@gooddata/sdk-ui-ext 11.43.0-alpha.1 → 11.43.0-alpha.2

package/esm/share/ObjectShareDialog.js

@@ -0,0 +1,102 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// (C) 2026 GoodData Corporation
+import { useCallback } from "react";
+import { useIntl } from "react-intl";
+import { UiAddGranteeDialog, UiConfirmDialog, UiGranteeRowControls, UiObjectShareDialog, } from "@gooddata/sdk-ui-kit";
+import { objectShareMessages } from "./messages.js";
+import { useObjectShare } from "./useObjectShare.js";
+/**
+ * Connected share dialog. Renders the main share modal, the add-grantee
+ * sub-dialog and the general-access confirm dialog, all driven by one
+ * controller. Each underlying dialog manages its own open state, so they can
+ * be safely co-mounted; focus, backdrop and portal lifecycles are owned by
+ * `UiModalDialog` inside the kit.
+ *
+ * Mount unconditionally and toggle via `isOpen`; the contents stay invisible
+ * while closed. For the common case pass plain props and let the dialog own its
+ * controller:
+ *
+ * ```tsx
+ * <ObjectShareDialog target={ref} objectTitle={title} isOpen={open} onClose={close} />
+ * ```
+ *
+ * @internal
+ */
+export function ObjectShareDialog({ target, objectTitle, isOpen, onClose, onSaved, labels, labelsLoading, labelsError, controller, }) {
+    const intl = useIntl();
+    // Own a controller unless the consumer injects one. The hook must run
+    // unconditionally (rules of hooks), so when a controller is injected we pass
+    // it an undefined target — it then no-ops and never duplicates the fetch the
+    // injected controller already owns.
+    const ownController = useObjectShare(controller ? undefined : target, {
+        onSaved,
+        labels,
+        labelsError,
+        labelsLoading,
+    });
+    const { state, actions } = controller ?? ownController;
+    const handleClose = useCallback(() => {
+        actions.reset();
+        onClose();
+    }, [actions, onClose]);
+    const isAddGranteeOpen = isOpen && state.subview === "addGrantee";
+    const isShareOpen = isOpen && state.subview !== "addGrantee";
+    const isConfirmOpen = isOpen && !!state.pendingGeneralAccess;
+    // Don't allow mutations until the access list has loaded: before then the
+    // controller reports empty grantees + RESTRICTED, which is a placeholder, not
+    // the real state. Acting on it would write from a false assumption. Mutations
+    // are also gated until per-label scope resolves (`labelsResolved`): a new
+    // grantee defaults to all labels, and any access change before resolution
+    // would diff against an assumed-full scope (skipping grants / revoking the
+    // wrong labels). `labelsResolved` is false while labels are still loading and
+    // when their fetch failed, so a pending/failed label set blocks every
+    // access-changing control here — Add, row controls and general access alike.
+    const isLoaded = state.status === "success";
+    const isMutable = isLoaded && state.labelsResolved;
+    const isAddDisabled = !isMutable;
+    // Map the controller's labels to the picker's item shape; the primary label
+    // is rendered locked (always selected, can't be unchecked).
+    const labelItems = state.labels.map((l) => ({
+        id: l.id,
+        label: l.title,
+        kind: l.isPrimary ? "primary" : undefined,
+        locked: l.isPrimary,
+    }));
+    return (_jsxs(_Fragment, { children: [_jsx(UiObjectShareDialog, { isOpen: isShareOpen, objectTitle: objectTitle, onClose: handleClose, grantees: state.grantees.map((g) => ({
+                    id: g.id,
+                    kind: g.kind,
+                    name: g.name,
+                    email: g.email,
+                    isPending: g.pending !== undefined,
+                    controls: (_jsx(UiGranteeRowControls, { labels: labelItems, selectedLabelIds: state.selectedLabelIdsByGrantee[g.id] ?? state.labels.map((l) => l.id), permissionLevel: g.level, effectivePermission: g.effectivePermission, 
+                        // Disable row controls while saving, and until per-label
+                        // scope resolves (labels still loading, failed, or the
+                        // probe in flight) — removing or re-scoping before then
+                        // would diff against the "assume all"/empty placeholder
+                        // and silently orphan real per-label grants.
+                        isDisabled: g.pending !== undefined || !state.labelsResolved, onLabelsChange: (selectedIds) => {
+                            void actions.changeGranteeLabels(g.id, selectedIds);
+                        }, onPermissionChange: (level) => {
+                            void actions.changePermissionLevel(g.id, level);
+                        }, onRemoveAccess: () => {
+                            void actions.removeGrantee(g.id);
+                        } })),
+                })), onAddClick: actions.openAddGrantee, isAddDisabled: isAddDisabled, generalAccess: state.generalAccess, onGeneralAccessChange: actions.requestGeneralAccessChange, 
+                // Gated on the same condition as Add: changing general access also
+                // mirrors the label scope, so it must wait for resolution and stay
+                // disabled when label metadata failed to load.
+                isGeneralAccessDisabled: !isMutable, 
+                // On a failed load the empty grantee list + RESTRICTED radio are a
+                // placeholder, not the real policy — show why instead of letting it
+                // read as "no one has access".
+                error: state.status === "error" ? intl.formatMessage(objectShareMessages.loadError) : undefined }), _jsx(UiAddGranteeDialog, { isOpen: isAddGranteeOpen, objectTitle: objectTitle, loadOptions: actions.loadOptions, selectedGrantees: state.pendingGrantees, onSelectedGranteesChange: actions.setPendingGrantees, onBack: actions.closeAddGrantee, onClose: handleClose, onCancel: actions.closeAddGrantee, onShare: () => {
+                    void actions.confirmAddGrantees();
+                } }), _jsx(UiConfirmDialog, { isOpen: isConfirmOpen, title: intl.formatMessage(state.pendingGeneralAccess === "RESTRICTED"
+                    ? objectShareMessages.confirmRestrictTitle
+                    : objectShareMessages.confirmGrantWorkspaceTitle), description: intl.formatMessage(state.pendingGeneralAccess === "RESTRICTED"
+                    ? objectShareMessages.confirmRestrictDescription
+                    : objectShareMessages.confirmGrantWorkspaceDescription, { title: objectTitle }), confirmLabel: intl.formatMessage(objectShareMessages.confirmButton), confirmVariant: "primary", onCancel: actions.cancelGeneralAccessChange, onClose: actions.cancelGeneralAccessChange, onConfirm: () => {
+                    void actions.confirmGeneralAccessChange();
+                } })
+        ] }));
+}

