moo.core.tests.test_security_queryset_wizard_guard

Security tests: queryset-level wizard guards.

Player, UniversalWizard, and the Preposition family have wizard-only save()/delete() overrides, but Django’s QuerySet.update()/delete() and bulk_create()/bulk_update() never call those methods. WizardGuardedManager closes that bypass; these tests pin the guard down.

Functions

make_plain(t_wizard, name)	Create a non-wizard Object to act as the restricted caller.
make_player_row()	Create a sacrificial Player row outside any caller context.
test_player_bulk_create_blocked_for_non_wizard(...)
test_player_bulk_update_blocked_for_non_wizard(...)
test_player_queryset_delete_allowed_for_wizard(...)
test_player_queryset_delete_blocked_for_non_wizard(...)
test_player_queryset_update_allowed_for_wizard(...)
test_player_queryset_update_blocked_for_non_wizard(...)
test_preposition_queryset_mutations_blocked_for_non_wizard(...)
test_queryset_guard_inert_outside_context(...)	Management commands and system code run with no caller; the guard must not fire.
test_remove_player_record_still_works_for_wizard(...)	Regression: the one production queryset delete on Player still works.
test_universal_wizard_queryset_mutation_blocked_for_non_wizard(...)