From dcb7cf1ef10d8050c8077ef72bd8f55294eb1d9e Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Wed, 21 Oct 2026 14:56:43 +0200
Subject: [PATCH 1/4] Restrict asset endpoint to authenticated users

---
 .../app/__snapshots__/app.module.spec.ts.snap |  4 +++-
 apps/api/src/app/app.module.spec.ts           |  1 -
 .../asset-profiles/asset.controller.ts        | 10 +++++++++-
 .../src/app/components/markets/markets.html   |  1 +
 .../lib/benchmark/benchmark.component.html    |  2 +-
 .../src/lib/benchmark/benchmark.component.ts  | 19 +++++++++++++------
 6 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/apps/api/src/app/__snapshots__/app.module.spec.ts.snap b/apps/api/src/app/__snapshots__/app.module.spec.ts.snap
index f5e8b793d4..6d23e3bf7a 100644
--- a/apps/api/src/app/__snapshots__/app.module.spec.ts.snap
+++ b/apps/api/src/app/__snapshots__/app.module.spec.ts.snap
@@ -366,7 +366,9 @@ exports[`AppModule should keep the security of each route 1`] = `
     ],
   },
   "GET /asset/:dataSource/:symbol": {
-    "guards": [],
+    "guards": [
+      "AuthGuard('jwt')",
+    ],
     "interceptors": [
       "TransformDataSourceInResponseInterceptor",
       "TransformDataSourceInRequestInterceptor",
diff --git a/apps/api/src/app/app.module.spec.ts b/apps/api/src/app/app.module.spec.ts
index f04485ccdd..27e11ea919 100644
--- a/apps/api/src/app/app.module.spec.ts
+++ b/apps/api/src/app/app.module.spec.ts
@@ -52,7 +52,6 @@ const AUTHENTICATION_STRATEGIES = ['api-key', 'google', 'jwt', 'oidc'];
  * are not served by a controller
  */
 const PUBLIC_ROUTES = [
-  'GET /asset/:dataSource/:symbol',
   'GET /assets/:languageCode/site.webmanifest',
   'GET /auth/google',
   'GET /auth/google/callback',
diff --git a/apps/api/src/app/endpoints/asset-profiles/asset.controller.ts b/apps/api/src/app/endpoints/asset-profiles/asset.controller.ts
index 9c90691388..a296354c20 100644
--- a/apps/api/src/app/endpoints/asset-profiles/asset.controller.ts
+++ b/apps/api/src/app/endpoints/asset-profiles/asset.controller.ts
@@ -2,7 +2,14 @@ import { TransformDataSourceInRequestInterceptor } from '@ghostfolio/api/interce
 import { TransformDataSourceInResponseInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-response/transform-data-source-in-response.interceptor';
 import type { AssetResponse } from '@ghostfolio/common/interfaces';
 
-import { Controller, Get, Param, UseInterceptors } from '@nestjs/common';
+import {
+  Controller,
+  Get,
+  Param,
+  UseGuards,
+  UseInterceptors
+} from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
 import { DataSource } from '@prisma/client';
 import { pick } from 'lodash-es';
 
@@ -15,6 +22,7 @@ export class AssetController {
   ) {}
 
   @Get(':dataSource/:symbol')
+  @UseGuards(AuthGuard('jwt'))
   @UseInterceptors(TransformDataSourceInRequestInterceptor)
   @UseInterceptors(TransformDataSourceInResponseInterceptor)
   public async getAsset(
diff --git a/apps/client/src/app/components/markets/markets.html b/apps/client/src/app/components/markets/markets.html
index 73e27e181e..176b847235 100644
--- a/apps/client/src/app/components/markets/markets.html
+++ b/apps/client/src/app/components/markets/markets.html
@@ -52,6 +52,7 @@
       <gf-benchmark
         [benchmarks]="benchmarks()"
         [deviceType]="deviceType()"
+        [hasPermissionToOpenDetails]="!!user"
         [locale]="user?.settings?.locale ?? DEFAULT_LOCALE"
         [showSymbol]="false"
         [user]="user"
diff --git a/libs/ui/src/lib/benchmark/benchmark.component.html b/libs/ui/src/lib/benchmark/benchmark.component.html
index d2b0a5e328..fd2cba4fc6 100644
--- a/libs/ui/src/lib/benchmark/benchmark.component.html
+++ b/libs/ui/src/lib/benchmark/benchmark.component.html
@@ -200,8 +200,8 @@
     <tr *matHeaderRowDef="displayedColumns()" mat-header-row></tr>
     <tr
       *matRowDef="let row; columns: displayedColumns()"
-      class="cursor-pointer"
       mat-row
+      [class.cursor-pointer]="hasPermissionToOpenDetails()"
       (click)="
         onOpenBenchmarkDialog({
           dataSource: row.dataSource,
diff --git a/libs/ui/src/lib/benchmark/benchmark.component.ts b/libs/ui/src/lib/benchmark/benchmark.component.ts
index bee06e3265..485a9e371f 100644
--- a/libs/ui/src/lib/benchmark/benchmark.component.ts
+++ b/libs/ui/src/lib/benchmark/benchmark.component.ts
@@ -16,6 +16,7 @@ import {
   ChangeDetectionStrategy,
   Component,
   DestroyRef,
+  OnInit,
   computed,
   effect,
   inject,
@@ -62,10 +63,11 @@ import { BenchmarkDetailDialogParams } from './benchmark-detail-dialog/interface
   styleUrls: ['./benchmark.component.scss'],
   templateUrl: './benchmark.component.html'
 })
-export class GfBenchmarkComponent {
+export class GfBenchmarkComponent implements OnInit {
   public readonly benchmarks = input<Benchmark[]>();
   public readonly deviceType = input.required<string>();
   public readonly hasPermissionToDeleteItem = input<boolean>();
+  public readonly hasPermissionToOpenDetails = input(true);
   public readonly locale = input(getLocale());
   public readonly showIcon = input(false);
   public readonly showSymbol = input(true);
@@ -120,10 +122,15 @@ export class GfBenchmarkComponent {
       }
     });
 