package/esm/share/accessSummary.d.ts

@@ -0,0 +1,20 @@
+import type { AccessGranteeDetail, IGranularRulesAccess } from "@gooddata/sdk-model";
+import type { GeneralAccessValue } from "@gooddata/sdk-ui-kit";
+/**
+ * Find the `allWorkspaceUsers` rule grant if one exists. Its presence with
+ * non-empty `permissions` is the single signal that distinguishes WORKSPACE
+ * from RESTRICTED general access.
+ */
+export declare function findAllWorkspaceUsersGrant(grants: AccessGranteeDetail[]): IGranularRulesAccess | undefined;
+export declare function deriveGeneralAccess(grants: AccessGranteeDetail[]): GeneralAccessValue;
+/**
+ * Workspace-wide permission level when the rule grant exists. Defaults to
+ * VIEW; promoted to SHARE only when the rule explicitly permits SHARE. EDIT
+ * is intentionally not surfaced — the UI caps at VIEW/SHARE.
+ */
+export declare function deriveWorkspacePermissionLevel(grants: AccessGranteeDetail[]): "VIEW" | "SHARE";
+/**
+ * Count of named grantees (users + user groups). The `allWorkspaceUsers` rule
+ * grant is excluded.
+ */
+//# sourceMappingURL=accessSummary.d.ts.map

package/esm/share/accessSummary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessSummary.d.ts","sourceRoot":"","sources":["../../src/share/accessSummary.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACrF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,mBAAmB,EAAE,GAAG,oBAAoB,GAAG,SAAS,CAE1G;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,EAAE,GAAG,kBAAkB,CAGrF;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,GAAG,OAAO,CAG9F;AAED;;;GAGG"}

