From 0c4f884b745a8b190d83056d5101c0232eb60cb1 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Sat, 29 Aug 2026 09:11:00 +0200
Subject: [PATCH] Fix redaction of asset profile in restricted views

---
 apps/api/src/helper/object.helper.spec.ts | 114 ++++++++++++++++++++++
 libs/common/src/lib/config.ts             |   4 +
 2 files changed, 118 insertions(+)

diff --git a/apps/api/src/helper/object.helper.spec.ts b/apps/api/src/helper/object.helper.spec.ts
index a28afb15c..415851a6c 100644
--- a/apps/api/src/helper/object.helper.spec.ts
+++ b/apps/api/src/helper/object.helper.spec.ts
@@ -3049,7 +3049,14 @@ describe('redactAttributes', () => {
             name: 'Interactive Brokers Account'
           },
           assetProfile: {
+            comment: 'Reviewed by the administrator',
             name: 'Apple Inc',
+            scraperConfiguration: {
+              headers: { Authorization: 'Bearer TOKEN' },
+              mode: 'lazy',
+              selector: '.price',
+              url: 'https://example.org/get_price'
+            },
             symbol: 'AAPL',
             symbolMapping: { YAHOO: 'AAPL' },
             watchedByCount: 7
@@ -3076,7 +3083,9 @@ describe('redactAttributes', () => {
         name: 'Interactive Brokers Account'
       },
       assetProfile: {
+        comment: null,
         name: 'Apple Inc',
+        scraperConfiguration: null,
         symbol: 'AAPL',
         symbolMapping: null,
         watchedByCount: null
@@ -3123,4 +3132,109 @@ describe('redactAttributes', () => {
       unitPrice: 220.79
     });
   });
+
+  it('should redact the activities of a response', () => {
+    expect(
+      redactPaths({
+        object: {
+          activities: [
+            {
+              assetProfile: {
+                comment: 'Reviewed by the administrator',
+                name: 'Apple Inc',
+                scraperConfiguration: {
+                  headers: { Authorization: 'Bearer TOKEN' },
+                  mode: 'lazy',
+                  selector: '.price',
+                  url: 'https://example.org/get_price'
+                },
+                symbol: 'AAPL',
+                symbolMapping: { YAHOO: 'AAPL' },
+                watchedByCount: 7
+              },
+              comment: 'Bought on a dip',
+              currency: 'USD',
+              fee: 19.9,
+              quantity: 50,
+              type: 'BUY',
+              unitPrice: 220.79,
+              value: 11039.5,
+              valueInBaseCurrency: 10123.4
+            }
+          ],
+          count: 1
+        },
+        paths: DEFAULT_REDACTED_PATHS
+      })
+    ).toStrictEqual({
+      activities: [
+        {
+          assetProfile: {
+            comment: null,
+            name: 'Apple Inc',
+            scraperConfiguration: null,
+            symbol: 'AAPL',
+            symbolMapping: null,
+            watchedByCount: null
+          },
+          comment: null,
+          currency: 'USD',
+          fee: null,
+          quantity: null,
+          type: 'BUY',
+          unitPrice: 220.79,
+          value: null,
+          valueInBaseCurrency: null
+        }
+      ],
+      count: 1
+    });
+  });
+
+  it('should redact the latest activities of a public portfolio', () => {
+    expect(
+      redactPaths({
+        object: {
+          latestActivities: [
+            {
+              assetProfile: {
+                currency: 'USD',
+                dataSource: 'YAHOO',
+                name: 'Apple Inc',
+                symbol: 'AAPL'
+              },
+              currency: 'USD',
+              date: '2021-11-30T23:00:00.000Z',
+              fee: 19.9,
+              quantity: 50,
+              type: 'BUY',
+              unitPrice: 220.79,
+              value: 11039.5,
+              valueInBaseCurrency: 10123.4
+            }
+          ]
+        },
+        paths: DEFAULT_REDACTED_PATHS
+      })
+    ).toStrictEqual({
+      latestActivities: [
+        {
+          assetProfile: {
+            currency: 'USD',
+            dataSource: 'YAHOO',
+            name: 'Apple Inc',
+            symbol: 'AAPL'
+          },
+          currency: 'USD',
+          date: '2021-11-30T23:00:00.000Z',
+          fee: null,
+          quantity: null,
+          type: 'BUY',
+          unitPrice: 220.79,
+          value: null,
+          valueInBaseCurrency: null
+        }
+      ]
+    });
+  });
 });
diff --git a/libs/common/src/lib/config.ts b/libs/common/src/lib/config.ts
index 4513c175f..8946d986c 100644
--- a/libs/common/src/lib/config.ts
+++ b/libs/common/src/lib/config.ts
@@ -122,6 +122,8 @@ export const DEFAULT_REDACTED_PATHS = [
   'accounts[*].value',
   'accounts[*].valueInBaseCurrency',
   'activities[*].account.comment',
+  'activities[*].assetProfile.comment',
+  'activities[*].assetProfile.scraperConfiguration',
   'activities[*].assetProfile.symbolMapping',
   'activities[*].assetProfile.watchedByCount',
   'activities[*].comment',
@@ -131,6 +133,8 @@ export const DEFAULT_REDACTED_PATHS = [
   'activities[*].quantity',
   'activities[*].value',
   'activities[*].valueInBaseCurrency',
+  'assetProfile.comment',
+  'assetProfile.scraperConfiguration',
   'assetProfile.symbolMapping',
   'assetProfile.watchedByCount',
   'balance',