fix: prevent plugin config leak to non-admin users

app/api/admin/plugins/[id]/config/route.ts

@@ -51,15 +51,20 @@ export async function GET(
 
     const config = await getPluginConfig(id);
 
-    let response: Record<string, unknown> = config;
+    let response: Record<string, unknown>;
-    if (!isAdmin && plugin.configSchema) {
+    if (isAdmin) {
+      response = config;
+    } else {
       response = {};
+      const schema = plugin.configSchema;
+      if (schema) {
         for (const [key, value] of Object.entries(config)) {
-        const field = plugin.configSchema[key];
+          const field = schema[key];
-        if (field?.type === 'secret') continue;
+          if (!field || field.type === 'secret') continue;
           response[key] = value;
         }
       }
+    }
 
     return NextResponse.json(response, {
       headers: { 'Cache-Control': 'no-store' },
@@ -110,6 +115,13 @@ export async function PUT(
       return NextResponse.json({ error: 'Invalid key format' }, { status: 400 });
     }
 
+    if (plugin.configSchema && !plugin.configSchema[body.key]) {
+      return NextResponse.json(
+        { error: 'Key is not declared in the plugin configSchema' },
+        { status: 400 },
+      );
+    }
+
     await setPluginConfig(id, body.key, body.value);
     return NextResponse.json({ ok: true });
   } catch {