package/esm/share/accessSummary.js

@@ -0,0 +1,26 @@
+// (C) 2026 GoodData Corporation
+/**
+ * Find the `allWorkspaceUsers` rule grant if one exists. Its presence with
+ * non-empty `permissions` is the single signal that distinguishes WORKSPACE
+ * from RESTRICTED general access.
+ */
+export function findAllWorkspaceUsersGrant(grants) {
+    return grants.find((g) => g.type === "allWorkspaceUsers");
+}
+export function deriveGeneralAccess(grants) {
+    const rule = findAllWorkspaceUsersGrant(grants);
+    return rule && rule.permissions.length > 0 ? "WORKSPACE" : "RESTRICTED";
+}
+/**
+ * Workspace-wide permission level when the rule grant exists. Defaults to
+ * VIEW; promoted to SHARE only when the rule explicitly permits SHARE. EDIT
+ * is intentionally not surfaced — the UI caps at VIEW/SHARE.
+ */
+export function deriveWorkspacePermissionLevel(grants) {
+    const rule = findAllWorkspaceUsersGrant(grants);
+    return rule?.permissions.includes("SHARE") ? "SHARE" : "VIEW";
+}
+/**
+ * Count of named grantees (users + user groups). The `allWorkspaceUsers` rule
+ * grant is excluded.
+ */

package/esm/share/messages.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Messages owned by the connected `ObjectShareDialog` and its hooks. Strings
+ * for the consumer's launcher button or inline access row live in the
+ * consumer's own bundle (see e.g. `analyticsCatalog.share.*` in
+ * `@gooddata/sdk-ui-catalog`).
+ *
+ * @internal
+ */
+export declare const objectShareMessages: {
+    confirmRestrictTitle: {
+        id: string;
+    };
+    confirmRestrictDescription: {
+        id: string;
+    };
+    confirmGrantWorkspaceTitle: {
+        id: string;
+    };
+    confirmGrantWorkspaceDescription: {
+        id: string;
+    };
+    confirmButton: {
+        id: string;
+    };
+    toastGranteeAdded: {
+        id: string;
+    };
+    toastAccessUpdated: {
+        id: string;
+    };
+    toastGeneralAccessUpdated: {
+        id: string;
+    };
+    toastError: {
+        id: string;
+    };
+    toastLabelScopePartial: {
+        id: string;
+    };
+    loadError: {
+        id: string;
+    };
+};
+//# sourceMappingURL=messages.d.ts.map

package/esm/share/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/share/messages.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAY9B,CAAC"}

package/esm/share/messages.js

@@ -0,0 +1,23 @@
+// (C) 2026 GoodData Corporation
+import { defineMessages } from "react-intl";
+/**
+ * Messages owned by the connected `ObjectShareDialog` and its hooks. Strings
+ * for the consumer's launcher button or inline access row live in the
+ * consumer's own bundle (see e.g. `analyticsCatalog.share.*` in
+ * `@gooddata/sdk-ui-catalog`).
+ *
+ * @internal
+ */
+export const objectShareMessages = defineMessages({
+    confirmRestrictTitle: { id: "objectShare.confirm.restrict.title" },
+    confirmRestrictDescription: { id: "objectShare.confirm.restrict.description" },
+    confirmGrantWorkspaceTitle: { id: "objectShare.confirm.grantWorkspace.title" },
+    confirmGrantWorkspaceDescription: { id: "objectShare.confirm.grantWorkspace.description" },
+    confirmButton: { id: "objectShare.confirm.button" },
+    toastGranteeAdded: { id: "objectShare.toast.granteeAdded" },
+    toastAccessUpdated: { id: "objectShare.toast.accessUpdated" },
+    toastGeneralAccessUpdated: { id: "objectShare.toast.generalAccessUpdated" },
+    toastError: { id: "objectShare.toast.error" },
+    toastLabelScopePartial: { id: "objectShare.toast.labelScopePartial" },
+    loadError: { id: "objectShare.loadError" },
+});

