From 453b60032c5b13ebd428cb4de496510a8a403b2d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Leon=20B=C3=B6sche?= <leonboesche1999@gmail.com>
Date: Wed, 14 Jan 2026 18:26:02 +0100
Subject: [PATCH] Implement folder move restrictions in file explorer and
 backend; prevent moving a folder into itself or its own subfolder.

---
 b0esche_cloud/lib/pages/file_explorer.dart | 32 ++++++++++++++++++++--
 go_cloud/internal/http/routes.go           | 28 +++++++++++++++++++
 2 files changed, 58 insertions(+), 2 deletions(-)

diff --git a/b0esche_cloud/lib/pages/file_explorer.dart b/b0esche_cloud/lib/pages/file_explorer.dart
index 458ab13..6ae2c89 100644
--- a/b0esche_cloud/lib/pages/file_explorer.dart
+++ b/b0esche_cloud/lib/pages/file_explorer.dart
@@ -1456,11 +1456,39 @@ class _FileExplorerState extends State<FileExplorer> {
                               );
                             },
                             onAcceptWithDetails: (draggedFile) {
+                              final sourcePath = draggedFile.data.path;
+                              final targetPath = file.path;
+
+                              // Prevent dragging a folder into itself
+                              if (sourcePath == targetPath) {
+                                ScaffoldMessenger.of(context).showSnackBar(
+                                  const SnackBar(
+                                    content: Text(
+                                      'Cannot move a folder into itself',
+                                    ),
+                                  ),
+                                );
+                                return;
+                              }
+
+                              // Prevent dragging a folder into its own subfolder
+                              if (targetPath.startsWith('$sourcePath/') ||
+                                  targetPath.startsWith('$sourcePath\\')) {
+                                ScaffoldMessenger.of(context).showSnackBar(
+                                  const SnackBar(
+                                    content: Text(
+                                      'Cannot move a folder into its own subfolder',
+                                    ),
+                                  ),
+                                );
+                                return;
+                              }
+
                               context.read<FileBrowserBloc>().add(
                                 MoveFile(
                                   orgId: widget.orgId,
-                                  sourcePath: draggedFile.data.path,
-                                  targetPath: file.path,
+                                  sourcePath: sourcePath,
+                                  targetPath: targetPath,
                                 ),
                               );
                             },
diff --git a/go_cloud/internal/http/routes.go b/go_cloud/internal/http/routes.go
index 4b508ef..440fba1 100644
--- a/go_cloud/internal/http/routes.go
+++ b/go_cloud/internal/http/routes.go
@@ -1464,6 +1464,20 @@ func moveOrgFileHandler(w http.ResponseWriter, r *http.Request, db *database.DB,
 		return
 	}
 
+	// Prevent moving a folder into itself or its own subfolders
+	if sourceFile.Type == "folder" {
+		// Check if trying to move into itself
+		if req.SourcePath == req.TargetPath {
+			errors.WriteError(w, errors.CodeInvalidArgument, "Cannot move a folder into itself", http.StatusBadRequest)
+			return
+		}
+		// Check if target is a subfolder of source
+		if strings.HasPrefix(req.TargetPath, req.SourcePath+"/") {
+			errors.WriteError(w, errors.CodeInvalidArgument, "Cannot move a folder into its own subfolder", http.StatusBadRequest)
+			return
+		}
+	}
+
 	// Determine new file name - check if target is a folder
 	var newPath string
 	var targetFile *database.File
@@ -1670,6 +1684,20 @@ func moveUserFileHandler(w http.ResponseWriter, r *http.Request, db *database.DB
 		return
 	}
 
+	// Prevent moving a folder into itself or its own subfolders
+	if sourceFile.Type == "folder" {
+		// Check if trying to move into itself
+		if req.SourcePath == req.TargetPath {
+			errors.WriteError(w, errors.CodeInvalidArgument, "Cannot move a folder into itself", http.StatusBadRequest)
+			return
+		}
+		// Check if target is a subfolder of source
+		if strings.HasPrefix(req.TargetPath, req.SourcePath+"/") {
+			errors.WriteError(w, errors.CodeInvalidArgument, "Cannot move a folder into its own subfolder", http.StatusBadRequest)
+			return
+		}
+	}
+
 	// Determine new file name - check if target is a folder
 	var newPath string
 	var targetFile *database.File