Fix update of asset profiles not owned by user

apps/api/src/app/activities/activities.service.spec.ts

@@ -546,9 +546,26 @@ describe('ActivitiesService', () => {
       expect(data).not.toHaveProperty('SymbolProfile');
     });
 
+    it('does not update the asset profile of a data provider', async () => {
+      const data = await getUpdatedActivityData({
+        dataSource: DataSource.YAHOO,
+        symbol: 'AAPL',
+        type: ActivityType.FEE,
+        userId: null
+      });
+
+      expect(data).not.toHaveProperty('SymbolProfile');
+    });
+
     async function getUpdatedActivityData({
+      dataSource = DataSource.MANUAL,
+      symbol = 'GF_GOLD',
+      type = ActivityType.BUY,
       userId
     }: {
+      dataSource?: DataSource;
+      symbol?: string;
+      type?: ActivityType;
       userId: string | null;
     }) {
       const update = jest.fn().mockResolvedValue({ userId: 'user-id' });
@@ -577,23 +594,23 @@ describe('ActivitiesService', () => {
 
       await service.updateActivity({
         data: {
+          type,
           assetClass: AssetClass.COMMODITY,
           assetSubClass: AssetSubClass.PRECIOUS_METAL,
           date: parseDate('2024-01-01'),
           SymbolProfile: {
             connect: {
               dataSource_symbol: {
-                dataSource: DataSource.MANUAL,
-                symbol: 'GF_GOLD'
+                dataSource,
+                symbol
               }
             },
             update: {
               assetClass: AssetClass.COMMODITY,
               assetSubClass: AssetSubClass.PRECIOUS_METAL,
-              name: 'GF_GOLD'
+              name: symbol
             }
-          },
-          type: 'BUY'
+          }
         },
         originalDate: parseDate('2024-01-01'),
         userId: 'user-id',

apps/api/src/app/activities/activities.service.ts

@@ -939,17 +939,12 @@ export class ActivitiesService {
         where
       });
 
-      // Update the asset profile only if it is a custom asset profile of the
-      // user, but not one of the admin, of a data provider or of another user
       if (activityToUpdate?.SymbolProfile.userId === userId) {
         data.SymbolProfile.update = {
           data: {
             assetClass: data.assetClass,
             assetSubClass: data.assetSubClass
           },
-          // Filter by the user again, so that a concurrent request which
-          // links the activity to a different asset profile cannot bypass
-          // the check
           where: { userId }
         };
       } else {