Enable a list to be moved across namespaces

pkg/models/list.go

@@ -630,6 +630,7 @@ func UpdateList(s *xorm.Session, list *List, auth web.Auth, updateListBackground
 		"is_archived",
 		"identifier",
 		"hex_color",
+		"namespace_id",
 		"position",
 	}
 	if list.Description != "" {

pkg/models/list_rights.go

@@ -116,6 +116,25 @@ func (l *List) CanUpdate(s *xorm.Session, a web.Auth) (canUpdate bool, err error
 		return false, nil
 	}
 
+	// Get the list
+	ol, err := GetListSimpleByID(s, l.ID)
+	if err != nil {
+		return false, err
+	}
+
+	// Check if we're moving the list into a different namespace.
+	// If that is the case, we need to verify permissions to do so.
+	if l.NamespaceID != 0 && l.NamespaceID != ol.NamespaceID {
+		newNamespace := &Namespace{ID: l.NamespaceID}
+		can, err := newNamespace.CanWrite(s, a)
+		if err != nil {
+			return false, err
+		}
+		if !can {
+			return false, ErrGenericForbidden{}
+		}
+	}
+
 	fid := getSavedFilterIDFromListID(l.ID)
 	if fid > 0 {
 		sf, err := getSavedFilterSimpleByID(s, fid)

pkg/models/list_test.go

@@ -163,6 +163,65 @@ func TestList_CreateOrUpdate(t *testing.T) {
 			assert.True(t, IsErrListIdentifierIsNotUnique(err))
 			_ = s.Close()
 		})
+		t.Run("change namespace", func(t *testing.T) {
+			t.Run("own", func(t *testing.T) {
+				usr := &user.User{
+					ID:       6,
+					Username: "user6",
+					Email:    "user6@example.com",
+				}
+
+				db.LoadAndAssertFixtures(t)
+				s := db.NewSession()
+				list := List{
+					ID:          6,
+					Title:       "Test6",
+					Description: "Lorem Ipsum",
+					NamespaceID: 7, // from 6
+				}
+				can, err := list.CanUpdate(s, usr)
+				assert.NoError(t, err)
+				assert.True(t, can)
+				err = list.Update(s, usr)
+				assert.NoError(t, err)
+				err = s.Commit()
+				assert.NoError(t, err)
+				db.AssertExists(t, "lists", map[string]interface{}{
+					"id":           list.ID,
+					"title":        list.Title,
+					"description":  list.Description,
+					"namespace_id": list.NamespaceID,
+				}, false)
+			})
+			// FIXME: The check for whether the namespace is archived is missing in namespace.CanWrite
+			// t.Run("archived own", func(t *testing.T) {
+			// 	db.LoadAndAssertFixtures(t)
+			// 	s := db.NewSession()
+			// 	list := List{
+			// 		ID:          1,
+			// 		Title:       "Test1",
+			// 		Description: "Lorem Ipsum",
+			// 		NamespaceID: 16, // from 1
+			// 	}
+			// 	can, err := list.CanUpdate(s, usr)
+			// 	assert.NoError(t, err)
+			// 	assert.False(t, can) // namespace is archived and thus not writeable
+			// 	_ = s.Close()
+			// })
+			t.Run("others", func(t *testing.T) {
+				db.LoadAndAssertFixtures(t)
+				s := db.NewSession()
+				list := List{
+					ID:          1,
+					Title:       "Test1",
+					Description: "Lorem Ipsum",
+					NamespaceID: 2, // from 1
+				}
+				can, _ := list.CanUpdate(s, usr)
+				assert.False(t, can) // namespace is not writeable by us
+				_ = s.Close()
+			})
+		})
 	})
 }