@gooddata/sdk-backend-spi 11.40.0-alpha.3 → 11.40.0-alpha.4

package/esm/index.d.ts

@@ -51,6 +51,7 @@ export type { IOrganizationSettingsService } from "./organization/settings/index
 export type { IOrganizationExportTemplatesService } from "./organization/exportTemplates/index.js";
 export type { IWorkspaceUserGroupsQuery, IWorkspaceUserGroupsQueryOptions, IWorkspaceUserGroupsQueryResult, } from "./workspace/userGroups/index.js";
 export type { IWorkspaceAccessControlService } from "./workspace/accessControl/index.js";
+export type { IObjectPermissionsObject, IWorkspaceObjectPermissionsService, } from "./workspace/objectPermissions/index.js";
 export type { IOrganizationUserService, IOrganizationUsersQuery, IOrganizationUsersQueryResult, IOrganizationUserGroupsQuery, IOrganizationUserGroupsQueryResult, } from "./organization/users/index.js";
 export type { IOrganizationPermissionService, IPermissionsAssignment, } from "./organization/permissions/index.js";
 export type { IOrganizationNotificationChannelService } from "./organization/notificationChannels/index.js";

package/esm/sdk-backend-spi.d.ts

@@ -117,6 +117,7 @@ import { INotificationChannelMetadataObject } from '@gooddata/sdk-model';
 import { INotificationChannelMetadataObjectDefinition } from '@gooddata/sdk-model';
 import { INotificationChannelTestResponse } from '@gooddata/sdk-model';
 import { INullableFilter } from '@gooddata/sdk-model';
+import { IObjectAccessList } from '@gooddata/sdk-model';
 import type { IObjectCertificationWrite } from '@gooddata/sdk-model';
 import { IOpenAiConfig } from '@gooddata/sdk-model';
 import { IOrganizationAssignee } from '@gooddata/sdk-model';
@@ -166,6 +167,7 @@ import { LlmProviderTestResults } from '@gooddata/sdk-model';
 import type { MemoryItemStrategy } from '@gooddata/sdk-model';
 import { NotificationChannelDestinationType } from '@gooddata/sdk-model';
 import { ObjectOrigin } from '@gooddata/sdk-model';
+import { ObjectPermissionsObjectKind } from '@gooddata/sdk-model';
 import { ObjectType } from '@gooddata/sdk-model';
 import { ObjRef } from '@gooddata/sdk-model';
 import { OrganizationPermissionAssignment } from '@gooddata/sdk-model';
@@ -722,6 +724,11 @@ export declare interface IAnalyticalWorkspace {
      * Returns service that can be used to manage access control records for the workspace.
      */
     accessControl(): IWorkspaceAccessControlService;
+    /**
+     * Returns service that manages per-object access for catalog attributes, facts and labels.
+     * @alpha
+     */
+    objectPermissions(): IWorkspaceObjectPermissionsService;
     /**
      * Returns service that operates over attribute hierarchies
      * @alpha
@@ -5102,6 +5109,17 @@ export declare interface IObjectExpressionToken {
     ref: ObjRef;
 }
 
+/**
+ * Identifies an object whose access is being managed. The `kind` lets the backend
+ * route to the right endpoint without an extra lookup to resolve the ref.
+ *
+ * @alpha
+ */
+export declare interface IObjectPermissionsObject {
+    readonly kind: ObjectPermissionsObjectKind;
+    readonly ref: ObjRef;
+}
+
 /**
  * Represents an organization that services analytical workspaces.
  *
@@ -8565,6 +8583,38 @@ export declare interface IWorkspaceMeasuresService {
     getConnectedAttributes(definition: IMeasure, auxMeasures?: IMeasure[]): Promise<ObjRef[]>;
 }
 
+/**
+ * Reads and updates who has access to a single catalog object. The grantee
+ * types are shared with the dashboard share service so the same UI primitives
+ * work for both flows.
+ *
+ * @alpha
+ */
+export declare interface IWorkspaceObjectPermissionsService {
+    /**
+     * Returns the current list of grants for the given object.
+     *
+     * @param target - the object whose access to read
+     */
+    getAccessList(target: IObjectPermissionsObject): Promise<IObjectAccessList>;
+    /**
+     * Applies the given grants. Grantees not included in `grantees` are left
+     * unchanged; a grantee with an empty `permissions` array is removed.
+     *
+     * @param target - the object whose access to change
+     * @param grantees - grants to apply
+     */
+    manageObjectPermissions(target: IObjectPermissionsObject, grantees: IGranularAccessGrantee[]): Promise<void>;
+    /**
+     * Returns the users and groups in the workspace that can be granted access.
+     * Excludes the current user. Whether organization admins are excluded
+     * depends on the backend.
+     *
+     * @param target - the object to find available assignees for
+     */
+    getAvailableAssignees(target: IObjectPermissionsObject): Promise<IAvailableAccessGrantee[]>;
+}
+
 /**
  * Service for querying additional parameter data.
  *

