TIME_MS,
 ): Promise<Disposer> {
-  let lastConfigOnDisk: Config | undefined;
+  let lastConfigOnDisk: string | undefined;
 
-  async function writeConfig(): Promise<void> {
-    const { config } = sharedStore;
-    await repository.writeConfig(config);
-    lastConfigOnDisk = config;
+  async function writeConfig(serializedConfig: string): Promise<void> {
+    await repository.writeConfig(serializedConfig);
+    lastConfigOnDisk = serializedConfig;
   }
 
   async function readConfig(): Promise<boolean> {
     const result = await repository.readConfig();
     if (result.found) {
+      const { contents } = result;
       try {
         // This cast is unsound if the config file is invalid,
         // but we'll throw an error in the end anyways.
-        sharedStore.loadConfig(result.data as Config);
+        const data = JSON.parse(contents) as Config;
+        sharedStore.loadConfig(data);
       } catch (error) {
-        log.error('Failed to apply config snapshot', result.data, error);
+        log.error('Failed to apply config snapshot', contents, error);
         return true;
       }
-      lastConfigOnDisk = sharedStore.config;
-      // We can't use `comparer.structural` from `mobx`, because
-      // it handles missing values and `undefined` values differently,
-      // but JSON is unable to distinguish them.
-      if (!deepEqual(result.data, lastConfigOnDisk, { strict: true })) {
-        await writeConfig();
+      lastConfigOnDisk = serializeConfig(sharedStore.config);
+      if (contents !== lastConfigOnDisk) {
+        await writeConfig(lastConfigOnDisk);
       }
     }
     return result.found;
@@ -69,16 +70,17 @@ export default async function synchronizeConfig(
 
   if (!(await readConfig())) {
     log.info('Config file was not found');
-    await writeConfig();
+    const serializedConfig = serializeConfig(sharedStore.config);
+    await writeConfig(serializedConfig);
     log.info('Created config file');
   }
 
   const disposeReaction = reaction(
     () => sharedStore.config,
-    debounce((config) => {
-      // We can compare snapshots by reference, since it is only recreated on store changes.
-      if (!deepEqual(config, lastConfigOnDisk, { strict: true })) {
-        writeConfig().catch((error) => {
+    debounce(() => {
+      const serializedConfig = serializeConfig(sharedStore.config);
+      if (serializedConfig !== lastConfigOnDisk) {
+        writeConfig(serializedConfig).catch((error) => {
           log.error('Failed to write config on config change', error);
         });
       }