Moving a file into a folder should check write on that folder
A
Practical lessons on auth, authorization, and access control.
Most move endpoints check whether you can update the file. They skip the destination. A teammate with read access on a shared report and no write access on the Finance folder can still drop that report into Finance, and everyone with Finance access suddenly sees it.
Authorize create or write on the destination folder before you change the parent. Apply the same check to drag-and-drop and to bulk moves. If the check fails, leave the file where it is and return an error the UI can show.
Quick test: grant a user read on one file and no write on a private folder. Attempt the move through the API and the UI. Both should fail, and the parent folder id should not change.