I created a move that lets a player "Dash" and it uses the TeleportAction. However when you use it next to the World Border the player can get through it. I created a test move which recreates this issue:

test_teleport:
    actions:
        cast:
        -   class: Teleport
    parameters:
        allow_max_range: true
        allow_passthrough: false
        range: 10
        vertical_range: 2
        safe: false
        transparent: transparent_no_water
        target: block

Try adding world_border_restricted: true at the top level (not under parameters)

Adding that doesn't work for me. We are on magic version 7.6.20 so that shouldn't be the problem.

test_teleport:
    world_border_restricted: true
    actions:
        cast:
        -   class: Teleport
    parameters:
        allow_max_range: true
        allow_passthrough: false
        range: 10
        vertical_range: 2
        safe: false
        transparent: transparent_no_water
        target: block

It used to work. It should prevent casting a spell if the source or target location is outside of the world border. Make sure you're not opped while testing.

Sorry, I don't think I'll be able to really test this out anytime soon.

I did some debugging and figured out this was because we had the Magic.bypass permission, which short-cirquits BaseSpell#canCast. However, it may make more sense to let the world border check take precedence here? As in, even with the permission node you would not be able to pass the world-border. Not sure if this would be better though.

The bypass perm is basically meant to bypass all permission checks, though, I think world border included. That perm is the main reason you shouldn't test while opped, which I guess means you shouldn't give that perm out to people.

It also lets you destroy protected areas with magic, which also seems like a bad thing in general for people to have.

This was all in our testing environment, where people have a bit more liberal permissions regarding to bending. I think it is just a bit weird how the bypass also affects things that seem more like properties of a spell rather than permissions. Some permission checks are also not affected, such as gliding restrictions, which don't let one cast a spell even with the bypass permission.

It's supposed to effect anything that would block a spell for some permission-like reason. It's kind of a gray area.

The gliding restriction for instance could be because that was put in to avoid breaking something, rather than to prevent players doing something they shouldn't do. Or maybe you guys added that (can't remember) and so just didn't think about the bypass flag?

At any rate I think there are more fine-grained bypass perms too if you'd rather revoke the bypass flag.

It's probably something we added. It is handled somewhere else since it isn't bound to a location if I remember correctly. Though, arguably, going outside of world borders might also break things. I don't think we need to worry about this minor inconsistency.