refactor: obfuscated pincode in transit

apps/server/src/api-data/settings/settings.controller.ts

@@ -6,10 +6,20 @@ import { DataProvider } from '../../classes/data-provider/DataProvider.js';
 import { failEmptyObjects } from '../../utils/routerUtils.js';
 import { extractPin } from '../../services/project-service/ProjectService.js';
 import { isDocker } from '../../setup/index.js';
+import { obfuscate } from 'ontime-utils';
 
 export async function getSettings(_req: Request, res: Response<Settings>) {
   const settings = DataProvider.getSettings();
-  res.status(200).send(settings);
+  const obfuscatedSettings = { ...settings };
+  if (settings.editorKey) {
+    obfuscatedSettings.editorKey = obfuscate(settings.editorKey);
+  }
+
+  if (settings.operatorKey) {
+    obfuscatedSettings.editorKey = obfuscate(settings.editorKey);
+  }
+
+  res.status(200).send(obfuscatedSettings);
 }
 
 export async function postSettings(req: Request, res: Response<Settings | ErrorResponse>) {

apps/server/src/classes/data-provider/DataProvider.ts

@@ -48,7 +48,7 @@ export class DataProvider {
     await this.persist();
   }
 
-  static getSettings(): Settings {
+  static getSettings(): Readonly<Settings> {
     return data.settings;
   }