From a4de762da8b0a85428cb563b8ea07312ce2c0638 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Mon, 13 Jul 2026 20:16:45 +0200
Subject: [PATCH] Harden validation of scraper configuration

---
 libs/common/src/lib/dtos/index.ts             |  2 ++
 .../src/lib/dtos/scraper-configuration.dto.ts | 35 +++++++++++++++++++
 .../src/lib/dtos/update-asset-profile.dto.ts  |  3 ++
 3 files changed, 40 insertions(+)
 create mode 100644 libs/common/src/lib/dtos/scraper-configuration.dto.ts

diff --git a/libs/common/src/lib/dtos/index.ts b/libs/common/src/lib/dtos/index.ts
index c74c68dfd..ae7ae9221 100644
--- a/libs/common/src/lib/dtos/index.ts
+++ b/libs/common/src/lib/dtos/index.ts
@@ -11,6 +11,7 @@ import { CreatePlatformDto } from './create-platform.dto';
 import { CreateTagDto } from './create-tag.dto';
 import { CreateWatchlistItemDto } from './create-watchlist-item.dto';
 import { DeleteOwnUserDto } from './delete-own-user.dto';
+import { ScraperConfigurationDto } from './scraper-configuration.dto';
 import { SectorDto } from './sector.dto';
 import { TransferBalanceDto } from './transfer-balance.dto';
 import { UpdateAccessDto } from './update-access.dto';
@@ -40,6 +41,7 @@ export {
   CreateTagDto,
   CreateWatchlistItemDto,
   DeleteOwnUserDto,
+  ScraperConfigurationDto,
   SectorDto,
   TransferBalanceDto,
   UpdateAccessDto,
diff --git a/libs/common/src/lib/dtos/scraper-configuration.dto.ts b/libs/common/src/lib/dtos/scraper-configuration.dto.ts
new file mode 100644
index 000000000..52cadb80c
--- /dev/null
+++ b/libs/common/src/lib/dtos/scraper-configuration.dto.ts
@@ -0,0 +1,35 @@
+import {
+  IsIn,
+  IsNumber,
+  IsObject,
+  IsOptional,
+  IsString,
+  IsUrl
+} from 'class-validator';
+
+export class ScraperConfigurationDto {
+  @IsNumber()
+  @IsOptional()
+  defaultMarketPrice?: number;
+
+  @IsObject()
+  @IsOptional()
+  headers?: { [key: string]: string };
+
+  @IsOptional()
+  @IsString()
+  locale?: string;
+
+  @IsIn(['instant', 'lazy'])
+  @IsOptional()
+  mode?: 'instant' | 'lazy';
+
+  @IsString()
+  selector: string;
+
+  @IsUrl({
+    protocols: ['http', 'https'],
+    require_protocol: true
+  })
+  url: string;
+}
diff --git a/libs/common/src/lib/dtos/update-asset-profile.dto.ts b/libs/common/src/lib/dtos/update-asset-profile.dto.ts
index 5b193ff7e..faa0cecfc 100644
--- a/libs/common/src/lib/dtos/update-asset-profile.dto.ts
+++ b/libs/common/src/lib/dtos/update-asset-profile.dto.ts
@@ -20,6 +20,7 @@ import {
 } from 'class-validator';
 
 import { CountryDto } from './country.dto';
+import { ScraperConfigurationDto } from './scraper-configuration.dto';
 import { SectorDto } from './sector.dto';
 
 export class UpdateAssetProfileDto {
@@ -67,6 +68,8 @@ export class UpdateAssetProfileDto {
 
   @IsObject()
   @IsOptional()
+  @Type(() => ScraperConfigurationDto)
+  @ValidateNested()
   scraperConfiguration?: Prisma.InputJsonObject;
 
   @IsArray()