fix(api): return engine groups by copy

Co-Authored-By: Virgil <virgil@lethean.io>

api.go

@@ -65,9 +65,9 @@ func (e *Engine) Addr() string {
 	return e.addr
 }
 
-// Groups returns all registered route groups.
+// Groups returns a copy of all registered route groups.
 func (e *Engine) Groups() []RouteGroup {
-	return e.groups
+	return slices.Clone(e.groups)
 }
 
 // GroupsIter returns an iterator over all registered route groups.

api_test.go

@@ -95,6 +95,28 @@ func TestRegister_Good_MultipleGroups(t *testing.T) {
 	}
 }
 
+func TestRegister_Good_GroupsReturnsCopy(t *testing.T) {
+	e, _ := api.New()
+	first := &healthGroup{}
+	second := &stubGroup{}
+	e.Register(first)
+	e.Register(second)
+
+	groups := e.Groups()
+	groups[0] = nil
+
+	fresh := e.Groups()
+	if fresh[0] == nil {
+		t.Fatal("expected Groups to return a copy, but engine state was mutated")
+	}
+	if fresh[0].Name() != first.Name() {
+		t.Fatalf("expected first group name %q, got %q", first.Name(), fresh[0].Name())
+	}
+	if fresh[1].Name() != "stub" {
+		t.Fatalf("expected second group name %q, got %q", "stub", fresh[1].Name())
+	}
+}
+
 // ── Handler ─────────────────────────────────────────────────────────────
 
 func TestHandler_Good_HealthEndpoint(t *testing.T) {