package/esm/share/objectShareController.helpers.d.ts

@@ -0,0 +1,80 @@
+import { type IAvailableAccessGrantee, type IGranularAccessGrantee, type IObjectAccessList, type ObjRef } from "@gooddata/sdk-model";
+import type { IObjectShareGrantee, ObjectSharePermissionLevel } from "./objectShareController.types.js";
+import type { IObjectShareLabel } from "./types.js";
+/** Stable row id shared by grantee rows and picker options: `user:<ref>` / `group:<ref>`. */
+export declare function granteeId(kind: "user" | "group", ref: ObjRef): string;
+/** Case-insensitive match of an assignee against the picker query (name, or email for users). */
+export declare function assigneeMatchesQuery(assignee: IAvailableAccessGrantee, query: string): boolean;
+/** The row's directly-granted level. SHARE outranks VIEW. */
+export declare function directLevel(permissions: readonly string[]): ObjectSharePermissionLevel;
+/**
+ * The effective permission to surface as a warning, or undefined when the direct
+ * grant already covers it. Set only when the grantee *inherits* SHARE (e.g. via a
+ * group) but is directly granted just VIEW — i.e. the effective access is higher
+ * than what the row's permission control shows.
+ */
+export declare function effectivePermissionAbove(direct: ObjectSharePermissionLevel, inheritedPermissions: readonly string[]): ObjectSharePermissionLevel | undefined;
+export declare function granteesFromAccessList(list: IObjectAccessList | undefined): IObjectShareGrantee[];
+/**
+ * Optimistic overlay entry for a single grantee id. `"set"` carries the intended
+ * row (a fresh add or a level change); `"remove"` marks a removal. `pending` is
+ * true while the backend write is in flight.
+ */
+export type IGranteeOverlayEntry = {
+    op: "set";
+    grantee: IObjectShareGrantee;
+    pending: boolean;
+} | {
+    op: "remove";
+    pending: boolean;
+};
+/**
+ * Merge the committed rows with the optimistic overlay: `set` replaces/inserts a
+ * row (annotated pending), `remove` drops it. Entries with no committed effect
+ * still apply so the UI reflects the user's intent during read-after-write lag.
+ */
+export declare function mergeOverlay(committed: IObjectShareGrantee[], overlay: Record<string, IGranteeOverlayEntry>): IObjectShareGrantee[];
+/**
+ * Drop overlay entries the freshly-fetched list now confirms: a `set` whose
+ * committed level matches the intended level, or a `remove` whose grantee is
+ * gone. Unconfirmed entries are kept (server still lagging) but lose `pending`
+ * so the row shows the intended value without a spinner.
+ */
+export declare function reconcileOverlay(committed: IObjectShareGrantee[], overlay: Record<string, IGranteeOverlayEntry>): Record<string, IGranteeOverlayEntry>;
+export declare function toGranularGrantee(kind: "user" | "group", granteeRef: ObjRef, level: ObjectSharePermissionLevel | "none"): IGranularAccessGrantee;
+/**
+ * The principal a label-scope reconcile applies to: a named user/group, or the
+ * implicit all-workspace-users rule (general access).
+ */
+export type LabelScopePrincipal = {
+    kind: "user" | "group";
+    granteeRef: ObjRef;
+} | {
+    allWorkspaceUsers: true;
+};
+export declare function granularGranteeFor(principal: LabelScopePrincipal, level: ObjectSharePermissionLevel | "none"): IGranularAccessGrantee;
+/**
+ * Pure diff: the per-label writes needed to move `principal`'s label scope from
+ * `current` to `desired`. The primary label is always kept in scope (never
+ * revoked). `labels` is the permissionable set (404 forms already excluded), so
+ * every returned write targets a label that can actually take a grant. No I/O —
+ * the single source of truth for what add / remove / general-access / the labels
+ * picker each write, so they can't drift apart.
+ */
+export declare function buildLabelMutations(principal: LabelScopePrincipal, desiredLabelIds: ReadonlySet<string>, currentLabelIds: ReadonlySet<string>, labels: IObjectShareLabel[]): Array<{
+    ref: ObjRef;
+    grantee: IGranularAccessGrantee;
+}>;
+/** Stable empty-labels default so the hook's default arg doesn't churn identities. */
+export declare const NO_LABELS: IObjectShareLabel[];
+/** Shared empty id-set for "no labels in scope" diffs. */
+export declare const EMPTY_IDS: ReadonlySet<string>;
+/**
+ * Whether a fetched grant for `granteeId` exists with a non-empty permission set.
+ * Inspects the raw grants rather than `granteesFromAccessList`, which normalizes
+ * every listed user/group to a VIEW level even when its `permissions` are empty —
+ * so a revoked-but-still-listed entry would otherwise read as granted, mis-scoping
+ * a per-label checkbox to a label the grantee can't actually access.
+ */
+export declare function isGranteeGrantedIn(list: IObjectAccessList, id: string): boolean;
+//# sourceMappingURL=objectShareController.helpers.d.ts.map

