Method opMoveFiles

src/FileRise/Domain/McpCoreOpsService.php:1024–1111

* @param array $payload * @return array */

(McpOpsContext $ctx, array $payload)

     * @return array<string,mixed>
     */
    private static function opMoveFiles(McpOpsContext $ctx, array $payload): array
    {
        self::assertWritableAccount($ctx, true);

        $sourceFolder = self::normalizeFolder((string)($payload['source'] ?? 'root'));
        $destinationFolder = self::normalizeFolder((string)($payload['destination'] ?? 'root'));
        $files = self::normalizeFileList($payload['files'] ?? []);

        $sourcePair = self::resolveSourcePair($payload);
        $sourceId = $sourcePair['sourceId'];
        $destSourceId = $sourcePair['destSourceId'];
        $crossSource = $sourcePair['crossSource'];

        if ($crossSource && (!class_exists(SourceContext::class) || !SourceContext::sourcesEnabled())) {
            throw new RuntimeException('Cross-source operations require sources to be enabled.', 400);
        }

        if ($crossSource) {
            return self::opMoveFilesCrossSource(
                $ctx,
                $sourceFolder,
                $destinationFolder,
                $files,
                $sourceId,
                $destSourceId
            );
        }

        $singlePayload = $payload;
        if ($sourceId !== '') {
            $singlePayload['sourceId'] = $sourceId;
        }

        return self::withSourceContext(
            $ctx,
            $singlePayload,
            true,
            function () use ($ctx, $sourceFolder, $destinationFolder, $files): array {
                $username = $ctx->username();
                $perms = $ctx->permissions();

                $hasSourceView = ACL::canReadOwn($username, $perms, $sourceFolder)
                || ACL::ownsFolderOrAncestor($username, $perms, $sourceFolder);
                if (!$hasSourceView) {
                    throw new RuntimeException('Forbidden: no read access to source.', 403);
                }

                $hasSourceDelete = ACL::canDelete($username, $perms, $sourceFolder)
                || ACL::ownsFolderOrAncestor($username, $perms, $sourceFolder);
                if (!$hasSourceDelete) {
                    throw new RuntimeException('Forbidden: no delete permission on source.', 403);
                }

                $hasDestMove = ACL::canMove($username, $perms, $destinationFolder)
                || ACL::ownsFolderOrAncestor($username, $perms, $destinationFolder);
                if (!$hasDestMove) {
                    throw new RuntimeException('Forbidden: no move permission on destination.', 403);
                }