From 2b8b8b405f2937d0eb066caab5e1707849e9c2f4 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:28:46 +0200
Subject: [PATCH] Bugfix/permission check of dividends import endpoint (#8282)

* Fix missing permission check

* Update changelog
---
 CHANGELOG.md                                           | 1 +
 apps/api/src/app/__snapshots__/app.module.spec.ts.snap | 1 +
 apps/api/src/app/endpoints/import/import.controller.ts | 1 +
 3 files changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6343d58b04..b421ffc6da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 
 - Fixed a transaction timeout for presets in the historical market data table of the admin control panel
+- Added the missing permission check in the `GET api/v1/import/dividends/:dataSource/:symbol` endpoint
 
 ## 3.90.0 - 2026-10-21
 
diff --git a/apps/api/src/app/__snapshots__/app.module.spec.ts.snap b/apps/api/src/app/__snapshots__/app.module.spec.ts.snap
index 6d23e3bf7a..927ecc7ebc 100644
--- a/apps/api/src/app/__snapshots__/app.module.spec.ts.snap
+++ b/apps/api/src/app/__snapshots__/app.module.spec.ts.snap
@@ -548,6 +548,7 @@ exports[`AppModule should keep the security of each route 1`] = `
       "TransformDataSourceInResponseInterceptor",
       "TransformDataSourceInRequestInterceptor",
     ],
+    "permission": "createActivity",
   },
   "GET /info": {
     "guards": [],
diff --git a/apps/api/src/app/endpoints/import/import.controller.ts b/apps/api/src/app/endpoints/import/import.controller.ts
index 846914bd03..9c5c162e4d 100644
--- a/apps/api/src/app/endpoints/import/import.controller.ts
+++ b/apps/api/src/app/endpoints/import/import.controller.ts
@@ -81,6 +81,7 @@ export class ImportController {
   }
 
   @Get('dividends/:dataSource/:symbol')
+  @HasPermission(permissions.createActivity)
   @UseGuards(AuthGuard('jwt'), HasPermissionGuard)
   @UseInterceptors(TransformDataSourceInRequestInterceptor)
   @UseInterceptors(TransformDataSourceInResponseInterceptor)