From bfa06b2108bbf0ed8fc97311a2fdaf2f2a151f8d Mon Sep 17 00:00:00 2001
From: Ankit Kumar Gupta <143015358+AnkitKmrGupta@users.noreply.github.com>
Date: Fri, 17 Oct 2025 19:25:20 +0530
Subject: [PATCH] fix(routing): handle validation for profile_id (#9809)

Co-authored-by: hyperswitch-bot[bot] <148525504+hyperswitch-bot[bot]@users.noreply.github.com>
---
 crates/router/src/core/utils.rs | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/crates/router/src/core/utils.rs b/crates/router/src/core/utils.rs
index 768e215809..729881a831 100644
--- a/crates/router/src/core/utils.rs
+++ b/crates/router/src/core/utils.rs
@@ -1871,9 +1871,10 @@ pub async fn validate_and_get_business_profile(
 ) -> RouterResult<Option<domain::Profile>> {
     profile_id
         .async_map(|profile_id| async {
-            db.find_business_profile_by_profile_id(
+            db.find_business_profile_by_merchant_id_profile_id(
                 key_manager_state,
                 merchant_key_store,
+                merchant_id,
                 profile_id,
             )
             .await
@@ -1882,18 +1883,6 @@ pub async fn validate_and_get_business_profile(
             })
         })
         .await
-        .transpose()?
-        .map(|business_profile| {
-            // Check if the merchant_id of business profile is same as the current merchant_id
-            if business_profile.merchant_id.ne(merchant_id) {
-                Err(errors::ApiErrorResponse::AccessForbidden {
-                    resource: business_profile.get_id().get_string_repr().to_owned(),
-                }
-                .into())
-            } else {
-                Ok(business_profile)
-            }
-        })
         .transpose()
 }