Nested folders: Fix move (#65526)

* Nested Folders: Fix move response

Fix JSON tags to be consistent with the GET endpoint

* Add API test for moving to root folder

* Allow move to root folder

* Fix failure message

* Update OpenAPI specification

pkg/api/folder.go

@@ -201,25 +201,37 @@ func (hs *HTTPServer) setDefaultFolderPermissions(ctx context.Context, orgID int
 	return nil
 }
 
+// swagger:route POST /folders/{folder_uid}/move folders moveFolder
+//
+// Move folder.
+//
+// Responses:
+// 200: folderResponse
+// 401: unauthorisedError
+// 403: forbiddenError
+// 404: notFoundError
+// 500: internalServerError
 func (hs *HTTPServer) MoveFolder(c *contextmodel.ReqContext) response.Response {
 	if hs.Features.IsEnabled(featuremgmt.FlagNestedFolders) {
 		cmd := folder.MoveFolderCommand{}
 		if err := web.Bind(c.Req, &cmd); err != nil {
 			return response.Error(http.StatusBadRequest, "bad request data", err)
 		}
-		var theFolder *folder.Folder
 		var err error
 
-		if cmd.NewParentUID != "" {
-			cmd.OrgID = c.OrgID
-			cmd.UID = web.Params(c.Req)[":uid"]
-			cmd.SignedInUser = c.SignedInUser
-			theFolder, err = hs.folderService.Move(c.Req.Context(), &cmd)
-			if err != nil {
-				return response.Error(http.StatusInternalServerError, "update folder uid failed", err)
-			}
+		cmd.OrgID = c.OrgID
+		cmd.UID = web.Params(c.Req)[":uid"]
+		cmd.SignedInUser = c.SignedInUser
+		theFolder, err := hs.folderService.Move(c.Req.Context(), &cmd)
+		if err != nil {
+			return response.Error(http.StatusInternalServerError, "move folder failed", err)
 		}
-		return response.JSON(http.StatusOK, theFolder)
+
+		g, err := guardian.NewByUID(c.Req.Context(), cmd.UID, c.OrgID, c.SignedInUser)
+		if err != nil {
+			return response.Err(err)
+		}
+		return response.JSON(http.StatusOK, hs.newToFolderDto(c, g, theFolder))
 	}
 	result := map[string]string{}
 	result["message"] = "To use this service, you need to activate nested folder feature."
@@ -408,6 +420,16 @@ type CreateFolderParams struct {
 	Body folder.CreateFolderCommand `json:"body"`
 }
 
+// swagger:parameters moveFolder
+type MoveFolderParams struct {
+	// in:path
+	// required:true
+	FolderUID string `json:"folder_uid"`
+	// in:body
+	// required:true
+	Body folder.MoveFolderCommand `json:"body"`
+}
+
 // swagger:parameters deleteFolder
 type DeleteFolderParams struct {
 	// in:path

pkg/api/folder_test.go

@@ -359,7 +359,9 @@ func TestHTTPServer_FolderMetadata(t *testing.T) {
 }
 
 func TestFolderMoveAPIEndpoint(t *testing.T) {
-	folderService := &foldertest.FakeService{}
+	folderService := &foldertest.FakeService{
+		ExpectedFolder: &folder.Folder{},
+	}
 	setUpRBACGuardian(t)
 
 	type testCase struct {
@@ -378,6 +380,14 @@ func TestFolderMoveAPIEndpoint(t *testing.T) {
 				{Action: dashboards.ActionFoldersWrite, Scope: dashboards.ScopeFoldersProvider.GetResourceScopeUID("newParentUid")},
 			},
 		},
+		{
+			description:  "can move folder to the root folder with specific permissions",
+			newParentUid: "",
+			expectedCode: http.StatusOK,
+			permissions: []accesscontrol.Permission{
+				{Action: dashboards.ActionFoldersWrite, Scope: dashboards.ScopeFoldersProvider.GetResourceScopeUID("uid")},
+			},
+		},
 		{
 			description:  "forbidden to move folder to another folder without the write access on the folder being moved",
 			newParentUid: "newParentUid",