+    addIcons({ ellipsisHorizontal, trashOutline });
+  }
+
+  public ngOnInit() {
     this.route.queryParams
       .pipe(takeUntilDestroyed(this.destroyRef))
       .subscribe((params) => {
         if (
+          this.hasPermissionToOpenDetails() &&
           params['benchmarkDetailDialog'] &&
           params['dataSource'] &&
           params['symbol']
@@ -134,8 +141,6 @@ export class GfBenchmarkComponent {
           });
         }
       });
-
-    addIcons({ ellipsisHorizontal, trashOutline });
   }
 
   protected onDeleteItem({ dataSource, symbol }: AssetProfileIdentifier) {
@@ -152,9 +157,11 @@ export class GfBenchmarkComponent {
     dataSource,
     symbol
   }: AssetProfileIdentifier) {
-    this.router.navigate([], {
-      queryParams: { dataSource, symbol, benchmarkDetailDialog: true }
-    });
+    if (this.hasPermissionToOpenDetails()) {
+      this.router.navigate([], {
+        queryParams: { dataSource, symbol, benchmarkDetailDialog: true }
+      });
+    }
   }
 
   private openBenchmarkDetailDialog({

From d37181de22dc2330f66a99ff4c8214feaa2f89c0 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Wed, 21 Oct 2026 14:58:11 +0200
Subject: [PATCH 2/4] Update changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 297677b966..89f3a16c97 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Restricted the asset endpoint (`GET api/v1/asset/:dataSource/:symbol`) to authenticated users
 - Improved the market price in the benchmark detail dialog by adding the currency and reducing the precision on mobile
 - Improved the style of the close button in the dialog footer component
 - Improved the style of the close button in the dialog header component

From e100ce2837118054ba28cab686136dd3fc1a0f01 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Fri, 23 Oct 2026 10:48:33 +0200
Subject: [PATCH 3/4] Update changelog

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 89f3a16c97..4bb5b04598 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,10 +13,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Restricted the asset endpoint (`GET api/v1/asset/:dataSource/:symbol`) to authenticated users
 - Improved the market price in the benchmark detail dialog by adding the currency and reducing the precision on mobile
 - Improved the style of the close button in the dialog footer component
 - Improved the style of the close button in the dialog header component
+- Restricted the asset endpoint (`GET api/v1/asset/:dataSource/:symbol`) to authenticated users
 - Improved the language localization for German (`de`)
 - Upgraded `prettier` from version `3.9.9` to `3.9.10`
 

From a0bfda518f995d5988d0f8da0d86be39cbfbe0f5 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Fri, 23 Oct 2026 11:13:08 +0200
Subject: [PATCH 4/4] Restrict asset endpoint to authenticated users

---
 apps/client/src/app/components/markets/markets.component.ts | 3 +++
 apps/client/src/app/components/markets/markets.html         | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/apps/client/src/app/components/markets/markets.component.ts b/apps/client/src/app/components/markets/markets.component.ts
index 1c8fdb1e1d..c4782b7db4 100644
--- a/apps/client/src/app/components/markets/markets.component.ts
+++ b/apps/client/src/app/components/markets/markets.component.ts
@@ -66,6 +66,7 @@ export class GfMarketsComponent implements OnInit {
   protected fearAndGreedIndex: number | undefined;
   protected fearAndGreedIndexMode: FearAndGreedIndexMode = 'STOCKS';
   protected hasPermissionToAccessFearAndGreedIndex: boolean;
+  protected hasPermissionToOpenBenchmarkDetails = false;
   protected hasPermissionToReadMarketDataOfMarkets: boolean;
   protected historicalDataItems: LineChartItem[];
   protected isLoadingFearAndGreedIndex = true;
@@ -99,6 +100,8 @@ export class GfMarketsComponent implements OnInit {
         if (state?.user) {
           this.user = state.user;
 
+          this.hasPermissionToOpenBenchmarkDetails = true;
+
           this.hasPermissionToReadMarketDataOfMarkets = hasPermission(
             this.user.permissions,
             permissions.readMarketDataOfMarkets
diff --git a/apps/client/src/app/components/markets/markets.html b/apps/client/src/app/components/markets/markets.html
index 176b847235..eafb3224f2 100644
--- a/apps/client/src/app/components/markets/markets.html
+++ b/apps/client/src/app/components/markets/markets.html
@@ -52,7 +52,7 @@
       <gf-benchmark
         [benchmarks]="benchmarks()"
         [deviceType]="deviceType()"
-        [hasPermissionToOpenDetails]="!!user"
+        [hasPermissionToOpenDetails]="hasPermissionToOpenBenchmarkDetails"
         [locale]="user?.settings?.locale ?? DEFAULT_LOCALE"
         [showSymbol]="false"
         [user]="user"