@gooddata/sdk-ui-ext 11.47.0-alpha.4 → 11.47.0-alpha.5

package/esm/share/accessSummary.js

@@ -1,26 +1,57 @@
 // (C) 2026 GoodData Corporation
 /**
- * Find the `allWorkspaceUsers` rule grant if one exists. Its presence with
- * non-empty `permissions` is the single signal that distinguishes WORKSPACE
- * from RESTRICTED general access.
+ * All `allWorkspaceUsers` rule grants. With workspace hierarchy the backend
+ * returns one entry per granting workspace — this workspace's own grant carries
+ * direct `permissions` while a parent's carries `inheritedPermissions`, in
+ * unspecified order. Callers must aggregate across entries, never inspect just
+ * the first.
  */
-export function findAllWorkspaceUsersGrant(grants) {
-    return grants.find((g) => g.type === "allWorkspaceUsers");
+export function findAllWorkspaceUsersGrants(grants) {
+    return grants.filter((g) => g.type === "allWorkspaceUsers");
 }
+/**
+ * Whether THIS workspace grants access to all workspace users — some rule entry
+ * with non-empty direct `permissions`. Inherited (parent-workspace) rule access
+ * is deliberately excluded: this value backs the mutable direct state; displays
+ * compose it with {@link deriveInheritedWorkspaceLevel}.
+ */
 export function deriveGeneralAccess(grants) {
-    const rule = findAllWorkspaceUsersGrant(grants);
-    return rule && rule.permissions.length > 0 ? "WORKSPACE" : "RESTRICTED";
+    return findAllWorkspaceUsersGrants(grants).some((rule) => rule.permissions.length > 0)
+        ? "WORKSPACE"
+        : "RESTRICTED";
 }
 /**
- * Workspace-wide permission level when the rule grant exists. Defaults to
- * VIEW; promoted to SHARE only when the rule explicitly permits SHARE. EDIT
- * is intentionally not surfaced — the UI caps at VIEW/SHARE.
+ * Workspace-wide permission level of this workspace's own rule grant. Defaults
+ * to VIEW; promoted to SHARE only when some rule entry directly permits SHARE.
+ * EDIT is intentionally not surfaced — the UI caps at VIEW/SHARE.
  */
 export function deriveWorkspacePermissionLevel(grants) {
-    const rule = findAllWorkspaceUsersGrant(grants);
-    return rule?.permissions.includes("SHARE") ? "SHARE" : "VIEW";
+    return findAllWorkspaceUsersGrants(grants).some((rule) => rule.permissions.includes("SHARE"))
+        ? "SHARE"
+        : "VIEW";
+}
+/**
+ * Strongest workspace-wide level inherited from parent workspaces, or undefined
+ * when none is inherited. Inherited rule access grants every user of this
+ * workspace access too (workspace membership cascades down the hierarchy), yet
+ * cannot be revoked from here — consumers must surface it as workspace access
+ * and disable the Restricted option.
+ */
+export function deriveInheritedWorkspaceLevel(grants) {
+    const inherited = findAllWorkspaceUsersGrants(grants).flatMap((rule) => rule.inheritedPermissions);
+    if (inherited.includes("SHARE")) {
+        return "SHARE";
+    }
+    return inherited.length > 0 ? "VIEW" : undefined;
 }
 /**
- * Count of named grantees (users + user groups). The `allWorkspaceUsers` rule
- * grant is excluded.
+ * The effective (displayed) workspace access: the direct state composed with
+ * inherited rule access. Inherited access makes general access WORKSPACE even
+ * when this workspace holds no rule of its own, and the level is the strongest
+ * of the two.
  */
+export function composeEffectiveWorkspaceAccess(direct, directLevel, inheritedLevel) {
+    const generalAccess = direct === "WORKSPACE" || inheritedLevel ? "WORKSPACE" : "RESTRICTED";
+    const workspaceLevel = inheritedLevel === "SHARE" || (direct === "WORKSPACE" && directLevel === "SHARE") ? "SHARE" : "VIEW";
+    return { generalAccess, workspaceLevel };
+}

