Block devices with sub-components from becoming sub-components via forged edit

tests/test_acceptance.py

@@ -999,6 +999,19 @@ def test_add_subcomponent(client):
     assert b"Remote" in resp.data
 
 
+def test_device_with_children_cannot_become_subcomponent(client):
+    _setup_rc_car(client)
+    # Garage is parent-eligible (top-level, 0 slots, no size)
+    client.post("/device/add", data={"name": "Garage", "battery_slots": "0", "battery_size": ""})
+    resp = client.post("/device/1/edit",
+                       data={"name": "RC Car Set", "battery_slots": "0", "parent_id": "4"},
+                       follow_redirects=True)
+    assert b"cannot itself become a sub-component" in resp.data
+    data = _json.loads(client.get("/export/all.json").data)
+    devs = {d["name"]: d for d in data["devices"]}
+    assert devs["RC Car Set"]["parent_id"] is None
+
+
 def test_subcomponent_prevents_deep_nesting(client):
     _setup_rc_car(client)
     # id=2 is "Remote", which already has parent_id=1