package/esm/share/objectShareController.helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"objectShareController.helpers.d.ts","sourceRoot":"","sources":["../../src/share/objectShareController.helpers.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,MAAM,EAId,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACxG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAM9F;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,0BAA0B,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,0BAA0B,EAClC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GACxC,0BAA0B,GAAG,SAAS,CAExC;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,GAAG,mBAAmB,EAAE,CA8BjG;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC1B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzC;;;;GAIG;AACH,wBAAgB,YAAY,CACxB,SAAS,EAAE,mBAAmB,EAAE,EAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,GAC9C,mBAAmB,EAAE,CAUvB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC5B,SAAS,EAAE,mBAAmB,EAAE,EAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,GAC9C,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAatC;AAED,wBAAgB,iBAAiB,CAC7B,IAAI,EAAE,MAAM,GAAG,OAAO,EACtB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,0BAA0B,GAAG,MAAM,GAC3C,sBAAsB,CAMxB;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GACzB;IAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,iBAAiB,EAAE,IAAI,CAAA;CAAE,CAAC;AAElC,wBAAgB,kBAAkB,CAC9B,SAAS,EAAE,mBAAmB,EAC9B,KAAK,EAAE,0BAA0B,GAAG,MAAM,0BAO7C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAC/B,SAAS,EAAE,mBAAmB,EAC9B,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,MAAM,EAAE,iBAAiB,EAAE,GAC5B,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,sBAAsB,CAAA;CAAE,CAAC,CAWzD;AAED,sFAAsF;AACtF,eAAO,MAAM,SAAS,EAAE,iBAAiB,EAAO,CAAC;AAEjD,0DAA0D;AAC1D,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,MAAM,CAAqB,CAAC;AAEhE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAU/E"}

