From b7fc13e20a93c07020bbaadfd2e0efad65370e58 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Mon, 13 Jul 2026 20:01:56 +0200
Subject: [PATCH] Task/harden validation of sectors in asset profile endpoints
 (#7319)

* Harden validation of sectors

* Update changelog
---
 CHANGELOG.md                                         |  1 +
 libs/common/src/lib/dtos/country.dto.ts              |  2 +-
 libs/common/src/lib/dtos/create-asset-profile.dto.ts |  3 +++
 libs/common/src/lib/dtos/index.ts                    |  2 ++
 libs/common/src/lib/dtos/sector.dto.ts               | 11 +++++++++++
 libs/common/src/lib/dtos/update-asset-profile.dto.ts |  3 +++
 6 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 libs/common/src/lib/dtos/sector.dto.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c2b310916..cdf27bf9b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Hardened the validation of the countries in the asset profile endpoints
+- Hardened the validation of the sectors in the asset profile endpoints
 - Rounded the value of the _Fear & Greed Index_ (market mood) in the twitter bot service
 - Set the change detection strategy to `OnPush` in the _X-ray_ page
 
diff --git a/libs/common/src/lib/dtos/country.dto.ts b/libs/common/src/lib/dtos/country.dto.ts
index 663aa1ac6..7fc8c38ab 100644
--- a/libs/common/src/lib/dtos/country.dto.ts
+++ b/libs/common/src/lib/dtos/country.dto.ts
@@ -5,7 +5,7 @@ export class CountryDto {
   code: string;
 
   @IsNumber()
-  @Min(0)
   @Max(1)
+  @Min(0)
   weight: number;
 }
diff --git a/libs/common/src/lib/dtos/create-asset-profile.dto.ts b/libs/common/src/lib/dtos/create-asset-profile.dto.ts
index 3e7e2224e..0b0ccb9d3 100644
--- a/libs/common/src/lib/dtos/create-asset-profile.dto.ts
+++ b/libs/common/src/lib/dtos/create-asset-profile.dto.ts
@@ -13,6 +13,7 @@ import {
 } from 'class-validator';
 
 import { CountryDto } from './country.dto';
+import { SectorDto } from './sector.dto';
 
 export class CreateAssetProfileDto {
   @IsEnum(AssetClass)
@@ -73,6 +74,8 @@ export class CreateAssetProfileDto {
 
   @IsArray()
   @IsOptional()
+  @Type(() => SectorDto)
+  @ValidateNested({ each: true })
   sectors?: Prisma.InputJsonArray;
 
   @IsString()
diff --git a/libs/common/src/lib/dtos/index.ts b/libs/common/src/lib/dtos/index.ts
index dea092398..c74c68dfd 100644
--- a/libs/common/src/lib/dtos/index.ts
+++ b/libs/common/src/lib/dtos/index.ts
@@ -11,6 +11,7 @@ import { CreatePlatformDto } from './create-platform.dto';
 import { CreateTagDto } from './create-tag.dto';
 import { CreateWatchlistItemDto } from './create-watchlist-item.dto';
 import { DeleteOwnUserDto } from './delete-own-user.dto';
+import { SectorDto } from './sector.dto';
 import { TransferBalanceDto } from './transfer-balance.dto';
 import { UpdateAccessDto } from './update-access.dto';
 import { UpdateAccountDto } from './update-account.dto';
@@ -39,6 +40,7 @@ export {
   CreateTagDto,
   CreateWatchlistItemDto,
   DeleteOwnUserDto,
+  SectorDto,
   TransferBalanceDto,
   UpdateAccessDto,
   UpdateAccountDto,
diff --git a/libs/common/src/lib/dtos/sector.dto.ts b/libs/common/src/lib/dtos/sector.dto.ts
new file mode 100644
index 000000000..e4655cb73
--- /dev/null
+++ b/libs/common/src/lib/dtos/sector.dto.ts
@@ -0,0 +1,11 @@
+import { IsNumber, IsString, Max, Min } from 'class-validator';
+
+export class SectorDto {
+  @IsString()
+  name: string;
+
+  @IsNumber()
+  @Max(1)
+  @Min(0)
+  weight: number;
+}
diff --git a/libs/common/src/lib/dtos/update-asset-profile.dto.ts b/libs/common/src/lib/dtos/update-asset-profile.dto.ts
index dc660a481..5b193ff7e 100644
--- a/libs/common/src/lib/dtos/update-asset-profile.dto.ts
+++ b/libs/common/src/lib/dtos/update-asset-profile.dto.ts
@@ -20,6 +20,7 @@ import {
 } from 'class-validator';
 
 import { CountryDto } from './country.dto';
+import { SectorDto } from './sector.dto';
 
 export class UpdateAssetProfileDto {
   @IsEnum(AssetClass)
@@ -70,6 +71,8 @@ export class UpdateAssetProfileDto {
 
   @IsArray()
   @IsOptional()
+  @Type(() => SectorDto)
+  @ValidateNested({ each: true })
   sectors?: Prisma.InputJsonArray;
 
   @IsOptional()