@gooddata/sdk-ui-ext 11.43.0-alpha.2 → 11.43.0-alpha.4

package/esm/share/useAccessList.js

@@ -1,17 +1,23 @@
 // (C) 2026 GoodData Corporation
-import { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import { objRefToString, } from "@gooddata/sdk-model";
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { objRefToString } from "@gooddata/sdk-model";
 import { useBackendStrict, useCancelablePromise, useWorkspaceStrict } from "@gooddata/sdk-ui";
 import { useToastMessage } from "@gooddata/sdk-ui-kit";
 import { deriveGeneralAccess, deriveWorkspacePermissionLevel } from "./accessSummary.js";
 import { objectShareMessages } from "./messages.js";
-import { assigneeMatchesQuery, granteeId, granteesFromAccessList, mergeOverlay, reconcileOverlay, } from "./objectShareController.helpers.js";
+import { assigneeMatchesQuery, granteeId, granteesFromAccessList } from "./objectShareController.helpers.js";
 /**
- * Owns the backend access list and its optimistic overlay. The list is fetched
- * via `useCancelablePromise` then owned locally: mutations patch the overlay and
- * a background refresh reconciles it, so the grantee list never blanks between a
- * change and the server response. A target switch is handled by stamping the
- * fetched list with its target and reading through `currentAccessList`.
+ * Owns the backend access list. It is fetched once (per target) then seeded into
+ * local state, which is authoritative while the dialog/summary is mounted:
+ * mutations write through to it directly and roll back the one changed entry on
+ * failure. There is no post-write refetch, so the grantee list never blanks and
+ * never fights the backend's read-after-write lag. A target switch re-seeds from
+ * the new fetch; the seed is gated on a per-target stamp so a late fetch for a
+ * previous target can't clobber the current one.
+ *
+ * Effective (inherited) permissions and display names come from that single
+ * fetch: inherited access doesn't change as a result of editing a direct grant,
+ * so the badge stays correct for the session without re-reading.
  *
  * @internal
  */
@@ -19,37 +25,24 @@ export function useAccessList(target, onSaved) {
     const backend = useBackendStrict();
     const workspace = useWorkspaceStrict();
     const toast = useToastMessage();
-    const [accessList, setAccessList] = useState(undefined);
-    const [accessListTarget, setAccessListTarget] = useState(undefined);
-    const [loadStatus, setLoadStatus] = useState(target ? "loading" : "idle");
+    // Authoritative local state, seeded from the fetch below.
+    const [grantees, setGrantees] = useState([]);
+    const [generalAccess, setGeneralAccess] = useState("RESTRICTED");
+    const [workspaceLevel, setWorkspaceLevel] = useState("VIEW");
+    // The target the local state was seeded for; undefined until the first seed.
+    // Reading state as belonging to the current target hinges on this matching
+    // `targetKey` — a target switch makes the old state stale until the re-seed.
+    const [seededTarget, setSeededTarget] = useState(undefined);
     const [loadError, setLoadError] = useState(undefined);
-    // Optimistic overlay keyed by grantee id. Each entry holds the *intended* row
-    // (add/level-change) or a removal, plus a pending flag while the write is in
-    // flight. The backend has read-after-write lag, so we show the intended state
-    // and clear an entry only once a refresh confirms it (or the write fails).
-    const [overlay, setOverlay] = useState({});
-    // Display names learned from the picker; keep a human name on a row after the
-    // optimistic overlay reconciles away (the grant often returns only a raw id).
+    // Display names learned from the picker; used to give a fetched row a human
+    // name when its grant carried only a raw id.
     const [knownNames, setKnownNames] = useState({});
     // Original ObjRef per grantee id, learned from the picker (the access-list id
     // is a serialized `kind:identifier`, which loses Uri-vs-Id). Reused for writes.
     const [knownRefs, setKnownRefs] = useState({});
-    // Optimistic general-access override — held from confirm until the fetched list
-    // reflects it, so the radio + summary update instantly.
-    const [optimisticGeneralAccess, setOptimisticGeneralAccess] = useState(undefined);
     const targetKey = target ? objRefToString(target.ref) : undefined;
-    // The owned list as it applies to the *current* target. A target switch makes
-    // the previous fetch's list stale until the new one lands; gating on the stamp
-    // means everything derived ignores it immediately — no reset effect.