package/esm/share/objectShareController.helpers.js

@@ -0,0 +1,152 @@
+// (C) 2026 GoodData Corporation
+import { isGranularUserAccess, isGranularUserGroupAccess, objRefToString, } from "@gooddata/sdk-model";
+/** Stable row id shared by grantee rows and picker options: `user:<ref>` / `group:<ref>`. */
+export function granteeId(kind, ref) {
+    return `${kind}:${objRefToString(ref)}`;
+}
+/** Case-insensitive match of an assignee against the picker query (name, or email for users). */
+export function assigneeMatchesQuery(assignee, query) {
+    if (!query) {
+        return true;
+    }
+    const email = assignee.type === "user" ? (assignee.email ?? "") : "";
+    return `${assignee.name} ${email}`.toLowerCase().includes(query);
+}
+/** The row's directly-granted level. SHARE outranks VIEW. */
+export function directLevel(permissions) {
+    return permissions.includes("SHARE") ? "SHARE" : "VIEW";
+}
+/**
+ * The effective permission to surface as a warning, or undefined when the direct
+ * grant already covers it. Set only when the grantee *inherits* SHARE (e.g. via a
+ * group) but is directly granted just VIEW — i.e. the effective access is higher
+ * than what the row's permission control shows.
+ */
+export function effectivePermissionAbove(direct, inheritedPermissions) {
+    return direct !== "SHARE" && inheritedPermissions.includes("SHARE") ? "SHARE" : undefined;
+}
+export function granteesFromAccessList(list) {
+    if (!list) {
+        return [];
+    }
+    const out = [];
+    for (const g of list.grants) {
+        if (isGranularUserAccess(g)) {
+            const level = directLevel(g.permissions);
+            out.push({
+                id: granteeId("user", g.user.ref),
+                kind: "user",
+                granteeRef: g.user.ref,
+                name: g.user.fullName ?? g.user.email ?? g.user.login,
+                email: g.user.email,
+                level,
+                effectivePermission: effectivePermissionAbove(level, g.inheritedPermissions),
+            });
+        }
+        else if (isGranularUserGroupAccess(g)) {
+            const level = directLevel(g.permissions);
+            out.push({
+                id: granteeId("group", g.userGroup.ref),
+                kind: "group",
+                granteeRef: g.userGroup.ref,
+                name: g.userGroup.name ?? objRefToString(g.userGroup.ref),
+                level,
+                effectivePermission: effectivePermissionAbove(level, g.inheritedPermissions),
+            });
+        }
+    }
+    return out;
+}
+/**
+ * Merge the committed rows with the optimistic overlay: `set` replaces/inserts a
+ * row (annotated pending), `remove` drops it. Entries with no committed effect
+ * still apply so the UI reflects the user's intent during read-after-write lag.
+ */
+export function mergeOverlay(committed, overlay) {
+    const byId = new Map(committed.map((g) => [g.id, g]));
+    for (const [id, entry] of Object.entries(overlay)) {
+        if (entry.op === "remove") {
+            byId.delete(id);
+        }
+        else {
+            byId.set(id, { ...entry.grantee, pending: entry.pending ? "saving" : undefined });
+        }
+    }
+    return [...byId.values()];
+}
+/**
+ * Drop overlay entries the freshly-fetched list now confirms: a `set` whose
+ * committed level matches the intended level, or a `remove` whose grantee is
+ * gone. Unconfirmed entries are kept (server still lagging) but lose `pending`
+ * so the row shows the intended value without a spinner.
+ */
+export function reconcileOverlay(committed, overlay) {
+    const byId = new Map(committed.map((g) => [g.id, g]));
+    const next = {};
+    for (const [id, entry] of Object.entries(overlay)) {
+        if (entry.op === "remove") {
+            if (byId.has(id)) {
+                next[id] = { op: "remove", pending: false };
+            }
+        }
+        else if (byId.get(id)?.level !== entry.grantee.level) {
+            next[id] = { op: "set", grantee: entry.grantee, pending: false };
+        }
+    }
+    return next;
+}
+export function toGranularGrantee(kind, granteeRef, level) {
+    const permissions = level === "none" ? [] : level === "SHARE" ? ["SHARE", "VIEW"] : ["VIEW"];
+    return kind === "user"
+        ? { type: "granularUser", granteeRef, permissions, inheritedPermissions: [] }
+        : { type: "granularGroup", granteeRef, permissions, inheritedPermissions: [] };
+}
+export function granularGranteeFor(principal, level) {
+    if ("allWorkspaceUsers" in principal) {
+        const permissions = level === "none" ? [] : ["VIEW"];
+        return { type: "allWorkspaceUsers", permissions, inheritedPermissions: [] };
+    }
+    return toGranularGrantee(principal.kind, principal.granteeRef, level);
+}
+/**
+ * Pure diff: the per-label writes needed to move `principal`'s label scope from
+ * `current` to `desired`. The primary label is always kept in scope (never
+ * revoked). `labels` is the permissionable set (404 forms already excluded), so
+ * every returned write targets a label that can actually take a grant. No I/O —
+ * the single source of truth for what add / remove / general-access / the labels
+ * picker each write, so they can't drift apart.
+ */
+export function buildLabelMutations(principal, desiredLabelIds, currentLabelIds, labels) {
+    const writes = [];
+    for (const label of labels) {
+        const wanted = label.isPrimary || desiredLabelIds.has(label.id);
+        const had = label.isPrimary || currentLabelIds.has(label.id);
+        if (wanted === had) {
+            continue;
+        }
+        writes.push({ ref: label.ref, grantee: granularGranteeFor(principal, wanted ? "VIEW" : "none") });
+    }
+    return writes;
+}
+/** Stable empty-labels default so the hook's default arg doesn't churn identities. */
+export const NO_LABELS = [];
+/** Shared empty id-set for "no labels in scope" diffs. */
+export const EMPTY_IDS = new Set();
+/**
+ * Whether a fetched grant for `granteeId` exists with a non-empty permission set.
+ * Inspects the raw grants rather than `granteesFromAccessList`, which normalizes
+ * every listed user/group to a VIEW level even when its `permissions` are empty —
+ * so a revoked-but-still-listed entry would otherwise read as granted, mis-scoping
+ * a per-label checkbox to a label the grantee can't actually access.
+ */
+export function isGranteeGrantedIn(list, id) {
+    return list.grants.some((g) => {
+        if (isGranularUserAccess(g)) {
+            return id === granteeId("user", g.user.ref) && g.permissions.length > 0;
+        }
+        if (isGranularUserGroupAccess(g)) {
+            return id === granteeId("group", g.userGroup.ref) && g.permissions.length > 0;
+        }
+        return false;
+    });
+}

