fix: PATCH-Buchung ohne Feld laesst Kategorie unveraendert, 404 bei unbekannter Kategorie

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

finance/app/routers/transactions.py

@@ -8,7 +8,7 @@ from sqlalchemy.orm import Session
 
 from app.auth import require_auth
 from app.db import get_session
-from app.models.tables import Transaction
+from app.models.tables import Category, Transaction
 from app.parsers.validate import dedup_hash
 from app.services.categorize import apply_rules
 
@@ -110,6 +110,9 @@ def patch_transaction(tx_id: int, data: TransactionPatch,
     tx = session.get(Transaction, tx_id)
     if tx is None:
         raise HTTPException(404, "Buchung nicht gefunden")
+    if "category_id" in data.model_fields_set:
+        if data.category_id is not None and session.get(Category, data.category_id) is None:
+            raise HTTPException(404, "Kategorie nicht gefunden")
         tx.category_id = data.category_id
     session.commit()
     session.refresh(tx)

finance/tests/test_crud_api.py

@@ -48,3 +48,32 @@ def test_rules_categorize(client):
     txs = client.get("/api/transactions", headers=H,
                      params={"account_id": acc["id"]}).json()
     assert txs[0]["category_id"] == cat["id"]
+
+
+def test_patch_transaction_category(client):
+    cat = client.post("/api/categories", headers=H, json={"name": "Freizeit"}).json()
+    acc = client.post("/api/accounts", headers=H, json={
+        "bank": "DKB", "iban": "DE77", "name": "G3", "type": "giro"}).json()
+    tx = client.post("/api/transactions", headers=H, json={
+        "account_id": acc["id"], "booking_date": "2026-07-04",
+        "amount": "-15.00", "purpose": "Kino", "counterparty": ""}).json()
+    tx_id = tx["id"]
+    assert tx["category_id"] is None
+
+    r = client.patch(f"/api/transactions/{tx_id}", headers=H,
+                     json={"category_id": cat["id"]})
+    assert r.status_code == 200
+    assert r.json()["category_id"] == cat["id"]
+
+    r = client.patch(f"/api/transactions/{tx_id}", headers=H, json={})
+    assert r.status_code == 200
+    assert r.json()["category_id"] == cat["id"]
+
+    r = client.patch(f"/api/transactions/{tx_id}", headers=H,
+                     json={"category_id": None})
+    assert r.status_code == 200
+    assert r.json()["category_id"] is None
+
+    r = client.patch(f"/api/transactions/{tx_id}", headers=H,
+                     json={"category_id": 9999})
+    assert r.status_code == 404