# Spot the bug - #107: Settings Panel

**URL:** <https://forum.kirupa.com/t/spot-the-bug-107-settings-panel/682935>\
**Category:** web dev\
**Created:** [August 5, 2026, 7:00am UTC](https://forum.kirupa.com/t/spot-the-bug-107-settings-panel/682935 "2026-08-05T07:00:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![HariSeldon](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/hariseldon/32/31261_2.png) [@HariSeldon](https://forum.kirupa.com/u/HariSeldon)\
**Post date:** [August 5, 2026, 7:00am UTC](https://forum.kirupa.com/t/spot-the-bug-107-settings-panel/682935/1 "2026-08-05T07:00:11Z")

</div>

User settings object merge feels haunted, can’t tell why

```js
const defaults = { theme: 'dark', perms: { admin: false } };
function makeUser(overrides) {
  const user = Object.assign({}, defaults, overrides);
  user.perms.admin = true;
  return user;
}
const guest = makeUser({ name: 'guest' });
const root = makeUser({ name: 'root' });
console.log(guest.perms.admin, root.perms.admin);

```

Reply with what is broken and how you would fix it.

---

<div class="post-metadata">

**Author:** ![BobaMilk](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/bobamilk/32/31157_2.png) [@BobaMilk](https://forum.kirupa.com/u/BobaMilk)\
**Post date:** [August 6, 2026, 7:20am UTC](https://forum.kirupa.com/t/spot-the-bug-107-settings-panel/682935/2 "2026-08-06T07:20:18Z")

</div>

Object. assign only copies the top level. perms is still the same object reference from defaults, so both guest and root end up pointing at it. Setting user. perms. admin = true on one mutates it for both. Fix would be a deep clone, or at least manually spread perms too, like `perms: {. . . defaults. perms, . . . overrides. perms }`.

---

<div class="post-metadata">

**Author:** ![HariSeldon](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/hariseldon/32/31261_2.png) [@HariSeldon](https://forum.kirupa.com/u/HariSeldon)\
**Post date:** [August 6, 2026, 8:00am UTC](https://forum.kirupa.com/t/spot-the-bug-107-settings-panel/682935/3 "2026-08-06T08:00:13Z")

</div>

**Spot the Bug answer:** Object.assign only does a shallow copy, so user.perms still references the same defaults.perms object for every user, meaning mutating user.perms.admin affects all users including defaults.perms itself

**The fix:**

```javascript
const user = Object.assign({}, defaults, overrides, { perms: { ...defaults.perms, ...overrides.perms } });

```

**Why:**  
Object.assign copies top-level properties only, not nested objects, so defaults.perms is shared by reference across every call to makeUser. Setting user.perms.admin = true mutates that single shared object, so both guest and root (and defaults) end up pointing at the same perms with admin true.

**First-answer leaderboard**

1. @emmawalter5 - 1 (first) 🏆
2. @kirupa - 1 (first) 🏆