feat(lists): drag tasks and list entries onto another list; remember open list and view; live pill in lists

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/server_test.go

@@ -1560,3 +1560,50 @@ func testSession(t *testing.T, store *storage.Store, userID string) string {
 	}
 	return sid
 }
+
+// List entries move between lists only if the user may edit both
+func TestMoveListItemBetweenLists(t *testing.T) {
+	srv, store, token := setupTestServer(t)
+	router := srv.Router()
+	claims, _ := auth.ValidateToken(testJWTSecret, token)
+	move := func(listID, itemID, target string) int {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/lists/"+listID+"/items/"+itemID+"/move", strings.NewReader(`{"targetListId":"`+target+`"}`))
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("Authorization", "Bearer "+token)
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, req)
+		return rec.Code
+	}
+
+	from, _ := store.CreateList(claims.UserID, "Einkauf", "", "shopping")
+	to, _ := store.CreateList(claims.UserID, "Baumarkt", "", "shopping")
+	item, _ := store.CreateListItem(from.ID, "Schrauben", "werkzeug", "20", 3, claims.UserID)
+
+	if code := move(from.ID, item.ID, to.ID); code != http.StatusOK {
+		t.Fatalf("move: %d", code)
+	}
+	if items, _ := store.GetListItems(from.ID); len(items) != 0 {
+		t.Fatalf("item still in the source list: %+v", items)
+	}
+	items, _ := store.GetListItems(to.ID)
+	if len(items) != 1 || items[0].Content != "Schrauben" || items[0].Category != "werkzeug" || items[0].Quantity != "20" {
+		t.Fatalf("item not moved intact: %+v", items)
+	}
+
+	// Read-only target and foreign lists are refused
+	other, _ := store.CreateUser("other@example.com", "hash", "Other", "member")
+	readOnly, _ := store.CreateList(other.ID, "Nur lesen", "", "shopping")
+	if _, err := store.AddListShare(other.ID, readOnly.ID, "user", claims.UserID, "viewer"); err != nil {
+		t.Fatalf("share: %v", err)
+	}
+	if code := move(to.ID, item.ID, readOnly.ID); code != http.StatusForbidden {
+		t.Fatalf("read-only target must be refused, got %d", code)
+	}
+	foreign, _ := store.CreateList(other.ID, "Fremd", "", "shopping")
+	if code := move(to.ID, item.ID, foreign.ID); code != http.StatusNotFound {
+		t.Fatalf("foreign target must be refused, got %d", code)
+	}
+	if code := move(from.ID, item.ID, to.ID); code != http.StatusNotFound {
+		t.Fatalf("item addressed through the wrong list must be refused, got %d", code)
+	}
+}