From e796c1d01a1e1a0c08b87139d974a80a7519f797 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Tue, 22 Sep 2026 09:25:47 +0200
Subject: [PATCH] Validate ownership of asset profile

---
 apps/api/src/app/activities/activities.service.ts | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/apps/api/src/app/activities/activities.service.ts b/apps/api/src/app/activities/activities.service.ts
index 0eb310ce49..4519e76f1d 100644
--- a/apps/api/src/app/activities/activities.service.ts
+++ b/apps/api/src/app/activities/activities.service.ts
@@ -900,7 +900,6 @@ export class ActivitiesService {
         data.type === 'BUY')
     ) {
       delete data.SymbolProfile.connect;
-      delete data.SymbolProfile.update.name;
 
       const { SymbolProfile: assetProfile } =
         await this.prismaService.order.findUniqueOrThrow({
@@ -916,7 +915,18 @@ export class ActivitiesService {
 
       const isOwnAssetProfile = assetProfile.userId === userId;
 
-      if (!isOwnAssetProfile) {
+      if (isOwnAssetProfile) {
+        data.SymbolProfile.update = {
+          data: {
+            assetClass: data.assetClass,
+            assetSubClass: data.assetSubClass
+          },
+          // Filter by the user again, so that a concurrent request which
+          // links the activity to a different asset profile cannot bypass
+          // the check
+          where: { userId }
+        };
+      } else {
         delete data.SymbolProfile.update;
       }
     } else {