From d8d66ce105ad86516d2619c724e4484c8338c0d9 Mon Sep 17 00:00:00 2001 From: seb Date: Mon, 3 Aug 2026 03:01:02 +0200 Subject: [PATCH] Add category.move to reparent a category. Validates both source and target via resolveCategoryAccess so the new parent must be a category of the same authorized company, and guards against moving into a descendant (cycle). Assigns next sibling sort. --- README.md | 4 +++ scripts/test-api.js | 17 ++++++++++ src/index.js | 2 ++ src/sql/category.js | 24 ++++++++++++++ src/store/category/move.js | 67 ++++++++++++++++++++++++++++++++++++++ 5 files changed, 114 insertions(+) create mode 100644 src/store/category/move.js diff --git a/README.md b/README.md index 1983aa8..31edc29 100644 --- a/README.md +++ b/README.md @@ -188,6 +188,7 @@ Company-scoped brands. Auth via `resolveCompanyAccess`. | --- | --- | --- | | `createUnderParent` | `({ googleAuthId, parentId, name })` | `{ id, parentId, sort, name, slug }` | | `rename` | `({ googleAuthId, id, name })` | `{ id, name, slug }` | +| `move` | `({ googleAuthId, id, parentId })` | `{ id, parentId, sort }` | | `order` | `({ googleAuthId, parentId, categoryIds })` | `{ categoryIds }` | | `delete` | `({ googleAuthId, id })` | `void` — blocked by FK if `categoryarticle` or child categories remain | | `getTreeForCompany` | `(googleAuthId, companyId)` | `{ languageId, tree, articles }` — tree rows carry `name` + `slug` | @@ -206,6 +207,8 @@ Company-scoped brands. Auth via `resolveCompanyAccess`. `order` reorders the direct children of `parentId` to the given `categoryIds` order (each child's `sort` set to its index `0..n-1`). Since a category can have multiple parents, `parentId` scopes which sibling list is reordered. `categoryIds` must be exactly the current children of `parentId` (same set, no dups) else `Invalid category order`. Auth via `resolveCategoryAccess` on `parentId`. Returns `{ categoryIds }`. For `PUT /api/category/order`. +`move` moves a category to a new parent. Both `id` (source) and `parentId` (target) are validated via `resolveCategoryAccess` — the target must be a real category of the same authorized company, else `Parent not found`. Moving into itself or into a descendant (cycle) → `Invalid parent`. The moved category gets the next sibling `sort` under the new parent. Returns `{ id, parentId, sort }`. For `POST /api/category/:id/move`. + --- ## `article` @@ -321,6 +324,7 @@ res.set('Content-Type', thumb.contentType).send(thumb.buffer); | `POST /api/category` | `category.createUnderParent({ googleAuthId, parentId, name })` | | `PATCH /api/category/:id` | `category.rename({ googleAuthId, id, name })` | | `PUT /api/category/order` | `category.order({ googleAuthId, parentId, categoryIds })` | +| `POST /api/category/:id/move` | `category.move({ googleAuthId, id, parentId })` | | `DELETE /api/category/:id` | `category.delete({ googleAuthId, id })` | | `GET /api/unit?companyId=` | `unit.list(googleAuthId, companyId)` | | `PUT /api/unit` | `unit.upsert(googleAuthId, companyId, { si, basesi, basesifactor, symbol, name })` | diff --git a/scripts/test-api.js b/scripts/test-api.js index a49f877..309b858 100644 --- a/scripts/test-api.js +++ b/scripts/test-api.js @@ -163,6 +163,7 @@ const MENU = { items: [ { value: 'category.createUnderParent', label: 'createUnderParent', hint: 'googleAuthId, parentId, name → row' }, { value: 'category.rename', label: 'rename', hint: 'googleAuthId, id, name → row' }, + { value: 'category.move', label: 'move', hint: 'googleAuthId, id, parentId → row' }, { value: 'category.order', label: 'order', hint: 'googleAuthId, parentId, JSON categoryIds' }, { value: 'category.delete', label: 'delete', hint: 'googleAuthId, id' }, { value: 'category.getTreeForCompany', label: 'getTreeForCompany', hint: 'googleAuthId, companyId → rows' }, @@ -671,6 +672,22 @@ async function runMethod(client, action) { }), ]; } + case 