From 00c37f026cc1c609d69579c9bc10ffcc9722c097 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Mon, 13 Jul 2026 21:30:58 +0200
Subject: [PATCH] Task/harden validation of scraper configuration in asset
 profile endpoint (#7322)

* Harden validation of scraper configuration

* Update changelog
---
 CHANGELOG.md                                  |  1 +
 libs/common/src/lib/dtos/index.ts             |  2 ++
 .../src/lib/dtos/scraper-configuration.dto.ts | 35 +++++++++++++++++++
 .../src/lib/dtos/update-asset-profile.dto.ts  |  3 ++
 4 files changed, 41 insertions(+)
 create mode 100644 libs/common/src/lib/dtos/scraper-configuration.dto.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 85df11fdb..a0a652c44 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Hardened the validation of the countries in the asset profile endpoints
 - Hardened the validation of the holdings in the asset profile endpoints
+- Hardened the validation of the scraper configuration in the asset profile endpoint
 - Hardened the validation of the sectors in the asset profile endpoints
 - Rounded the value of the _Fear & Greed Index_ (market mood) in the twitter bot service
 - Set the change detection strategy to `OnPush` in the _X-ray_ page
diff --git a/libs/common/src/lib/dtos/index.ts b/libs/common/src/lib/dtos/index.ts
index c531313a6..785115356 100644
--- a/libs/common/src/lib/dtos/index.ts
+++ b/libs/common/src/lib/dtos/index.ts
@@ -12,6 +12,7 @@ import { CreateTagDto } from './create-tag.dto';
 import { CreateWatchlistItemDto } from './create-watchlist-item.dto';
 import { DeleteOwnUserDto } from './delete-own-user.dto';
 import { HoldingDto } from './holding.dto';
+import { ScraperConfigurationDto } from './scraper-configuration.dto';
 import { SectorDto } from './sector.dto';
 import { TransferBalanceDto } from './transfer-balance.dto';
 import { UpdateAccessDto } from './update-access.dto';
@@ -42,6 +43,7 @@ export {
   CreateWatchlistItemDto,
   DeleteOwnUserDto,
   HoldingDto,
+  ScraperConfigurationDto,
   SectorDto,
   TransferBalanceDto,
   UpdateAccessDto,
diff --git a/libs/common/src/lib/dtos/scraper-configuration.dto.ts b/libs/common/src/lib/dtos/scraper-configuration.dto.ts
new file mode 100644
index 000000000..52cadb80c
--- /dev/null
+++ b/libs/common/src/lib/dtos/scraper-configuration.dto.ts
@@ -0,0 +1,35 @@
+import {
+  IsIn,
+  IsNumber,
+  IsObject,
+  IsOptional,
+  IsString,
+  IsUrl
+} from 'class-validator';
+
+export class ScraperConfigurationDto {
+  @IsNumber()
+  @IsOptional()
+  defaultMarketPrice?: number;
+
+  @IsObject()
+  @IsOptional()
+  headers?: { [key: string]: string };
+
+  @IsOptional()
+  @IsString()
+  locale?: string;
+
+  @IsIn(['instant', 'lazy'])
+  @IsOptional()
+  mode?: 'instant' | 'lazy';
+
+  @IsString()
+  selector: string;
+
+  @IsUrl({
+    protocols: ['http', 'https'],
+    require_protocol: true
+  })
+  url: string;
+}
diff --git a/libs/common/src/lib/dtos/update-asset-profile.dto.ts b/libs/common/src/lib/dtos/update-asset-profile.dto.ts
index 2204fd0ab..a6e2230e8 100644
--- a/libs/common/src/lib/dtos/update-asset-profile.dto.ts
+++ b/libs/common/src/lib/dtos/update-asset-profile.dto.ts
@@ -21,6 +21,7 @@ import {
 
 import { CountryDto } from './country.dto';
 import { HoldingDto } from './holding.dto';
+import { ScraperConfigurationDto } from './scraper-configuration.dto';
 import { SectorDto } from './sector.dto';
 
 export class UpdateAssetProfileDto {
@@ -70,6 +71,8 @@ export class UpdateAssetProfileDto {
 
   @IsObject()
   @IsOptional()
+  @Type(() => ScraperConfigurationDto)
+  @ValidateNested()
   scraperConfiguration?: Prisma.InputJsonObject;
 
   @IsArray()