From 88dc318a5c3109599005505d01b58c2689e05399 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Fri, 23 Oct 2026 08:43:53 +0200
Subject: [PATCH] Fix missing permission check in dividends import endpoint

---
 apps/api/src/app/__snapshots__/app.module.spec.ts.snap | 1 +
 apps/api/src/app/endpoints/import/import.controller.ts | 1 +
 2 files changed, 2 insertions(+)

diff --git a/apps/api/src/app/__snapshots__/app.module.spec.ts.snap b/apps/api/src/app/__snapshots__/app.module.spec.ts.snap
index f5e8b793d4..188dd6e179 100644
--- a/apps/api/src/app/__snapshots__/app.module.spec.ts.snap
+++ b/apps/api/src/app/__snapshots__/app.module.spec.ts.snap
@@ -546,6 +546,7 @@ exports[`AppModule should keep the security of each route 1`] = `
       "TransformDataSourceInResponseInterceptor",
       "TransformDataSourceInRequestInterceptor",
     ],
+    "permission": "createActivity",
   },
   "GET /info": {
     "guards": [],
diff --git a/apps/api/src/app/endpoints/import/import.controller.ts b/apps/api/src/app/endpoints/import/import.controller.ts
index 846914bd03..dcb9844d3f 100644
--- a/apps/api/src/app/endpoints/import/import.controller.ts
+++ b/apps/api/src/app/endpoints/import/import.controller.ts
@@ -82,6 +82,7 @@ export class ImportController {
 
   @Get('dividends/:dataSource/:symbol')
   @UseGuards(AuthGuard('jwt'), HasPermissionGuard)
+  @HasPermission(permissions.createActivity)
   @UseInterceptors(TransformDataSourceInRequestInterceptor)
   @UseInterceptors(TransformDataSourceInResponseInterceptor)
   public async gatherDividends(