package/esm/workspace/index.d.ts

@@ -16,6 +16,7 @@ import { type IWorkspaceCatalogFactory } from "./ldm/catalog.js";
 import { type IWorkspaceDatasetsService } from "./ldm/datasets.js";
 import { type IWorkspaceLogicalModelService } from "./ldm/model.js";
 import { type IWorkspaceMeasuresService } from "./measures/index.js";
+import { type IWorkspaceObjectPermissionsService } from "./objectPermissions/index.js";
 import { type IWorkspaceParametersService } from "./parameters/index.js";
 import { type IWorkspacePermissionsService } from "./permissions/index.js";
 import { type IReferencesService } from "./references/index.js";
@@ -128,6 +129,11 @@ export interface IAnalyticalWorkspace {
      * Returns service that can be used to manage access control records for the workspace.
      */
     accessControl(): IWorkspaceAccessControlService;
+    /**
+     * Returns service that manages per-object access for catalog attributes, facts and labels.
+     * @alpha
+     */
+    objectPermissions(): IWorkspaceObjectPermissionsService;
     /**
      * Returns service that operates over attribute hierarchies
      * @alpha

package/esm/workspace/objectPermissions/index.d.ts

@@ -0,0 +1,42 @@
+import { type IAvailableAccessGrantee, type IGranularAccessGrantee, type IObjectAccessList, type ObjRef, type ObjectPermissionsObjectKind } from "@gooddata/sdk-model";
+/**
+ * Identifies an object whose access is being managed. The `kind` lets the backend
+ * route to the right endpoint without an extra lookup to resolve the ref.
+ *
+ * @alpha
+ */
+export interface IObjectPermissionsObject {
+    readonly kind: ObjectPermissionsObjectKind;
+    readonly ref: ObjRef;
+}
+/**
+ * Reads and updates who has access to a single catalog object. The grantee
+ * types are shared with the dashboard share service so the same UI primitives
+ * work for both flows.
+ *
+ * @alpha
+ */
+export interface IWorkspaceObjectPermissionsService {
+    /**
+     * Returns the current list of grants for the given object.
+     *
+     * @param target - the object whose access to read
+     */
+    getAccessList(target: IObjectPermissionsObject): Promise<IObjectAccessList>;
+    /**
+     * Applies the given grants. Grantees not included in `grantees` are left
+     * unchanged; a grantee with an empty `permissions` array is removed.
+     *
+     * @param target - the object whose access to change
+     * @param grantees - grants to apply
+     */
+    manageObjectPermissions(target: IObjectPermissionsObject, grantees: IGranularAccessGrantee[]): Promise<void>;
+    /**
+     * Returns the users and groups in the workspace that can be granted access.
+     * Excludes the current user. Whether organization admins are excluded
+     * depends on the backend.
+     *
+     * @param target - the object to find available assignees for
+     */
+    getAvailableAssignees(target: IObjectPermissionsObject): Promise<IAvailableAccessGrantee[]>;
+}

package/esm/workspace/objectPermissions/index.js

@@ -0,0 +1,2 @@
+// (C) 2026 GoodData Corporation
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gooddata/sdk-backend-spi",
-  "version": "11.40.0-alpha.3",
+  "version": "11.40.0-alpha.4",
   "description": "GoodData Backend SPI abstraction interfaces",
   "license": "MIT",
   "author": "GoodData",
@@ -24,7 +24,7 @@
     "lodash-es": "^4.17.23",
     "ts-invariant": "0.10.3",
     "tslib": "2.8.1",
-    "@gooddata/sdk-model": "11.40.0-alpha.3"
+    "@gooddata/sdk-model": "11.40.0-alpha.4"
   },
   "devDependencies": {
     "@microsoft/api-documenter": "^7.17.0",
@@ -43,13 +43,13 @@
     "eslint-plugin-no-barrel-files": "1.2.2",
     "eslint-plugin-sonarjs": "3.0.6",
     "npm-run-all": "^4.1.5",
-    "oxfmt": "0.45.0",
-    "oxlint": "^1.43.0",
-    "oxlint-tsgolint": "0.11.4",
+    "oxfmt": "0.52.0",
+    "oxlint": "1.51.0",
+    "oxlint-tsgolint": "0.15.0",
     "typescript": "5.9.3",
-    "vitest": "4.1.0",
-    "@gooddata/oxlint-config": "11.40.0-alpha.3",
-    "@gooddata/eslint-config": "11.40.0-alpha.3"
+    "vitest": "4.1.8",
+    "@gooddata/oxlint-config": "11.40.0-alpha.4",
+    "@gooddata/eslint-config": "11.40.0-alpha.4"
   },
   "scripts": {
     "_phase:build": "npm run build",