feat: move videos to another project (single + bulk)

Add a "Move to project" action in the video card dropdown and the selection-mode toolbar. Videos (with their versions, comments, assets and video-scoped share links) can be moved into another project in the same workspace. - New GET/POST /api/projects/[projectId]/videos/move: GET lists manageable destination projects in the workspace; POST performs the move. - Requires canEdit on both source and destination; same-workspace only. - Move runs in an interactive transaction that re-asserts source ownership atomically (updateMany guarded by projectId) to avoid a TOCTOU race, and returns 409 on conflict. GET is rate-limited ('api').
2026-09-11 09:36:08 +00:00 · 2026-07-10 20:55:12 +07:00
parent 654d3a6bc7
commit 57c5a127d1
4 changed files with 439 additions and 0 deletions
@@ -19,6 +19,7 @@ import {
  Loader2,
  Trash2,
  ChevronDown,
+  FolderInput,
 } from 'lucide-react';
 import { toast } from 'sonner';
 import { Button } from '@/components/ui/button';
@@ -42,6 +43,7 @@ import {
 } from '@/components/ui/alert-dialog';
 import { VideoCard } from '@/components/video-card';
 import { VideoDragDropUploader } from '@/components/video-drag-drop-uploader';
+import { MoveVideosDialog } from '@/components/move-videos-dialog';
 import type { DirectUploadProvider } from '@/components/video-page/types';
 import {
  runProjectDownloadManifest,
@@ -105,6 +107,7 @@ export function ProjectContentClient({
  const [isDownloading, setIsDownloading] = useState(false);
  const [isDeletingSelected, setIsDeletingSelected] = useState(false);
  const [showDeleteSelectedDialog, setShowDeleteSelectedDialog] = useState(false);
+  const [showMoveSelectedDialog, setShowMoveSelectedDialog] = useState(false);

  const canSelectVideos = canDownloadProject || canEdit;

@@ -138,6 +141,13 @@ export function ProjectContentClient({
    setSelectedVideoIds((prev) => prev.filter((id) => id !== videoId));
  }, []);