package/esm/share/objectShareController.types.d.ts

@@ -0,0 +1,110 @@
+import type { ObjRef } from "@gooddata/sdk-model";
+import type { GeneralAccessValue, IUiGranteeAsyncOptions, IUiPickedGrantee } from "@gooddata/sdk-ui-kit";
+import type { IObjectAccessSummary, IObjectShareLabel } from "./types.js";
+/**
+ * Permission level surfaced in the share dialog. `EDIT` is intentionally
+ * not represented — the underlying permission menu caps at VIEW/SHARE.
+ *
+ * @internal
+ */
+export type ObjectSharePermissionLevel = "VIEW" | "SHARE";
+/**
+ * Dialog row derived from a backend grant.
+ *
+ * @internal
+ */
+export interface IObjectShareGrantee {
+    /** Stable id used as the dialog row's React key. `user:<ref>` / `group:<ref>`. */
+    id: string;
+    kind: "user" | "group";
+    granteeRef: ObjRef;
+    name: string;
+    email?: string;
+    level: ObjectSharePermissionLevel;
+    /**
+     * Effective permission when it is *higher* than the directly-granted `level`
+     * because the grantee inherits a stronger permission (e.g. via a group).
+     * Undefined when the direct grant already is the effective permission. Drives
+     * the row's "effective permission" warning badge.
+     */
+    effectivePermission?: ObjectSharePermissionLevel;
+    /**
+     * Row-level in-flight state for optimistic updates: `"saving"` while a level
+     * change or freshly-added grant is being committed, `"removing"` while a
+     * removal is in flight. Undefined when the row reflects committed state.
+     */
+    pending?: "saving" | "removing";
+}
+/**
+ * @internal
+ */
+export interface IObjectShareControllerState {
+    subview: "main" | "addGrantee";
+    status: "idle" | "loading" | "success" | "error" | "saving";
+    error?: Error;
+    summary: IObjectAccessSummary | undefined;
+    grantees: IObjectShareGrantee[];
+    generalAccess: GeneralAccessValue;
+    /**
+     * Labels (display forms) of the shared attribute, in source order. Empty for
+     * objects without labels (e.g. facts) — the labels picker is then hidden.
+     */
+    labels: IObjectShareLabel[];
+    /**
+     * Whether per-label scope resolution has finished. While false, a grantee's
+     * label scope is not yet known: consumers must not treat a missing
+     * `selectedLabelIdsByGrantee` entry as "all selected" for editing, and should
+     * keep the Add action disabled.
+     */
+    labelsResolved: boolean;
+    /**
+     * Per-grantee label scope: grantee id → the label ids that grantee can access.
+     * The primary label is always included. Empty entry means "all labels" has not
+     * yet been resolved; consumers should treat a missing entry as all-selected.
+     */
+    selectedLabelIdsByGrantee: Record<string, string[]>;
+    /** Pending confirm — when set, the confirm dialog is visible. */
+    pendingGeneralAccess?: GeneralAccessValue;
+    /** Grantees staged in the add-grantee dialog before confirmation. */
+    pendingGrantees: IUiPickedGrantee[];
+}
+/**
+ * @internal
+ */
+export interface IObjectShareControllerActions {
+    /** Reset transient dialog state (subview + pending buffers). Call on dialog close. */
+    reset: () => void;
+    openAddGrantee: () => void;
+    closeAddGrantee: () => void;
+    setPendingGrantees: (next: IUiPickedGrantee[]) => void;
+    /**
+     * Loader for the add-grantee picker. Wraps `getAvailableAssignees` with
+     * client-side search + already-picked filtering, returning the picker's
+     * `{ groups, users }` shape.
+     */
+    loadOptions: (search: string) => Promise<IUiGranteeAsyncOptions>;
+    /** Commit all pending grantees to the backend. */
+    confirmAddGrantees: () => Promise<void>;
+    /** Change the permission level for a single grantee. Auto-saves. */
+    changePermissionLevel: (granteeId: string, level: ObjectSharePermissionLevel) => Promise<void>;
+    /** Remove a grantee. Auto-saves. */
+    removeGrantee: (granteeId: string) => Promise<void>;
+    /**
+     * Scope a grantee's access to the given label ids (the primary label is always
+     * kept). Sends a per-label VIEW/none grant for each label that changed. Auto-saves.
+     */
+    changeGranteeLabels: (granteeId: string, selectedLabelIds: string[]) => Promise<void>;
+    /** Stage a general access change; opens the confirm dialog. */
+    requestGeneralAccessChange: (next: GeneralAccessValue) => void;
+    cancelGeneralAccessChange: () => void;
+    /** Commit the pending general access change. Auto-saves. */
+    confirmGeneralAccessChange: () => Promise<void>;
+}
+/**
+ * @internal
+ */
+export interface IObjectShareController {
+    state: IObjectShareControllerState;
+    actions: IObjectShareControllerActions;
+}
+//# sourceMappingURL=objectShareController.types.d.ts.map