-    const currentAccessList = accessListTarget === targetKey ? accessList : undefined;
-    // Always-current target key, read inside async callbacks that captured an older
-    // one. A background refresh started for the previous target can resolve after a
-    // switch; without this it would stamp the list back to the stale target, leaving
-    // the new target's `currentAccessList` undefined (and, with the load-gated
-    // status, stuck "loading" since its own fetch already settled).
-    const targetKeyRef = useRef(targetKey);
-    targetKeyRef.current = targetKey;
-    // Initial (and target-change) load. Feeds setAccessList once; thereafter we own it.
+    // Initial (and target-change) load. Seeds local state once per target; thereafter
+    // local state is authoritative and mutations write through it.
     const { result: fetchedList, status: fetchStatus, error: fetchError, } = useCancelablePromise({
         promise: target
             ? () => backend.workspace(workspace).objectPermissions().getAccessList(target)
@@ -58,118 +51,77 @@ export function useAccessList(target, onSaved) {
     // Key on the serialized ref, not the ObjRef object — an inline idRef(...) is a
     // new instance each render and would otherwise refetch forever.
     [backend, workspace, target?.kind, targetKey]);
+    // Local state belongs to the current target only once its list has been seeded
+    // AND no fetch is in flight for it. Requiring `fetchStatus === "success"` (not
+    // just a matching `seededTarget`) matters when the same object is reopened after
+    // navigating away: the deps change re-runs `useCancelablePromise`, which resets to
+    // `loading` while it refetches. Without this, the still-matching previous
+    // `seededTarget` would keep `hasList` true and surface the prior session's
+    // grantees as `success` (mutations enabled) until the new list lands.
+    const hasList = seededTarget === targetKey && targetKey !== undefined && fetchStatus === "success";
     useEffect(() => {
         if (fetchStatus === "success" && fetchedList) {
             // The cancelable promise is keyed on targetKey, so this list is for it.
-            setAccessList(fetchedList);
-            setAccessListTarget(targetKey);
-            setLoadStatus("idle");
+            setGrantees(granteesFromAccessList(fetchedList));
+            setGeneralAccess(deriveGeneralAccess(fetchedList.grants));
+            setWorkspaceLevel(deriveWorkspacePermissionLevel(fetchedList.grants));
+            setSeededTarget(targetKey);
             setLoadError(undefined);
-            setOverlay({}); // a target-change load is authoritative; drop stale overlay
-            setOptimisticGeneralAccess(undefined);
         }
         else if (fetchStatus === "error") {
-            setLoadStatus("error");
             setLoadError(fetchError instanceof Error ? fetchError : new Error(String(fetchError)));
         }
         else if (fetchStatus === "loading") {
-            setLoadStatus("loading");
+            // A (re)fetch is in flight — including when the same object is reopened
+            // after navigating away. Drop the seed stamp so the previous session's
+            // list isn't surfaced as the current one until the fresh fetch is seeded.
+            setSeededTarget(undefined);
         }
     }, [fetchStatus, fetchedList, fetchError, targetKey]);
-    // Background refresh — pulls server truth without nulling the current list,
-    // then reconciles the overlay (clears entries the server now confirms).
-    const refresh = useCallback(async () => {
-        if (!target) {
-            return;
-        }
-        try {
-            const fresh = await backend.workspace(workspace).objectPermissions().getAccessList(target);
-            // The target may have changed while this refresh was in flight. Stamping
-            // a stale target's list now would clobber the new target's stamp and
-            // strand it loading, so drop the result if we've since switched away.
-            if (targetKeyRef.current !== targetKey) {
-                return;
-            }
-            setAccessList(fresh);
-            setAccessListTarget(targetKey);
-            setOverlay((prev) => reconcileOverlay(granteesFromAccessList(fresh), prev));
-            // Drop the optimistic general-access override once the server confirms it.
-            const freshGeneralAccess = deriveGeneralAccess(fresh.grants);
-            setOptimisticGeneralAccess((prev) => (prev === freshGeneralAccess ? undefined : prev));
-        }
-        catch {
-            // The refresh failed, but the mutation that triggered it already
-            // succeeded. The overlay can't be reconciled against fresh data now, so
-            // settle it optimistically: keep each entry's intended state (a `set`
-            // value stays, a `remove` keeps hiding the row) but clear its `pending`
-            // flag. Otherwise rows would spin on "saving"/"removing" forever even
-            // though the change persisted and a success toast was shown.
