Filter update of asset profile by user

apps/api/src/app/activities/activities.service.spec.ts

@@ -528,8 +528,11 @@ describe('ActivitiesService', () => {
 
       expect(data.SymbolProfile).toEqual({
         update: {
-          assetClass: AssetClass.COMMODITY,
-          assetSubClass: AssetSubClass.PRECIOUS_METAL
+          data: {
+            assetClass: AssetClass.COMMODITY,
+            assetSubClass: AssetSubClass.PRECIOUS_METAL
+          },
+          where: { userId: 'user-id' }
         }
       });
     });

apps/api/src/app/activities/activities.service.ts

@@ -933,7 +933,6 @@ export class ActivitiesService {
         data.type === 'BUY')
     ) {
       delete data.SymbolProfile.connect;
-      delete data.SymbolProfile.update.name;
 
       const activityToUpdate = await this.prismaService.order.findUnique({
         select: { SymbolProfile: { select: { userId: true } } },
@@ -942,7 +941,18 @@ export class ActivitiesService {
 
       // Update the asset profile only if it is a custom asset profile of the
       // user, but not one of the admin, of a data provider or of another user
-      if (activityToUpdate?.SymbolProfile.userId !== userId) {
+      if (activityToUpdate?.SymbolProfile.userId === userId) {
+        data.SymbolProfile.update = {
+          data: {
+            assetClass: data.assetClass,
+            assetSubClass: data.assetSubClass
+          },
+          // Filter by the user again, so that a concurrent request which
+          // links the activity to a different asset profile cannot bypass
+          // the check
+          where: { userId }
+        };
+      } else {
         delete data.SymbolProfile;
       }
     } else {