package/esm/share/objectShareController.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"objectShareController.types.d.ts","sourceRoot":"","sources":["../../src/share/objectShareController.types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEzG,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAChC,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,0BAA0B,CAAC;IAClC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;OAIG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IACxC,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5D,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAE1C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,aAAa,EAAE,kBAAkB,CAAC;IAElC;;;OAGG;IACH,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpD,mEAAiE;IACjE,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C,qEAAqE;IACrE,eAAe,EAAE,gBAAgB,EAAE,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC1C,sFAAsF;IACtF,KAAK,EAAE,MAAM,IAAI,CAAC;IAElB,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,kBAAkB,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACvD;;;;OAIG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,kDAAkD;IAClD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC,oEAAoE;IACpE,qBAAqB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,oCAAoC;IACpC,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;OAGG;IACH,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF,+DAA+D;IAC/D,0BAA0B,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/D,yBAAyB,EAAE,MAAM,IAAI,CAAC;IACtC,4DAA4D;IAC5D,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,2BAA2B,CAAC;IACnC,OAAO,EAAE,6BAA6B,CAAC;CAC1C"}

package/esm/share/objectShareController.types.js

@@ -0,0 +1,2 @@
+// (C) 2026 GoodData Corporation
+export {};

package/esm/share/types.d.ts

@@ -0,0 +1,47 @@
+import type { ObjRef } from "@gooddata/sdk-model";
+import type { GeneralAccessValue } from "@gooddata/sdk-ui-kit";
+/**
+ * A label (attribute display form) of the shared attribute. The share dialog
+ * scopes a grantee's access to a subset of these via per-label permission grants.
+ *
+ * @internal
+ */
+export interface IObjectShareLabel {
+    /** Backend ref of the label, used as the `kind: "label"` permission target. */
+    ref: ObjRef;
+    /** Stable id (serialized ref) — the picker's item id and selection key. */
+    id: string;
+    /** Display title shown in the labels picker. */
+    title: string;
+    /**
+     * The primary (key) label. It is always accessible and cannot be unchecked —
+     * rendered locked in the picker. Sharing an attribute always includes it.
+     */
+    isPrimary: boolean;
+    /**
+     * The default display label — the one shown by default in visualizations.
+     * At most one label is the default. Distinct from the primary (key) label.
+     */
+    isDefault: boolean;
+}
+/**
+ * Aggregated, read-only access state for an object — what the inline access row
+ * in a host UI needs to render the current sharing state without opening the
+ * full share dialog.
+ *
+ * - `generalAccess` — `RESTRICTED` if only named grantees can access the object;
+ *   `WORKSPACE` if the workspace-wide rule grant is present with non-empty permissions.
+ * - `workspaceLevel` — the rule grant's permission level; `VIEW` by default,
+ *   `SHARE` when the rule explicitly permits `SHARE`. EDIT is intentionally not
+ *   surfaced (the UI caps at VIEW/SHARE).
+ * - `granteeCount` — number of named grantees (users + groups). Excludes the
+ *   workspace-wide rule grant itself.
+ *
+ * @internal
+ */
+export interface IObjectAccessSummary {
+    generalAccess: GeneralAccessValue;
+    workspaceLevel: "VIEW" | "SHARE";
+    granteeCount: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/esm/share/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/share/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAC9B,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oBAAoB;IACjC,aAAa,EAAE,kBAAkB,CAAC;IAClC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;CACxB"}

package/esm/share/types.js

@@ -0,0 +1,2 @@
+// (C) 2026 GoodData Corporation
+export {};