-            setOverlay((prev) => {
-                let changed = false;
-                const next = {};
-                for (const [id, entry] of Object.entries(prev)) {
-                    if (entry.pending) {
-                        changed = true;
-                        next[id] = { ...entry, pending: false };
-                    }
-                    else {
-                        next[id] = entry;
-                    }
-                }
-                return changed ? next : prev;
-            });
-        }
-    }, [backend, workspace, target, targetKey]);
-    // Committed rows overlaid with optimistic intent; backfill a human name from
-    // the picker cache where the grant only carried a raw id.
-    const grantees = useMemo(() => {
-        if (!currentAccessList) {
-            return [];
-        }
-        const committed = granteesFromAccessList(currentAccessList).map((g) => {
+    // The current target's rows, with a human name backfilled from the picker
+    // cache where the grant returned only a raw id. Empty until the current
+    // target's list is seeded, so a stale previous target's rows never show
+    // through the switch window. Derivation, not state — re-applies as the cache grows.
+    const namedGrantees = useMemo(() => hasList
+        ? grantees.map((g) => {
             const known = knownNames[g.id];
             return known && g.name === objRefToString(g.granteeRef) ? { ...g, name: known } : g;
-        });
-        return mergeOverlay(committed, overlay);
-    }, [currentAccessList, overlay, knownNames]);
-    const granteeIdsKey = granteesFromAccessList(currentAccessList)
+        })
+        : [], [hasList, grantees, knownNames]);
+    // Stable sorted key of the currently-granted ids — drives the picker's
+    // "exclude already-granted" filter. Keyed on ids only (not names), so the
+    // picker's own name-cache writes can't change loadOptions' identity and
+    // re-trigger its fetch.
+    const excludedIdsKey = useMemo(() => grantees
+        .filter((g) => g.pending !== "removing")
         .map((g) => g.id)
         .sort()
-        .join(",");
-    const committedGeneralAccess = useMemo(() => (currentAccessList ? deriveGeneralAccess(currentAccessList.grants) : "RESTRICTED"), [currentAccessList]);
-    const generalAccess = optimisticGeneralAccess ?? committedGeneralAccess;
+        .join(","), [grantees]);
     const summary = useMemo(() => {
-        if (!currentAccessList) {
+        if (!hasList) {
             return undefined;
         }
         return {
             generalAccess,
-            // While the optimistic override is active we just wrote the workspace
-            // rule as VIEW, so report VIEW rather than the stale fetched grant
-            // (which can still read SHARE through read-after-write lag).
-            workspaceLevel: optimisticGeneralAccess
-                ? "VIEW"
-                : deriveWorkspacePermissionLevel(currentAccessList.grants),
-            granteeCount: grantees.length,
+            workspaceLevel: generalAccess === "WORKSPACE" ? workspaceLevel : "VIEW",
+            granteeCount: namedGrantees.filter((g) => g.pending !== "removing").length,
         };
-    }, [currentAccessList, generalAccess, optimisticGeneralAccess, grantees]);
-    // "success" only once the *current* target's list has actually landed. After a
-    // target switch the stamp clears `currentAccessList` immediately, but
-    // `loadStatus` still reads "idle" from the previous target's completed load
-    // until the effect re-runs — so gating on loadStatus alone would briefly report
-    // "success" with no list, letting the dialog enable mutations and the catalog
-    // row hide both summary and skeleton. Treat "no list for this target yet" as
-    // loading.
+    }, [hasList, generalAccess, workspaceLevel, namedGrantees]);
+    // "success" only once the *current* target's list has been seeded. After a
+    // target switch the previous seed is stale (seededTarget !== targetKey), so
+    // gating on hasList keeps the status at "loading" until the new list lands —
+    // never "success" with no list, which would let the dialog enable mutations
+    // and the catalog row hide both summary and skeleton.
     const status = target
-        ? loadStatus === "error"
+        ? fetchStatus === "error"
             ? "error"
-            : loadStatus === "loading" || !currentAccessList
-                ? "loading"
-                : "success"
+            : hasList
+                ? "success"
+                : "loading"
         : "idle";
-    // Commit a single grant change against the backend, then reconcile via refresh.
-    // Optimistic state is applied by the caller; on failure the caller's rollback
-    // runs and a toast is shown.