'category.move': { + const googleAuthId = await askInt('google_auth id'); + if (googleAuthId == null) return; + const id = await askInt('Category id'); + if (id == null) return; + const parentId = await askInt('new parent id'); + if (parentId == null) return; + return [ + 'row', + await client.category.move({ + googleAuthId: Number(googleAuthId), + id: Number(id), + parentId: Number(parentId), + }), + ]; + } case 'category.order': { const googleAuthId = await askInt('google_auth id'); if (googleAuthId == null) return; diff --git a/src/index.js b/src/index.js index a0a8d2e..c491aa3 100644 --- a/src/index.js +++ b/src/index.js @@ -9,6 +9,7 @@ import categoryGetTreeForCompany from './store/category/getTreeForCompany.js'; import categoryGetCategoryArticles from './store/category/getCategoryArticles.js'; import categoryCreateUnderParent from './store/category/createUnderParent.js'; import categoryRename from './store/category/rename.js'; +import categoryMove from './store/category/move.js'; import categoryOrder from './store/category/order.js'; import categoryDelete from './store/category/delete.js'; import articleDelete from './store/article/delete.js'; @@ -74,6 +75,7 @@ export default class LibDashStore { getCategoryArticles: categoryGetCategoryArticles(pool), createUnderParent: categoryCreateUnderParent(pool), rename: categoryRename(pool), + move: categoryMove(pool), order: categoryOrder(pool), delete: categoryDelete(pool), }; diff --git a/src/sql/category.js b/src/sql/category.js index a683979..ecdeaaa 100644 --- a/src/sql/category.js +++ b/src/sql/category.js @@ -103,6 +103,30 @@ SET sort = @sort WHERE id = @id AND parent_id = @parentId `; +/** True if @id is an ancestor of @parentId (would create a cycle when moving). */ +export const IS_ANCESTOR = ` +WITH ancestors AS ( + SELECT id, parent_id + FROM category + WHERE id = @parentId + + UNION ALL + + SELECT c.id, c.parent_id + FROM category c + INNER JOIN ancestors a ON c.id = a.parent_id +) +SELECT id +FROM ancestors +WHERE id = @id +`; + +export const MOVE = ` +UPDATE category +SET parent_id = @parentId, sort = @sort +WHERE id = @id +`; + export const DELETE = ` DELETE FROM category WHERE id = @id diff --git a/src/store/category/move.js b/src/store/category/move.js new file mode 100644 index 0000000..94c9c6d --- /dev/null +++ b/src/store/category/move.js @@ -0,0 +1,67 @@ +import { + GET_NEXT_SIBLING_SORT, + IS_ANCESTOR, + MOVE, +} from '../../sql/category.js'; +import request from '../request.js'; +import resolveCategoryAccess from './resolveCategoryAccess.js'; + +export default function move(pool) { + const access = resolveCategoryAccess(pool); + + return async ({ googleAuthId, id, parentId }) => { + // Source category auth (throws if missing / not authorized). + const source = await access(googleAuthId, id); + // Target must be a valid category for the same authorized user/company. + const target = await access(googleAuthId, parentId); + + if (target.companyId !== source.companyId) { + throw new Error('Parent not found'); + } + + if (id === parentId) { + throw new Error('Invalid parent'); + } + + const cycle = await pool + .request() + .input('id', id) + .input('parentId', parentId) + .query(IS_ANCESTOR); + + if (cycle.recordset[0]) { + throw new Error('Invalid parent'); + } + + const tx = pool.transaction(); + await tx.begin(); + + try { + const sortResult = await request(pool, tx) + .input('parentId', parentId) + .query(GET_NEXT_SIBLING_SORT); + const sort = sortResult.recordset[0].sort; + + const result = await request(pool, tx) + .input('id', id) + .input('parentId', parentId) + .input('sort', sort) + .query(MOVE); + + if (!result.rowsAffected[0]) { + throw new Error('Category not found'); + } + + await tx.commit(); + + return { id, parentId, sort }; + } catch (err) { + try { + await tx.rollback(); + } catch { + // ignore + } + throw err; + } + }; +}