Add category.move to reparent a category.

Validates both source and target via resolveCategoryAccess so the new
parent must be a category of the same authorized company, and guards
against moving into a descendant (cycle). Assigns next sibling sort.

README.md

@@ -188,6 +188,7 @@ Company-scoped brands. Auth via `resolveCompanyAccess`.
 | --- | --- | --- |
 | `createUnderParent` | `({ googleAuthId, parentId, name })` | `{ id, parentId, sort, name, slug }` |
 | `rename` | `({ googleAuthId, id, name })` | `{ id, name, slug }` |
+| `move` | `({ googleAuthId, id, parentId })` | `{ id, parentId, sort }` |
 | `order` | `({ googleAuthId, parentId, categoryIds })` | `{ categoryIds }` |
 | `delete` | `({ googleAuthId, id })` | `void` — blocked by FK if `categoryarticle` or child categories remain |
 | `getTreeForCompany` | `(googleAuthId, companyId)` | `{ languageId, tree, articles }` — tree rows carry `name` + `slug` |
@@ -206,6 +207,8 @@ Company-scoped brands. Auth via `resolveCompanyAccess`.
 
 `order` reorders the direct children of `parentId` to the given `categoryIds` order (each child's `sort` set to its index `0..n-1`). Since a category can have multiple parents, `parentId` scopes which sibling list is reordered. `categoryIds` must be exactly the current children of `parentId` (same set, no dups) else `Invalid category order`. Auth via `resolveCategoryAccess` on `parentId`. Returns `{ categoryIds }`. For `PUT /api/category/order`.
 
+`move` moves a category to a new parent. Both `id` (source) and `parentId` (target) are validated via `resolveCategoryAccess` — the target must be a real category of the same authorized company, else `Parent not found`. Moving into itself or into a descendant (cycle) → `Invalid parent`. The moved category gets the next sibling `sort` under the new parent. Returns `{ id, parentId, sort }`. For `POST /api/category/:id/move`.
+
 ---
 
 ## `article`
@@ -321,6 +324,7 @@ res.set('Content-Type', thumb.contentType).send(thumb.buffer);
 | `POST /api/category` | `category.createUnderParent({ googleAuthId, parentId, name })` |
 | `PATCH /api/category/:id` | `category.rename({ googleAuthId, id, name })` |
 | `PUT /api/category/order` | `category.order({ googleAuthId, parentId, categoryIds })` |
+| `POST /api/category/:id/move` | `category.move({ googleAuthId, id, parentId })` |
 | `DELETE /api/category/:id` | `category.delete({ googleAuthId, id })` |
 | `GET /api/unit?companyId=` | `unit.list(googleAuthId, companyId)` |
 | `PUT /api/unit` | `unit.upsert(googleAuthId, companyId, { si, basesi, basesifactor, symbol, name })` |

scripts/test-api.js

@@ -163,6 +163,7 @@ const MENU = {
     items: [
       { value: 'category.createUnderParent', label: 'createUnderParent', hint: 'googleAuthId, parentId, name → row' },
       { value: 'category.rename', label: 'rename', hint: 'googleAuthId, id, name → row' },
+      { value: 'category.move', label: 'move', hint: 'googleAuthId, id, parentId → row' },
       { value: 'category.order', label: 'order', hint: 'googleAuthId, parentId, JSON categoryIds' },
       { value: 'category.delete', label: 'delete', hint: 'googleAuthId, id' },
       { value: 'category.getTreeForCompany', label: 'getTreeForCompany', hint: 'googleAuthId, companyId → rows' },
@@ -671,6 +672,22 @@ async function runMethod(client, action) {
         }),
       ];
     }
+    case 'category.move': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const id = await askInt('Category id');
+      if (id == null) return;
+      const parentId = await askInt('new parent id');
+      if (parentId == null) return;
+      return [
+        'row',
+        await client.category.move({
+          googleAuthId: Number(googleAuthId),
+          id: Number(id),
+          parentId: Number(parentId),
+        }),
+      ];
+    }
     case 'category.order': {
       const googleAuthId = await askInt('google_auth id');
       if (googleAuthId == null) return;

src/index.js

@@ -9,6 +9,7 @@ import categoryGetTreeForCompany from './store/category/getTreeForCompany.js';
 import categoryGetCategoryArticles from './store/category/getCategoryArticles.js';
 import categoryCreateUnderParent from './store/category/createUnderParent.js';
 import categoryRename from './store/category/rename.js';
+import categoryMove from './store/category/move.js';
 import categoryOrder from './store/category/order.js';
 import categoryDelete from './store/category/delete.js';
 import articleDelete from './store/article/delete.js';
@@ -74,6 +75,7 @@ export default class LibDashStore {
       getCategoryArticles: categoryGetCategoryArticles(pool),
       createUnderParent: categoryCreateUnderParent(pool),
       rename: categoryRename(pool),
+      move: categoryMove(pool),
       order: categoryOrder(pool),
       delete: categoryDelete(pool),
     };

src/sql/category.js

@@ -103,6 +103,30 @@ SET sort = @sort
 WHERE id = @id AND parent_id = @parentId
 `;
 
+/** True if @id is an ancestor of @parentId (would create a cycle when moving). */
+export const IS_ANCESTOR = `
+WITH ancestors AS (
+    SELECT id, parent_id
+    FROM category
+    WHERE id = @parentId
+
+    UNION ALL
+
+    SELECT c.id, c.parent_id
+    FROM category c
+    INNER JOIN ancestors a ON c.id = a.parent_id
+)
+SELECT id
+FROM ancestors
+WHERE id = @id
+`;
+
+export const MOVE = `
+UPDATE category
+SET parent_id = @parentId, sort = @sort
+WHERE id = @id
+`;
+
 export const DELETE = `
 DELETE FROM category
 WHERE id = @id

src/store/category/move.js

@@ -0,0 +1,67 @@
+import {
+  GET_NEXT_SIBLING_SORT,
+  IS_ANCESTOR,
+  MOVE,
+} from '../../sql/category.js';
+import request from '../request.js';
+import resolveCategoryAccess from './resolveCategoryAccess.js';
+
+export default function move(pool) {
+  const access = resolveCategoryAccess(pool);
+
+  return async ({ googleAuthId, id, parentId }) => {
+    // Source category auth (throws if missing / not authorized).
+    const source = await access(googleAuthId, id);
+    // Target must be a valid category for the same authorized user/company.
+    const target = await access(googleAuthId, parentId);
+
+    if (target.companyId !== source.companyId) {
+      throw new Error('Parent not found');
+    }
+
+    if (id === parentId) {
+      throw new Error('Invalid parent');
+    }
+
+    const cycle = await pool
+      .request()
+      .input('id', id)
+      .input('parentId', parentId)
+      .query(IS_ANCESTOR);
+
+    if (cycle.recordset[0]) {
+      throw new Error('Invalid parent');
+    }
+
+    const tx = pool.transaction();
+    await tx.begin();
+
+    try {
+      const sortResult = await request(pool, tx)
+        .input('parentId', parentId)
+        .query(GET_NEXT_SIBLING_SORT);
+      const sort = sortResult.recordset[0].sort;
+
+      const result = await request(pool, tx)
+        .input('id', id)
+        .input('parentId', parentId)
+        .input('sort', sort)
+        .query(MOVE);
+
+      if (!result.rowsAffected[0]) {
+        throw new Error('Category not found');
+      }
+
+      await tx.commit();
+
+      return { id, parentId, sort };
+    } catch (err) {
+      try {
+        await tx.rollback();
+      } catch {
+        // ignore
+      }
+      throw err;
+    }
+  };
+}