+    // Write a single grant change to the backend, then toast. The caller applies
+    // the optimistic local write-through and rolls it back on failure; there is no
+    // refetch — local state stays authoritative.
     const commit = useCallback(async (mutate, successMessage) => {
         if (!target) {
             return false;
@@ -181,18 +133,17 @@ export function useAccessList(target, onSaved) {
                 .manageObjectPermissions(target, mutate);
             toast.addSuccess(successMessage);
             onSaved?.();
-            await refresh();
             return true;
         }
         catch {
             toast.addError(objectShareMessages.toastError);
             return false;
         }
-    }, [backend, workspace, target, toast, onSaved, refresh]);
+    }, [backend, workspace, target, toast, onSaved]);
     // Picker loader — fetches available assignees on demand, filters by the typed
-    // query, excludes anything already granted. Depends only on the grant sources
-    // (accessList, overlay), so its identity changes only when the granted set
-    // actually changes. It must NOT write state that feeds its own deps.
+    // query, excludes anything already granted. Depends only on the granted set
+    // (grantees), so its identity changes only when that set actually changes. It
+    // must NOT write state that feeds its own deps.
     const loadOptions = useCallback(async (search) => {
         if (!target) {
             return { groups: [], users: [] };
@@ -223,7 +174,7 @@ export function useAccessList(target, onSaved) {
             }
             return next;
         });
-        const excluded = new Set(mergeOverlay(granteesFromAccessList(currentAccessList), overlay).map((g) => g.id));
+        const excluded = new Set(excludedIdsKey ? excludedIdsKey.split(",") : []);
         const selectable = withIds
             .filter(({ id }) => !excluded.has(id)) // hide anyone already granted
             .filter(({ assignee }) => assigneeMatchesQuery(assignee, query));
@@ -240,24 +191,25 @@ export function useAccessList(target, onSaved) {
                 .filter(({ assignee }) => assignee.type !== "user")
                 .map(({ assignee, id }) => ({ id, kind: "group", name: assignee.name })),
         };
-    }, [backend, workspace, target, currentAccessList, overlay]);
+    }, [backend, workspace, target, excludedIdsKey]);
     // Reuse the picker's original ref (preserves UriRef vs IdentifierRef);
     // fall back to the serialized id only if it wasn't cached.
     const refForId = useCallback((id) => knownRefs[id] ?? { identifier: id.split(":", 2)[1] }, [knownRefs]);
     return {
         targetKey,
-        currentAccessList,
-        grantees,
-        granteeIdsKey,
+        hasList,
+        grantees: namedGrantees,
         generalAccess,
+        workspaceLevel,
         summary,
         status,
         loadError,
         commit,
         loadOptions,
         refForId,
-        setOverlay,
+        setGrantees,
+        setGeneralAccess,
+        setWorkspaceLevel,
         setKnownNames,
-        setOptimisticGeneralAccess,
     };
 }

package/esm/share/useLabelScope.d.ts

@@ -1,6 +1,4 @@
-import { type MutableRefObject } from "react";
 import { type IObjectPermissionsObject } from "@gooddata/sdk-backend-spi";
-import type { IObjectAccessList } from "@gooddata/sdk-model";
 import { type LabelScopePrincipal } from "./objectShareController.helpers.js";
 import type { IObjectShareLabel } from "./types.js";
 /**
@@ -30,11 +28,6 @@ export interface ILabelScope {
     /** Per-grantee label scope: grantee id → label ids in scope (primary always in). */
     selectedLabelIdsByGrantee: Record<string, string[]>;
     setSelectedLabelIdsByGrantee: React.Dispatch<React.SetStateAction<Record<string, string[]>>>;
-    /**
-     * Grantee ids whose scope was just written optimistically; the resolution
-     * effect keeps these instead of overwriting them through read-after-write lag.
-     */
-    optimisticScopeRef: MutableRefObject<Set<string>>;
     /**
      * The single per-label write path. Diffs `desired` vs `current` over the
      * permissionable labels and grants/revokes for one principal. Returns false
@@ -48,7 +41,12 @@ export interface ILabelScope {
  * which labels are permissionable, and exposes one reconcile primitive shared by
  * add / remove / general-access / the labels picker so their behavior can't drift.
