Release v2.17.0: add read-only user previews and access fallbacks

test/web-manage-routes.test.js

@@ -76,6 +76,7 @@ test('screen update keeps the existing slug on edit', async () => {
   };
 
   const calls = [];
+  const permissionKeys = [];
   const pages = { renderScreenFormPage() {}, renderScreenEditPage() {} };
   const deps = {
     pool,
@@ -132,7 +133,8 @@ test('screen update keeps the existing slug on edit', async () => {
       return { ok: true };
     },
     playerPublicBaseUrl: 'http://player.example',
-    requirePermission() {
+    requirePermission(permissionKey) {
+      permissionKeys.push(permissionKey);
       return function (_req, _res, next) {
         next();
       };
@@ -178,6 +180,7 @@ test('dashboard commands fan out to each connected bridge player', async () => {
   };
 
   const calls = [];
+  const permissionKeys = [];
   registerManageRoutes(app, {
     pool: {
       async query(sql) {
@@ -251,7 +254,8 @@ test('dashboard commands fan out to each connected bridge player', async () => {
       calls.push({ kind: 'forwardPlayerCommandToBaseUrl', baseUrl, slug, payload });
       return { ok: true };
     },
-    requirePermission() {
+    requirePermission(permissionKey) {
+      permissionKeys.push(permissionKey);
       return function (_req, _res, next) {
         next();
       };
@@ -260,6 +264,8 @@ test('dashboard commands fan out to each connected bridge player', async () => {
 
   const routeHandlers = handlers['/commands'];
   assert.equal(Array.isArray(routeHandlers), true);
+  assert.ok(permissionKeys.includes('clients.allow'));
+  assert.ok(!permissionKeys.includes('dashboard.allow'));
 
   const req = {
     body: { command: 'pause' },