Add category.move to reparent a category.

Validates both source and target via resolveCategoryAccess so the new
parent must be a category of the same authorized company, and guards
against moving into a descendant (cycle). Assigns next sibling sort.

src/index.js

@@ -9,6 +9,7 @@ import categoryGetTreeForCompany from './store/category/getTreeForCompany.js';
 import categoryGetCategoryArticles from './store/category/getCategoryArticles.js';
 import categoryCreateUnderParent from './store/category/createUnderParent.js';
 import categoryRename from './store/category/rename.js';
+import categoryMove from './store/category/move.js';
 import categoryOrder from './store/category/order.js';
 import categoryDelete from './store/category/delete.js';
 import articleDelete from './store/article/delete.js';
@@ -74,6 +75,7 @@ export default class LibDashStore {
       getCategoryArticles: categoryGetCategoryArticles(pool),
       createUnderParent: categoryCreateUnderParent(pool),
       rename: categoryRename(pool),
+      move: categoryMove(pool),
       order: categoryOrder(pool),
       delete: categoryDelete(pool),
     };

src/sql/category.js

@@ -103,6 +103,30 @@ SET sort = @sort
 WHERE id = @id AND parent_id = @parentId
 `;
 
+/** True if @id is an ancestor of @parentId (would create a cycle when moving). */
+export const IS_ANCESTOR = `
+WITH ancestors AS (
+    SELECT id, parent_id
+    FROM category
+    WHERE id = @parentId
+
+    UNION ALL
+
+    SELECT c.id, c.parent_id
+    FROM category c
+    INNER JOIN ancestors a ON c.id = a.parent_id
+)
+SELECT id
+FROM ancestors
+WHERE id = @id
+`;
+
+export const MOVE = `
+UPDATE category
+SET parent_id = @parentId, sort = @sort
+WHERE id = @id
+`;
+
 export const DELETE = `
 DELETE FROM category
 WHERE id = @id

src/store/category/move.js

@@ -0,0 +1,67 @@
+import {
+  GET_NEXT_SIBLING_SORT,
+  IS_ANCESTOR,
+  MOVE,
+} from '../../sql/category.js';
+import request from '../request.js';
+import resolveCategoryAccess from './resolveCategoryAccess.js';
+
+export default function move(pool) {
+  const access = resolveCategoryAccess(pool);
+
+  return async ({ googleAuthId, id, parentId }) => {
+    // Source category auth (throws if missing / not authorized).
+    const source = await access(googleAuthId, id);
+    // Target must be a valid category for the same authorized user/company.
+    const target = await access(googleAuthId, parentId);
+
+    if (target.companyId !== source.companyId) {
+      throw new Error('Parent not found');
+    }
+
+    if (id === parentId) {
+      throw new Error('Invalid parent');
+    }
+
+    const cycle = await pool
+      .request()
+      .input('id', id)
+      .input('parentId', parentId)
+      .query(IS_ANCESTOR);
+
+    if (cycle.recordset[0]) {
+      throw new Error('Invalid parent');
+    }
+
+    const tx = pool.transaction();
+    await tx.begin();
+
+    try {
+      const sortResult = await request(pool, tx)
+        .input('parentId', parentId)
+        .query(GET_NEXT_SIBLING_SORT);
+      const sort = sortResult.recordset[0].sort;
+
+      const result = await request(pool, tx)
+        .input('id', id)
+        .input('parentId', parentId)
+        .input('sort', sort)
+        .query(MOVE);
+
+      if (!result.rowsAffected[0]) {
+        throw new Error('Category not found');
+      }
+
+      await tx.commit();
+
+      return { id, parentId, sort };
+    } catch (err) {
+      try {
+        await tx.rollback();
+      } catch {
+        // ignore
+      }
+      throw err;
+    }
+  };
+}