Don't expose object refs in public APIs ya dummy!

Make sure to deep clone them input/output objects
to maintain immutability y'hear

2 files changed, 7 insertions, 5 deletions

diff --git a/app/node_modules/okschema/index.js b/app/node_modules/okschema/index.js
index 8871a99..4b215d1 100644
--- a/app/node_modules/okschema/index.js
+++ b/app/node_modules/okschema/index.js
@@ -1,4 +1,4 @@
-var assign = require('object-assign');
+var cloneDeep = require('lodash.clonedeep');
 var mschema = require('mschema');
 var v = require('validator');
 
@@ -68,7 +68,7 @@ function OKSchema(spec) {
   if (!(this instanceof OKSchema)) return new OKSchema(spec);
   if (!spec)
     throw new Error('No spec provided to OKSchema');
-  spec = assign({}, spec);
+  spec = cloneDeep(spec);
   // Cache the mschema version of our spec
   this._mschemaSpec = Object.keys(spec).reduce(function(cache, prop) {
     // If custom type, return its parent spec
@@ -83,8 +83,10 @@ function OKSchema(spec) {
   }, {});
 
   Object.defineProperty(this, 'spec', {
-    value: spec,
-    writable: false
+    get: function() {
+      return cloneDeep(spec);
+    },
+    enumerable: true
   });
 }
 
diff --git a/app/node_modules/okschema/package.json b/app/node_modules/okschema/package.json
index 21214fa..21a7c67 100644
--- a/app/node_modules/okschema/package.json
+++ b/app/node_modules/okschema/package.json
@@ -9,8 +9,8 @@
   "author": "OKFocus",
   "license": "None",
   "dependencies": {
+    "lodash.clonedeep": "^3.0.0",
     "mschema": "^0.5.5",
-    "object-assign": "^2.0.0",
     "validator": "^3.37.0"
   }
 }