feat(lists): drag tasks and list entries onto another list; remember open list and view; live pill in lists

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/handlers_lists.go

@@ -245,6 +245,48 @@ func (s *Server) handleDeleteListItem(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
 }
 
+// handleMoveListItem moves an item into another list; the user must be allowed to edit both lists
+func (s *Server) handleMoveListItem(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+	itemID := chi.URLParam(r, "itemId")
+	if !s.listItemsWriteAllowed(w, r, itemID) {
+		return
+	}
+	var req struct {
+		TargetListID string `json:"targetListId"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.TargetListID == "" {
+		writeError(w, http.StatusBadRequest, "Zielliste fehlt")
+		return
+	}
+	if req.TargetListID == listID {
+		writeError(w, http.StatusBadRequest, "Eintrag ist bereits in dieser Liste")
+		return
+	}
+	if err := s.store.EnsureListItemsWritable(userID, req.TargetListID, ""); err != nil {
+		if errors.Is(err, storage.ErrListReadOnly) {
+			writeError(w, http.StatusForbidden, err.Error())
+		} else {
+			writeError(w, http.StatusNotFound, err.Error())
+		}
+		return
+	}
+
+	item, err := s.store.MoveListItem(itemID, req.TargetListID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	s.wsHub.BroadcastListEvent(listID, "ITEM_DELETED", map[string]string{
+		"itemId": itemID,
+		"listId": listID,
+	})
+	s.wsHub.BroadcastListEvent(req.TargetListID, "ITEM_CREATED", item)
+	writeJSON(w, http.StatusOK, item)
+}
+
 func (s *Server) handleClearCompletedItems(w http.ResponseWriter, r *http.Request) {
 	listID := chi.URLParam(r, "id")
 	if !s.listItemsWriteAllowed(w, r, "") {

internal/api/server.go

@@ -263,6 +263,7 @@ func (s *Server) Router() http.Handler {
 		r.Patch("/api/v1/lists/{id}/items/{itemId}", s.handleToggleListItem)
 		r.Put("/api/v1/lists/{id}/items/{itemId}", s.handleUpdateListItem)
 		r.Delete("/api/v1/lists/{id}/items/{itemId}", s.handleDeleteListItem)
+		r.Post("/api/v1/lists/{id}/items/{itemId}/move", s.handleMoveListItem)
 		r.Post("/api/v1/lists/{id}/items/reorder", s.handleReorderListItems)
 		r.Put("/api/v1/lists/{id}/items/reorder", s.handleReorderListItems)
 		r.Post("/api/v1/lists/{id}/clear-completed", s.handleClearCompletedItems)

internal/api/server_test.go

@@ -1560,3 +1560,50 @@ func testSession(t *testing.T, store *storage.Store, userID string) string {
 	}
 	return sid
 }
+
+// List entries move between lists only if the user may edit both
+func TestMoveListItemBetweenLists(t *testing.T) {
+	srv, store, token := setupTestServer(t)
+	router := srv.Router()
+	claims, _ := auth.ValidateToken(testJWTSecret, token)
+	move := func(listID, itemID, target string) int {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/lists/"+listID+"/items/"+itemID+"/move", strings.NewReader(`{"targetListId":"`+target+`"}`))
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("Authorization", "Bearer "+token)
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, req)
+		return rec.Code
+	}
+
+	from, _ := store.CreateList(claims.UserID, "Einkauf", "", "shopping")
+	to, _ := store.CreateList(claims.UserID, "Baumarkt", "", "shopping")
+	item, _ := store.CreateListItem(from.ID, "Schrauben", "werkzeug", "20", 3, claims.UserID)
+
+	if code := move(from.ID, item.ID, to.ID); code != http.StatusOK {
+		t.Fatalf("move: %d", code)
+	}
+	if items, _ := store.GetListItems(from.ID); len(items) != 0 {
+		t.Fatalf("item still in the source list: %+v", items)
+	}
+	items, _ := store.GetListItems(to.ID)
+	if len(items) != 1 || items[0].Content != "Schrauben" || items[0].Category != "werkzeug" || items[0].Quantity != "20" {
+		t.Fatalf("item not moved intact: %+v", items)
+	}
+
+	// Read-only target and foreign lists are refused
+	other, _ := store.CreateUser("other@example.com", "hash", "Other", "member")
+	readOnly, _ := store.CreateList(other.ID, "Nur lesen", "", "shopping")
+	if _, err := store.AddListShare(other.ID, readOnly.ID, "user", claims.UserID, "viewer"); err != nil {
+		t.Fatalf("share: %v", err)
+	}
+	if code := move(to.ID, item.ID, readOnly.ID); code != http.StatusForbidden {
+		t.Fatalf("read-only target must be refused, got %d", code)
+	}
+	foreign, _ := store.CreateList(other.ID, "Fremd", "", "shopping")
+	if code := move(to.ID, item.ID, foreign.ID); code != http.StatusNotFound {
+		t.Fatalf("foreign target must be refused, got %d", code)
+	}
+	if code := move(from.ID, item.ID, to.ID); code != http.StatusNotFound {
+		t.Fatalf("item addressed through the wrong list must be refused, got %d", code)
+	}
+}