  *
+ * The resolved scope is local-authoritative: the probe seeds a scope only for
+ * grantees it doesn't already know, so an optimistic scope written for a freshly
+ * added grantee is never overwritten by the backend's lagging read. Local scopes
+ * are dropped on a target switch so the next object re-resolves from scratch.
+ *
  * @internal
  */
-export declare function useLabelScope(target: IObjectPermissionsObject | undefined, targetKey: string | undefined, labels: IObjectShareLabel[], currentAccessList: IObjectAccessList | undefined, granteeIdsKey: string, labelsError: boolean, labelsLoading: boolean): ILabelScope;
+export declare function useLabelScope(target: IObjectPermissionsObject | undefined, targetKey: string | undefined, labels: IObjectShareLabel[], hasList: boolean, committedGranteeIds: string[], labelsError: boolean, labelsLoading: boolean): ILabelScope;
 //# sourceMappingURL=useLabelScope.d.ts.map

package/esm/share/useLabelScope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useLabelScope.d.ts","sourceRoot":"","sources":["../../src/share/useLabelScope.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAqD,MAAM,OAAO,CAAC;AAEjG,OAAO,EAAE,KAAK,wBAAwB,EAA6B,MAAM,2BAA2B,CAAC;AACrG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EACH,KAAK,mBAAmB,EAI3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAWpD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IACxB;;;;OAIG;IACH,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC;;;;;;;;OAQG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,sFAAoF;IACpF,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,4BAA4B,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F;;;OAGG;IACH,kBAAkB,EAAE,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD;;;;OAIG;IACH,mBAAmB,EAAE,CACjB,SAAS,EAAE,mBAAmB,EAC9B,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,KACnC,OAAO,CAAC,OAAO,CAAC,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,EAChD,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,OAAO,EACpB,aAAa,EAAE,OAAO,GACvB,WAAW,CAoKb"}
+{"version":3,"file":"useLabelScope.d.ts","sourceRoot":"","sources":["../../src/share/useLabelScope.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,wBAAwB,EAA6B,MAAM,2BAA2B,CAAC;AAGrG,OAAO,EACH,KAAK,mBAAmB,EAG3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAWpD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IACxB;;;;OAIG;IACH,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC;;;;;;;;OAQG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,sFAAoF;IACpF,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,4BAA4B,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F;;;;OAIG;IACH,mBAAmB,EAAE,CACjB,SAAS,EAAE,mBAAmB,EAC9B,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,KACnC,OAAO,CAAC,OAAO,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,OAAO,EAAE,OAAO,EAChB,mBAAmB,EAAE,MAAM,EAAE,EAC7B,WAAW,EAAE,OAAO,EACpB,aAAa,EAAE,OAAO,GACvB,WAAW,CAsKb"}

package/esm/share/useLabelScope.js

@@ -1,8 +1,8 @@
 // (C) 2026 GoodData Corporation
-import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useCallback, useEffect, useMemo, useState } from "react";
 import { isUnexpectedResponseError } from "@gooddata/sdk-backend-spi";
 import { useBackendStrict, useWorkspaceStrict } from "@gooddata/sdk-ui";
-import { buildLabelMutations, granteesFromAccessList, isGranteeGrantedIn, } from "./objectShareController.helpers.js";
+import { buildLabelMutations, isGranteeGrantedIn, } from "./objectShareController.helpers.js";
 /**
  * Whether a label's access-list error means the label is genuinely not
  * independently permissionable (a definitive 404 / 501), as opposed to a
@@ -17,13 +17,17 @@ function isNotPermissionable(error) {
  * which labels are permissionable, and exposes one reconcile primitive shared by
  * add / remove / general-access / the labels picker so their behavior can't drift.
  *
+ * The resolved scope is local-authoritative: the probe seeds a scope only for
+ * grantees it doesn't already know, so an optimistic scope written for a freshly
+ * added grantee is never overwritten by the backend's lagging read. Local scopes
+ * are dropped on a target switch so the next object re-resolves from scratch.
+ *
  * @internal
  */
-export function useLabelScope(target, targetKey, labels, currentAccessList, granteeIdsKey, labelsError, labelsLoading) {
+export function useLabelScope(target, targetKey, labels, hasList, committedGranteeIds, labelsError, labelsLoading) {
     const backend = useBackendStrict();
     const workspace = useWorkspaceStrict();
     const [selectedLabelIdsByGrantee, setSelectedLabelIdsByGrantee] = useState({});
-    const optimisticScopeRef = useRef(new Set());
     // Label ids whose permissions endpoint responded — not every display form is
     // independently permissionable (some 404). `undefined` means "not resolved
     // yet" (assume all).
