Release v2.17.0: add read-only user previews and access fallbacks

test/api-source-request.test.js

@@ -209,11 +209,16 @@ test('API source add and edit forms render connection diagnostics with the corre
   const user = { permissionKeys: ['api-sources.create', 'api-sources.update'] };
   const add = renderAdd({}, '', user);
   const edit = renderEdit({ id: 42, name: 'Campaign' }, {}, '', user);
+  const preview = renderEdit({ id: 42, name: 'Campaign' }, {}, '', {
+    isViewingAs: true,
+    permissionKeys: ['api-sources.update', 'api-sources.allow', 'api-sources.delete']
+  });
   assert.match(add, /<p>Configure shared authentication and the requests for this API source\.<\/p>/);
   assert.match(edit, /<p>Manage shared authentication, request URLs, and latest responses\.<\/p>/);
   assert.match(add, /data-api-source-test-url="\/data-sources\/api-sources\/test"/);
   assert.match(edit, /data-api-source-test-url="\/data-sources\/api-sources\/42\/test"/);
   for (const html of [add, edit]) {
+    assert.match(html, /<form id="api-source-form" method="post" action="[^"]+" data-async-save/);
     assert.match(html, /data-api-source-diagnostics hidden/);
     assert.match(html, /data-api-source-copy-report disabled/);
     assert.match(html, /data-api-source-test-status role="status"/);
@@ -237,6 +242,12 @@ test('API source add and edit forms render connection diagnostics with the corre
     assert.doesNotMatch(html, /data-api-requests-header/);
     assert.match(html, /data-api-request-title>Request - /);
   }
+  assert.match(preview, /data-manual-refresh-url="\/data-sources\/api-sources\/42\/requests\/42\/refresh"[^>]*disabled/);
+  assert.match(preview, /data-api-source-test-url="\/data-sources\/api-sources\/42\/test"[^>]*disabled/);
+  assert.match(preview, /data-api-auth-test-url="\/data-sources\/api-sources\/42\/auth-test"[^>]*disabled/);
+  assert.match(preview, /data-async-data-source-toggle[^>]*disabled/);
+  assert.match(preview, /data-api-request-add disabled/);
+  assert.match(preview, /data-api-request-remove data-request-protected disabled/);
 });
 
 test('saved requests show visible full-width response trees with independent expand controls', () => {