diff --git a/apps/api/src/app/activities/activities.service.spec.ts b/apps/api/src/app/activities/activities.service.spec.ts index 9c1938179f..b828eef1ca 100644 --- a/apps/api/src/app/activities/activities.service.spec.ts +++ b/apps/api/src/app/activities/activities.service.spec.ts @@ -528,8 +528,11 @@ describe('ActivitiesService', () => { expect(data.SymbolProfile).toEqual({ update: { - assetClass: AssetClass.COMMODITY, - assetSubClass: AssetSubClass.PRECIOUS_METAL + data: { + assetClass: AssetClass.COMMODITY, + assetSubClass: AssetSubClass.PRECIOUS_METAL + }, + where: { userId: 'user-id' } } }); }); diff --git a/apps/api/src/app/activities/activities.service.ts b/apps/api/src/app/activities/activities.service.ts index 34179b9e69..16a3501811 100644 --- a/apps/api/src/app/activities/activities.service.ts +++ b/apps/api/src/app/activities/activities.service.ts @@ -933,7 +933,6 @@ export class ActivitiesService { data.type === 'BUY') ) { delete data.SymbolProfile.connect; - delete data.SymbolProfile.update.name; const activityToUpdate = await this.prismaService.order.findUnique({ select: { SymbolProfile: { select: { userId: true } } }, @@ -942,7 +941,18 @@ export class ActivitiesService { // Update the asset profile only if it is a custom asset profile of the // user, but not one of the admin, of a data provider or of another user - if (activityToUpdate?.SymbolProfile.userId !== userId) { + if (activityToUpdate?.SymbolProfile.userId === userId) { + data.SymbolProfile.update = { + data: { + assetClass: data.assetClass, + assetSubClass: data.assetSubClass + }, + // Filter by the user again, so that a concurrent request which + // links the activity to a different asset profile cannot bypass + // the check + where: { userId } + }; + } else { delete data.SymbolProfile; } } else {