Shielding Svelte Configuration Payloads with Null-Prototype Objects and Immutable Symbols

import { writable } from 'svelte/store';
 
const SECRET_KEY = Symbol('config.auth.key');
 
export function createSecureConfigStore(rawConfig) {
  const sanitizedConfig = Object.assign(Object.create(null), rawConfig);
  sanitizedConfig[SECRET_KEY] = crypto.randomUUID();
  
  const { subscribe, set } = writable(Object.freeze(sanitizedConfig));
  
  return {
    subscribe,
    updateKey: (accessSymbol, newConfig) => {
      if (accessSymbol !== SECRET_KEY) throw new Error('Unauthorized');
      const updated = Object.assign(Object.create(null), newConfig);
      updated[SECRET_KEY] = sanitizedConfig[SECRET_KEY];
      set(Object.freeze(updated));
    }
  };
}