@@ -39,19 +43,30 @@ export function useLabelScope(target, targetKey, labels, currentAccessList, gran
     useEffect(() => {
         setPermissionableLabelIds(undefined);
     }, [targetKey, labelsKey]);
+    // A target switch — or a label-set change under the same target (labels finish
+    // loading, a label added/removed) — drops every resolved scope so the seeding
+    // effect below re-resolves from the current label set's per-label lists rather
+    // than preserving scopes computed against the old labels. Without the labelsKey
+    // reset, an existing grantee would keep a scope missing a newly-added label even
+    // when the backend grants them access to it. (An add under the SAME labels only
+    // changes granteeIdsKey, not labelsKey, so an optimistic scope still survives.)
+    useEffect(() => {
+        setSelectedLabelIdsByGrantee({});
+    }, [targetKey, labelsKey]);
+    // Stable string key of the committed grantee ids — the array is rebuilt each
+    // render, so the effect keys on this instead to re-resolve only on a real change.
+    const granteeIdsKey = committedGranteeIds.slice().sort().join(",");
     // Resolve each grantee's label scope: fetch every label's access list once and
     // record, per grantee, which labels they appear in (primary label always counts).
     // Keyed on the committed grantee ids + labels so it re-resolves after add/remove.
-    // `hasAccessList` is a dep too: a list that loads with no named grantees keeps
+    // `hasList` is a dep too: a list that loads with no named grantees keeps
     // `granteeIdsKey` empty, so without it the effect would never run and the
     // permissionable set (404 filtering) would never resolve.
-    const hasAccessList = currentAccessList !== undefined;
     useEffect(() => {
-        if (!target || labels.length === 0 || !currentAccessList) {
+        if (!target || labels.length === 0 || !hasList) {
             return;
         }
         let cancelled = false;
-        const committedGranteeIds = granteesFromAccessList(currentAccessList).map((g) => g.id);
         Promise.all(labels.map((label) => backend
             .workspace(workspace)
             .objectPermissions()
@@ -89,13 +104,14 @@ export function useLabelScope(target, targetKey, labels, currentAccessList, gran
                 }
             }
             setSelectedLabelIdsByGrantee((prev) => {
-                // Keep a just-written optimistic scope through read-after-write lag;
-                // take the freshly-resolved scope for everyone else.
-                const next = { ...resolved };
-                for (const id of optimisticScopeRef.current) {
-                    if (prev[id]) {
-                        next[id] = prev[id];
-                    }
+                // Seed a scope only for grantees we don't already have one for. A
+                // scope written optimistically (a fresh add, a labels edit) is
+                // local-authoritative and must survive the re-resolution that the
+                // grantee-set change triggers — the backend's lagging read would
+                // otherwise reset it. Grantees gone from the list are dropped.
+                const next = {};
+                for (const id of committedGranteeIds) {
+                    next[id] = prev[id] ?? resolved[id];
                 }
                 return next;
             });
@@ -105,23 +121,14 @@ export function useLabelScope(target, targetKey, labels, currentAccessList, gran
             cancelled = true;
         };
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [backend, workspace, targetKey, labelsKey, granteeIdsKey, hasAccessList]);
-    // A label-set change OR a target switch re-resolves scopes; drop the optimistic-
-    // scope guard so the freshly-resolved scopes aren't held stale. Keying on
-    // labelsKey alone leaked across objects that happen to share a labelsKey (e.g.
-    // during navigation, before the new object's labels load): the prior object's
-    // optimistic entries would then merge over the new object's resolved scopes and
-    // show/save the wrong label grants. targetKey makes the guard per-object.
-    useEffect(() => {
-        optimisticScopeRef.current = new Set();
-    }, [labelsKey, targetKey]);
+    }, [backend, workspace, targetKey, labelsKey, granteeIdsKey, hasList]);
     // Only labels whose permissions endpoint responded are scope-controllable; until
     // resolution completes (permissionableLabelIds undefined) assume all are usable.
     // While the current target's list isn't loaded yet, ignore a permissionable set
     // left over from a previous object so we never mis-filter the new labels.
