From ccbf958aa653e6f26be90b7b7f4333742338bc73 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Fri, 16 May 2025 20:16:24 +0200
Subject: [PATCH 1/2] Feature/upgrade countup.js to version 2.8.2 (#4708)

* Upgrade countup.js to version 2.8.2

* Update changelog
---
 CHANGELOG.md      | 1 +
 package-lock.json | 8 ++++----
 package.json      | 2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4a60ad6fa..c9b2ba32f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Improved the language localization for Dutch (`nl`)
 - Improved the language localization for German (`de`)
 - Improved the language localization for Italian (`it`)
+- Upgraded `countup.js` from version `2.8.0` to `2.8.2`
 - Upgraded `nestjs` from version `10.4.15` to `11.0.12`
 - Upgraded `yahoo-finance2` from version `2.11.3` to `3.3.1`
 
diff --git a/package-lock.json b/package-lock.json
index 52924f839..b2e0f3b9f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -61,7 +61,7 @@
         "color": "5.0.0",
         "countries-and-timezones": "3.7.2",
         "countries-list": "3.1.1",
-        "countup.js": "2.8.0",
+        "countup.js": "2.8.2",
         "date-fns": "4.1.0",
         "envalid": "8.0.0",
         "google-spreadsheet": "3.2.0",
@@ -16965,9 +16965,9 @@
       "license": "MIT"
     },
     "node_modules/countup.js": {
-      "version": "2.8.0",
-      "resolved": "https://registry.npmjs.org/countup.js/-/countup.js-2.8.0.tgz",
-      "integrity": "sha512-f7xEhX0awl4NOElHulrl4XRfKoNH3rB+qfNSZZyjSZhaAoUk6elvhH+MNxMmlmuUJ2/QNTWPSA7U4mNtIAKljQ==",
+      "version": "2.8.2",
+      "resolved": "https://registry.npmjs.org/countup.js/-/countup.js-2.8.2.tgz",
+      "integrity": "sha512-UtRoPH6udaru/MOhhZhI/GZHJKAyAxuKItD2Tr7AbrqrOPBX/uejWBBJt8q86169AMqKkE9h9/24kFWbUk/Bag==",
       "license": "MIT"
     },
     "node_modules/create-jest": {
diff --git a/package.json b/package.json
index 51b592245..a995a8a47 100644
--- a/package.json
+++ b/package.json
@@ -107,7 +107,7 @@
     "color": "5.0.0",
     "countries-and-timezones": "3.7.2",
     "countries-list": "3.1.1",
-    "countup.js": "2.8.0",
+    "countup.js": "2.8.2",
     "date-fns": "4.1.0",
     "envalid": "8.0.0",
     "google-spreadsheet": "3.2.0",

From 698d71fb3a6e75a9b223d2e018d1f7d15227765a Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Sat, 17 May 2025 19:39:48 +0200
Subject: [PATCH 2/2] Feature/restrict permissions of demo user (#4697)

* Restrict permissions of demo user

* Update changelog
---
 CHANGELOG.md                          | 1 +
 apps/api/src/app/user/user.service.ts | 8 +++++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9b2ba32f..f509061ee 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Harmonized the data providers management style of the admin control panel
+- Restricted the permissions of the demo user
 - Renamed `Order` to `activities` in the `User` database schema
 - Improved the language localization for Catalan (`ca`)
 - Improved the language localization for Chinese (`zh`)
diff --git a/apps/api/src/app/user/user.service.ts b/apps/api/src/app/user/user.service.ts
index cf55b8862..87c82fa0b 100644
--- a/apps/api/src/app/user/user.service.ts
+++ b/apps/api/src/app/user/user.service.ts
@@ -394,9 +394,11 @@ export class UserService {
         // Reset holdings view mode
         user.Settings.settings.holdingsViewMode = undefined;
       } else if (user.subscription?.type === 'Premium') {
-        currentPermissions.push(permissions.createApiKey);
-        currentPermissions.push(permissions.enableDataProviderGhostfolio);
-        currentPermissions.push(permissions.reportDataGlitch);
+        if (!hasRole(user, Role.DEMO)) {
+          currentPermissions.push(permissions.createApiKey);
+          currentPermissions.push(permissions.enableDataProviderGhostfolio);
+          currentPermissions.push(permissions.reportDataGlitch);
+        }
 
         currentPermissions = without(
           currentPermissions,