Better endpoint to move transactions.

app/Api/V1/Controllers/Data/Bulk/AccountController.php

@@ -12,11 +12,16 @@ use Illuminate\Http\JsonResponse;
 
 /**
  * Class AccountController
+ *
+ * @deprecated
  */
 class AccountController extends Controller
 {
     private AccountRepositoryInterface $repository;
 
+    /**
+     *
+     */
     public function __construct()
     {
         parent::__construct();
@@ -37,8 +42,8 @@ class AccountController extends Controller
      */
     public function moveTransactions(MoveTransactionsRequest $request): JsonResponse
     {
-        $accountIds  = $request->getAll();
-        $original    = $this->repository->find($accountIds['original_account']);
+        $accountIds = $request->getAll();
+        $original = $this->repository->find($accountIds['original_account']);
         $destination = $this->repository->find($accountIds['destination_account']);
 
         /** @var AccountDestroyService $service */

app/Api/V1/Controllers/Data/Bulk/TransactionController.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace FireflyIII\Api\V1\Controllers\Data\Bulk;
+
+use FireflyIII\Api\V1\Controllers\Controller;
+use FireflyIII\Api\V1\Requests\Data\Bulk\TransactionRequest;
+use FireflyIII\Repositories\Account\AccountRepositoryInterface;
+use FireflyIII\Services\Internal\Destroy\AccountDestroyService;
+use Illuminate\Http\JsonResponse;
+
+/**
+ * Class TransactionController
+ *
+ * Endpoint to update transactions by submitting
+ * (optional) a "where" clause and an "update"
+ * clause.
+ *
+ * Because this is a security nightmare waiting to happen validation
+ * is pretty strict.
+ */
+class TransactionController extends Controller
+{
+    private AccountRepositoryInterface $repository;
+
+    /**
+     *
+     */
+    public function __construct()
+    {
+        parent::__construct();
+        $this->middleware(
+            function ($request, $next) {
+                $this->repository = app(AccountRepositoryInterface::class);
+                $this->repository->setUser(auth()->user());
+
+                return $next($request);
+            }
+        );
+    }
+
+    /**
+     * @param TransactionRequest $request
+     *
+     * @return JsonResponse
+     */
+    public function update(TransactionRequest $request): JsonResponse
+    {
+        $query  = $request->getAll();
+        $params = $query['query'];
+        // this deserves better code, but for now a loop of basic if-statements
+        // to respond to what is in the $query.
+        // this is OK because only one thing can be in the query at the moment.
+        if ($this->updatesTransactionAccount($params)) {
+            $original    = $this->repository->find((int)$params['where']['source_account_id']);
+            $destination = $this->repository->find((int)$params['update']['destination_account_id']);
+
+            /** @var AccountDestroyService $service */
+            $service = app(AccountDestroyService::class);
+            $service->moveTransactions($original, $destination);
+        }
+
+        return response()->json([], 204);
+    }
+
+    /**
+     * @param array $params
+     *
+     * @return bool
+     */
+    private function updatesTransactionAccount(array $params): bool
+    {
+        return array_key_exists('source_account_id', $params['where']) && array_key_exists('destination_account_id', $params['update']);
+    }
+
+}

app/Api/V1/Requests/Data/Bulk/TransactionRequest.php

@@ -0,0 +1,64 @@
+<?php
+
+namespace FireflyIII\Api\V1\Requests\Data\Bulk;
+
+use FireflyIII\Enums\ClauseType;
+use FireflyIII\Rules\IsValidBulkClause;
+use FireflyIII\Support\Request\ChecksLogin;
+use FireflyIII\Support\Request\ConvertsDataTypes;
+use FireflyIII\Validation\Api\Data\Bulk\ValidatesBulkTransactionQuery;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Validator;
+use JsonException;
+use Log;
+
+/**
+ * Class TransactionRequest
+ */
+class TransactionRequest extends FormRequest
+{
+    use ChecksLogin, ConvertsDataTypes, ValidatesBulkTransactionQuery;
+
+    /**
+     * @return array
+     */
+    public function getAll(): array
+    {
+        $data = [];
+        try {
+            $data = [
+                'query' => json_decode($this->get('query'), true, 8, JSON_THROW_ON_ERROR),
+            ];
+        } catch (JsonException $e) {
+            // dont really care. the validation should catch invalid json.
+            Log::error($e->getMessage());
+        }
+
+        return $data;
+    }
+
+    /**
+     * @return string[]
+     */
+    public function rules(): array
+    {
+        return [
+            'query' => ['required', 'min:1', 'max:255', 'json', new IsValidBulkClause(ClauseType::TRANSACTION)],
+        ];
+    }
+
+    /**
+     * @param Validator $validator
+     *
+     * @return void
+     */
+    public function withValidator(Validator $validator): void
+    {
+        $validator->after(
+            function (Validator $validator) {
+                // validate transaction query data.
+                $this->validateTransactionQuery($validator);
+            }
+        );
+    }
+}