-    const effectiveLabels = useMemo(() => currentAccessList && permissionableLabelIds
+    const effectiveLabels = useMemo(() => hasList && permissionableLabelIds
         ? labels.filter((l) => permissionableLabelIds.has(l.id))
-        : labels, [labels, permissionableLabelIds, currentAccessList]);
+        : labels, [labels, permissionableLabelIds, hasList]);
     // Resolution is done when the probe has produced a permissionable set, or when
     // there are genuinely no labels to probe (a label-free object). Until then
     // callers must treat the scope as unknown (not "all selected").
@@ -154,7 +161,6 @@ export function useLabelScope(target, targetKey, labels, currentAccessList, gran
         labelsResolved,
         selectedLabelIdsByGrantee,
         setSelectedLabelIdsByGrantee,
-        optimisticScopeRef,
         reconcileLabelScope,
     };
 }

package/esm/share/useObjectShareController.d.ts

@@ -1,24 +1,27 @@
 import type { IObjectPermissionsObject } from "@gooddata/sdk-backend-spi";
-import { type IObjectShareController } from "./objectShareController.types.js";
-import type { IObjectShareLabel } from "./types.js";
+import { type IObjectShareController, type IUseObjectShareOptions } from "./objectShareController.types.js";
 /**
- * Manages the share dialog state and backend I/O for a single shareable
- * object.
+ * Manages the share dialog state and backend I/O for a single shareable object.
  *
- * The access list is fetched (and re-fetched after every save) via
- * `useCancelablePromise`; everything that reflects the backend — the grantee
- * rows, general-access value, summary — is derived from it on render, never
- * copied into local state. Local state is only the dialog's own transient UI:
- * the active subview, the add-grantee buffer, the pending general-access
- * confirm, and an in-flight save flag. Top-level open/close is the consumer's
- * concern (see {@link ObjectShareDialog}).
+ * The access list is fetched once and seeded into local state, which is the
+ * source of truth while the dialog/summary is mounted. Each access change is
+ * written through to local state immediately and sent to the backend; on failure
+ * the one changed entry is rolled back. There is no post-write refetch, so the
+ * grantee list never blanks and never fights the backend's read-after-write lag.
+ * Top-level open/close is the consumer's concern (see {@link ObjectShareDialog}).
  *
- * Mutations follow a **commit-on-interaction** model: each access change is
- * sent immediately; the general-access toggle goes through a confirm step
- * because it is high-impact. There is no batched Save. The list is fetched
- * eagerly so `state.summary` also drives an inline access row while closed.
+ * Mutations follow a **commit-on-interaction** model: each access change is sent
+ * immediately; the general-access toggle goes through a confirm step because it
+ * is high-impact. There is no batched Save. The list is fetched eagerly so
+ * `state.summary` also drives an inline access row while closed.
+ *
+ * Most consumers do not call this directly — render {@link ObjectShareDialog} with
+ * plain props and it owns its controller. Call this (exported as `useObjectShare`)
+ * only to share a single access-list fetch between the dialog and an inline summary
+ * row: call it once, read `state.summary` for the row, and pass the controller into
+ * the dialog.
  *
  * @internal
  */
-export declare function useObjectShareController(target: IObjectPermissionsObject | undefined, onSaved?: () => void, labels?: IObjectShareLabel[], labelsError?: boolean, labelsLoading?: boolean): IObjectShareController;
+export declare function useObjectShareController(target: IObjectPermissionsObject | undefined, options?: IUseObjectShareOptions): IObjectShareController;
 //# sourceMappingURL=useObjectShareController.d.ts.map

package/esm/share/useObjectShareController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useObjectShareController.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareController.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAW1E,OAAO,EACH,KAAK,sBAAsB,EAK9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIpD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,MAAM,IAAI,EACpB,MAAM,GAAE,iBAAiB,EAAc,EACvC,WAAW,UAAQ,EACnB,aAAa,UAAQ,GACtB,sBAAsB,CAyZxB"}
+{"version":3,"file":"useObjectShareController.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareController.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAa1E,OAAO,EACH,KAAK,sBAAsB,EAI3B,KAAK,sBAAsB,EAE9B,MAAM,kCAAkC,CAAC;AAI1C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,sBAAsB,GACjC,sBAAsB,CAggBxB"}