From df6fa86b1d7ef19d818f9d258f442ea3fd8c0c83 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Mon, 13 Jul 2026 20:22:06 +0200
Subject: [PATCH] Task/harden validation of holdings in asset profile endpoints
 (#7320)

* Harden validation of holdings

* Update changelog
---
 CHANGELOG.md                                         |  1 +
 libs/common/src/lib/dtos/create-asset-profile.dto.ts |  3 +++
 libs/common/src/lib/dtos/holding.dto.ts              | 11 +++++++++++
 libs/common/src/lib/dtos/index.ts                    |  2 ++
 libs/common/src/lib/dtos/update-asset-profile.dto.ts |  3 +++
 5 files changed, 20 insertions(+)
 create mode 100644 libs/common/src/lib/dtos/holding.dto.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9011a3350..1106df29b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Hardened the validation of the countries in the asset profile endpoints
+- Hardened the validation of the holdings in the asset profile endpoints
 - Hardened the validation of the sectors in the asset profile endpoints
 - Rounded the value of the _Fear & Greed Index_ (market mood) in the twitter bot service
 - Set the change detection strategy to `OnPush` in the _X-ray_ page
diff --git a/libs/common/src/lib/dtos/create-asset-profile.dto.ts b/libs/common/src/lib/dtos/create-asset-profile.dto.ts
index 0b0ccb9d3..17a9d12b9 100644
--- a/libs/common/src/lib/dtos/create-asset-profile.dto.ts
+++ b/libs/common/src/lib/dtos/create-asset-profile.dto.ts
@@ -13,6 +13,7 @@ import {
 } from 'class-validator';
 
 import { CountryDto } from './country.dto';
+import { HoldingDto } from './holding.dto';
 import { SectorDto } from './sector.dto';
 
 export class CreateAssetProfileDto {
@@ -58,6 +59,8 @@ export class CreateAssetProfileDto {
 
   @IsArray()
   @IsOptional()
+  @Type(() => HoldingDto)
+  @ValidateNested({ each: true })
   holdings?: Prisma.InputJsonArray;
 
   @IsBoolean()
diff --git a/libs/common/src/lib/dtos/holding.dto.ts b/libs/common/src/lib/dtos/holding.dto.ts
new file mode 100644
index 000000000..8c093e3bc
--- /dev/null
+++ b/libs/common/src/lib/dtos/holding.dto.ts
@@ -0,0 +1,11 @@
+import { IsNumber, IsString, Max, Min } from 'class-validator';
+
+export class HoldingDto {
+  @IsNumber()
+  @Max(1)
+  @Min(0)
+  allocationInPercentage: number;
+
+  @IsString()
+  name: string;
+}
diff --git a/libs/common/src/lib/dtos/index.ts b/libs/common/src/lib/dtos/index.ts
index c74c68dfd..c531313a6 100644
--- a/libs/common/src/lib/dtos/index.ts
+++ b/libs/common/src/lib/dtos/index.ts
@@ -11,6 +11,7 @@ import { CreatePlatformDto } from './create-platform.dto';
 import { CreateTagDto } from './create-tag.dto';
 import { CreateWatchlistItemDto } from './create-watchlist-item.dto';
 import { DeleteOwnUserDto } from './delete-own-user.dto';
+import { HoldingDto } from './holding.dto';
 import { SectorDto } from './sector.dto';
 import { TransferBalanceDto } from './transfer-balance.dto';
 import { UpdateAccessDto } from './update-access.dto';
@@ -40,6 +41,7 @@ export {
   CreateTagDto,
   CreateWatchlistItemDto,
   DeleteOwnUserDto,
+  HoldingDto,
   SectorDto,
   TransferBalanceDto,
   UpdateAccessDto,
diff --git a/libs/common/src/lib/dtos/update-asset-profile.dto.ts b/libs/common/src/lib/dtos/update-asset-profile.dto.ts
index 5b193ff7e..2204fd0ab 100644
--- a/libs/common/src/lib/dtos/update-asset-profile.dto.ts
+++ b/libs/common/src/lib/dtos/update-asset-profile.dto.ts
@@ -20,6 +20,7 @@ import {
 } from 'class-validator';
 
 import { CountryDto } from './country.dto';
+import { HoldingDto } from './holding.dto';
 import { SectorDto } from './sector.dto';
 
 export class UpdateAssetProfileDto {
@@ -55,6 +56,8 @@ export class UpdateAssetProfileDto {
 
   @IsArray()
   @IsOptional()
+  @Type(() => HoldingDto)
+  @ValidateNested({ each: true })
   holdings?: Prisma.InputJsonArray;
 
   @IsBoolean()