+  const handleVideosMoved = useCallback((movedIds: string[]) => {
+    const moved = new Set(movedIds);
+    setLocalVideos((prev) => prev.filter((video) => !moved.has(video.id)));
+    setSelectedVideoIds([]);
+    setSelectionMode(false);
+  }, []);
+
  const toggleVideoSelection = useCallback((videoId: string, selected: boolean) => {
    setSelectedVideoIds((prev) => {
      if (selected) {
@@ -447,6 +457,17 @@ export function ProjectContentClient({
                </DropdownMenuContent>
              </DropdownMenu>
            )}
+            {canEdit && (
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={() => setShowMoveSelectedDialog(true)}
+                disabled={selectedCount === 0 || isDeletingSelected}
+              >
+                <FolderInput className="h-4 w-4 mr-2" />
+                Move to project
+              </Button>
+            )}
            {canEdit && (
              <Button
                variant="destructive"
@@ -561,6 +582,14 @@ export function ProjectContentClient({
          </AlertDialogFooter>
        </AlertDialogContent>
      </AlertDialog>
+
+      <MoveVideosDialog
+        open={showMoveSelectedDialog}
+        onOpenChange={setShowMoveSelectedDialog}
+        projectId={projectId}
+        videoIds={selectedVideoIds}
+        onMoved={handleVideosMoved}
+      />
    </>
  );
 }
@@ -0,0 +1,221 @@
+import { NextRequest } from 'next/server';
+import { revalidatePath } from 'next/cache';
+import { auth, checkProjectAccess } from '@/lib/auth';
+import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
+import { db } from '@/lib/db';
+import { logError } from '@/lib/logger';
+import { rateLimit } from '@/lib/rate-limit';
+
+type RouteParams = { params: Promise<{ projectId: string }> };
+
+const MAX_BULK_MOVE = 50;
+
+// Thrown inside the move transaction when the atomic source-ownership re-check
+// fails (a concurrent request relocated a video between check and commit).
+class VideoMoveConflictError extends Error {}
+
+// GET /api/projects/[projectId]/videos/move
+// Lists destination projects (same workspace, manageable by the user) the
+// current project's videos can be moved into.
+export async function GET(request: NextRequest, { params }: RouteParams) {
+  try {
+    const limited = await rateLimit(request, 'api');
+    if (limited) return limited;
+
+    const session = await auth();
+    const { projectId } = await params;
+
+    if (!session?.user?.id) {
+      return apiErrors.unauthorized();
+    }
+    const userId = session.user.id;
+
+    const project = await db.project.findUnique({
+      where: { id: projectId },
+      select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+    });
+    if (!project) {
+      return apiErrors.notFound('Project');
+    }
+
+    const access = await checkProjectAccess(project, userId, { intent: 'manage' });
+    if (!access.canEdit) {
+      return apiErrors.forbidden('Access denied');
+    }
+
+    // Workspace owners/admins can manage every project in the workspace; everyone
+    // else can only move into projects they own or are an admin member of.
+    const [workspace, workspaceMember] = await Promise.all([
+      db.workspace.findUnique({
+        where: { id: project.workspaceId },
+        select: { ownerId: true },
+      }),
+      db.workspaceMember.findUnique({
+        where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
+      }),
+    ]);
+    const isWorkspaceManager = workspace?.ownerId === userId || workspaceMember?.role === 'ADMIN';
+
+    const targets = await db.project.findMany({
+      where: {
+        workspaceId: project.workspaceId,
+        id: { not: projectId },
+        ...(isWorkspaceManager
+          ? {}
+          : {
+              OR: [{ ownerId: userId }, { members: { some: { userId, role: 'ADMIN' } } }],
+            }),
+      },
+      orderBy: { name: 'asc' },
+      select: { id: true, name: true },
+    });
+
+    const response = successResponse({ projects: targets });
+    return withCacheControl(response, 'private, no-store');
+  } catch (error) {
+    logError('Error listing video move targets:', error);
+    return apiErrors.internalError('Failed to load destination projects');
+  }
+}
+
+// POST /api/projects/[projectId]/videos/move
+// Moves one or more videos from this project into another project in the same
+// workspace. Versions, comments and assets follow the video automatically.
+export async function POST(request: NextRequest, { params }: RouteParams) {
+  try {
+    const limited = await rateLimit(request, 'mutate');
+    if (limited) return limited;
+
+    const session = await auth();
+    const { projectId } = await params;
+
+    if (!session?.user?.id) {
+      return apiErrors.unauthorized();
+    }
+    const userId = session.user.id;
+
+    const body = await request.json();
+    const { videoIds, targetProjectId } = body as {
+      videoIds?: unknown;
+      targetProjectId?: unknown;
+    };
+
+    if (!Array.isArray(videoIds) || videoIds.length === 0) {
+      return apiErrors.badRequest('videoIds must be a non-empty array');
+    }
+    if (videoIds.length > MAX_BULK_MOVE) {
+      return apiErrors.badRequest(`You can move at most ${MAX_BULK_MOVE} videos at once`);
+    }
+    if (!videoIds.every((id) => typeof id === 'string' && id.trim().length > 0)) {
+      return apiErrors.badRequest('Each video id must be a non-empty string');
+    }
+    if (typeof targetProjectId !== 'string' || targetProjectId.trim().length === 0) {
+      return apiErrors.badRequest('targetProjectId must be a non-empty string');
+    }
+
+    const normalizedIds = [...new Set(videoIds.map((id) => id.trim()))];
+    const targetId = targetProjectId.trim();
+
+    if (targetId === projectId) {
+      return apiErrors.badRequest('Source and destination projects are the same');
+    }
+
+    const [sourceProject, targetProject] = await Promise.all([
+      db.project.findUnique({
+        where: { id: projectId },
+        select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+      }),
+      db.project.findUnique({
+        where: { id: targetId },
+        select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+      }),
+    ]);
+    if (!sourceProject) {
+      return apiErrors.notFound('Project');
+    }
+    if (!targetProject) {
+      return apiErrors.badRequest('Destination project not found');
+    }
+    if (sourceProject.workspaceId !== targetProject.workspaceId) {
+      return apiErrors.badRequest('Videos can only be moved within the same workspace');
+    }
+
+    const [sourceAccess, targetAccess] = await Promise.all([
+      checkProjectAccess(sourceProject, userId, { intent: 'manage' }),
+      checkProjectAccess(targetProject, userId, { intent: 'manage' }),
+    ]);
+    if (!sourceAccess.canEdit) {
+      return apiErrors.forbidden('You cannot move videos out of this project');
+    }
+    if (!targetAccess.canEdit) {
+      return apiErrors.forbidden('You cannot move videos into the selected project');
+    }
+
+    // Fast, friendly pre-check for the common case (stale UI). The authoritative
+    // ownership guard is re-asserted atomically inside the transaction below.
+    const videos = await db.video.findMany({
+      where: { id: { in: normalizedIds }, projectId },
+      select: { id: true },
+    });
+    if (videos.length !== normalizedIds.length) {
+      return apiErrors.badRequest('One or more selected videos do not belong to this project');
+    }
+
+    try {
+      await db.$transaction(async (tx) => {
+        // Append moved videos after the destination's existing videos so ordering
+        // stays stable instead of colliding with the source positions. Read this
+        // before the move so the videos being moved aren't counted yet.
+        const maxPosition = await tx.video.aggregate({
+          where: { projectId: targetId },
+          _max: { position: true },
+        });
+        const basePosition = (maxPosition._max.position ?? -1) + 1;
+
+        // Re-assert source ownership as part of the write itself: a concurrent
+        // move can't slip a video out from under us between check and commit,
+        // and the row locks serialize competing moves of the same videos.
+        const moved = await tx.video.updateMany({
+          where: { id: { in: normalizedIds }, projectId },
+          data: { projectId: targetId },
+        });
+        if (moved.count !== normalizedIds.length) {
+          throw new VideoMoveConflictError();
+        }
+
+        // Apply per-video ordering now that the videos live in the destination.
+        await Promise.all(
+          normalizedIds.map((id, index) =>
+            tx.video.update({ where: { id }, data: { position: basePosition + index } })
+          )
+        );
+
+        // Keep video-scoped share links pointing at the video's new project.
+        await tx.shareLink.updateMany({
+          where: { videoId: { in: normalizedIds } },
+          data: { projectId: targetId },
+        });
+      });
+    } catch (error) {
+      if (error instanceof VideoMoveConflictError) {
+        return apiErrors.conflict(
+          'One or more selected videos changed while moving. Please refresh and try again.'
+        );
+      }
+      throw error;
+    }
+
+    revalidatePath(`/projects/${projectId}`);
+    revalidatePath(`/projects/${targetId}`);
+
+    const response = successResponse({
+      message: `${normalizedIds.length} video${normalizedIds.length === 1 ? '' : 's'} moved`,
+      movedCount: normalizedIds.length,
+      targetProjectId: targetId,
+    });
+    return withCacheControl(response, 'private, no-store');
+  } catch (error) {
+    logError('Error moving videos:', error);
+    return apiErrors.internalError('Failed to move videos');
+  }
+}