From 1fe79941709b0ee38a534bc28f30a77d1178008c Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Mon, 12 Oct 2026 19:30:27 +0200
Subject: [PATCH] Fix update of asset profiles not owned by user

---
 .../app/activities/activities.service.spec.ts | 27 +++++++++++++++----
 .../src/app/activities/activities.service.ts  |  5 ----
 2 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/apps/api/src/app/activities/activities.service.spec.ts b/apps/api/src/app/activities/activities.service.spec.ts
index b828eef1ca..57bd8ab665 100644
--- a/apps/api/src/app/activities/activities.service.spec.ts
+++ b/apps/api/src/app/activities/activities.service.spec.ts
@@ -546,9 +546,26 @@ describe('ActivitiesService', () => {
       expect(data).not.toHaveProperty('SymbolProfile');
     });
 
+    it('does not update the asset profile of a data provider', async () => {
+      const data = await getUpdatedActivityData({
+        dataSource: DataSource.YAHOO,
+        symbol: 'AAPL',
+        type: ActivityType.FEE,
+        userId: null
+      });
+
+      expect(data).not.toHaveProperty('SymbolProfile');
+    });
+
     async function getUpdatedActivityData({
+      dataSource = DataSource.MANUAL,
+      symbol = 'GF_GOLD',
+      type = ActivityType.BUY,
       userId
     }: {
+      dataSource?: DataSource;
+      symbol?: string;
+      type?: ActivityType;
       userId: string | null;
     }) {
       const update = jest.fn().mockResolvedValue({ userId: 'user-id' });
@@ -577,23 +594,23 @@ describe('ActivitiesService', () => {
 
       await service.updateActivity({
         data: {
+          type,
           assetClass: AssetClass.COMMODITY,
           assetSubClass: AssetSubClass.PRECIOUS_METAL,
           date: parseDate('2024-01-01'),
           SymbolProfile: {
             connect: {
               dataSource_symbol: {
-                dataSource: DataSource.MANUAL,
-                symbol: 'GF_GOLD'
+                dataSource,
+                symbol
               }
             },
             update: {
               assetClass: AssetClass.COMMODITY,
               assetSubClass: AssetSubClass.PRECIOUS_METAL,
-              name: 'GF_GOLD'
+              name: symbol
             }
-          },
-          type: 'BUY'
+          }
         },
         originalDate: parseDate('2024-01-01'),
         userId: 'user-id',
diff --git a/apps/api/src/app/activities/activities.service.ts b/apps/api/src/app/activities/activities.service.ts
index 16a3501811..0dce736f4e 100644
--- a/apps/api/src/app/activities/activities.service.ts
+++ b/apps/api/src/app/activities/activities.service.ts
@@ -939,17 +939,12 @@ export class ActivitiesService {
         where
       });
 
-      // Update the asset profile only if it is a custom asset profile of the
-      // user, but not one of the admin, of a data provider or of another user
       if (activityToUpdate?.SymbolProfile.userId === userId) {
         data.SymbolProfile.update = {
           data: {
             assetClass: data.assetClass,
             assetSubClass: data.assetSubClass
           },
-          // Filter by the user again, so that a concurrent request which
-          // links the activity to a different asset profile cannot bypass
-          // the check
           where: { userId }
         };
       } else {