package/esm/share/objectShareController.types.d.ts

@@ -80,6 +80,20 @@ export interface IObjectShareControllerState {
      * never offered for the workspace rule.
      */
     workspaceLevel: "VIEW" | "SHARE";
+    /**
+     * Whether workspace-wide access is (at least partly) inherited from a parent
+     * workspace. Inherited rule access grants every user of this workspace access
+     * too, yet cannot be revoked from here — consumers disable the Restricted
+     * option and explain why. `generalAccess` and `workspaceLevel` are effective
+     * values that already account for it.
+     */
+    workspaceAccessInherited: boolean;
+    /**
+     * Whether the workspace-rule level dropdown must be read-only: this workspace
+     * holds no rule of its own to re-grade (access is inherited-only), or an
+     * inherited SHARE pins the effective level regardless of the direct grant.
+     */
+    workspaceLevelLocked: boolean;
     /**
      * Whether a workspace-level re-grade is in flight. Consumers disable the
      * workspace permission dropdown while true so rapid toggles can't issue

package/esm/share/objectShareController.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"objectShareController.types.d.ts","sourceRoot":"","sources":["../../src/share/objectShareController.types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,KAAK,EACR,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAElE;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IAClC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAC9D,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,0BAA0B,CAAC;IAClC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IACxC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,mBAAmB,CAAC;IACrD,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5D,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;;OAMG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAE1C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,aAAa,EAAE,kBAAkB,CAAC;IAClC;;;;;OAKG;IACH,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAE9B;;;OAGG;IACH,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpD,mEAAiE;IACjE,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C,qEAAqE;IACrE,eAAe,EAAE,gBAAgB,EAAE,CAAC;IAEpC;;;;OAIG;IACH,cAAc,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClD;;;;OAIG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B,iEAAiE;IACjE,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,oBAAoB,EAAE,OAAO,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC1C,sFAAsF;IACtF,KAAK,EAAE,MAAM,IAAI,CAAC;IAElB,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,kBAAkB,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACvD;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3F,kDAAkD;IAClD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC,oEAAoE;IACpE,qBAAqB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,oCAAoC;IACpC,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;OAGG;IACH,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF,+DAA+D;IAC/D,0BAA0B,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/D,yBAAyB,EAAE,MAAM,IAAI,CAAC;IACtC,4DAA4D;IAC5D,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE,gEAAgE;IAChE,qBAAqB,EAAE,MAAM,IAAI,CAAC;IAClC,mFAAmF;IACnF,sBAAsB,EAAE,MAAM,IAAI,CAAC;IACnC;;;OAGG;IACH,iBAAiB,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAC1D,6DAA6D;IAC7D,yBAAyB,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD;;;;;OAKG;IACH,wBAAwB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,2BAA2B,CAAC;IACnC,OAAO,EAAE,6BAA6B,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAC;CACpB"}
+{"version":3,"file":"objectShareController.types.d.ts","sourceRoot":"","sources":["../../src/share/objectShareController.types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,KAAK,EACR,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAElE;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IAClC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAC9D,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,0BAA0B,CAAC;IAClC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IACxC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,mBAAmB,CAAC;IACrD,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5D,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;;OAMG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAE1C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,aAAa,EAAE,kBAAkB,CAAC;IAClC;;;;;OAKG;IACH,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;;;OAMG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAE9B;;;OAGG;IACH,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpD,mEAAiE;IACjE,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C,qEAAqE;IACrE,eAAe,EAAE,gBAAgB,EAAE,CAAC;IAEpC;;;;OAIG;IACH,cAAc,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClD;;;;OAIG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B,iEAAiE;IACjE,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,oBAAoB,EAAE,OAAO,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC1C,sFAAsF;IACtF,KAAK,EAAE,MAAM,IAAI,CAAC;IAElB,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,kBAAkB,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACvD;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3F,kDAAkD;IAClD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC,oEAAoE;IACpE,qBAAqB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,oCAAoC;IACpC,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;OAGG;IACH,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF,+DAA+D;IAC/D,0BAA0B,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/D,yBAAyB,EAAE,MAAM,IAAI,CAAC;IACtC,4DAA4D;IAC5D,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE,gEAAgE;IAChE,qBAAqB,EAAE,MAAM,IAAI,CAAC;IAClC,mFAAmF;IACnF,sBAAsB,EAAE,MAAM,IAAI,CAAC;IACnC;;;OAGG;IACH,iBAAiB,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAC1D,6DAA6D;IAC7D,yBAAyB,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD;;;;;OAKG;IACH,wBAAwB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,2BAA2B,CAAC;IACnC,OAAO,EAAE,6BAA6B,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAC;CACpB"}

package/esm/share/useAccessList.d.ts

@@ -15,10 +15,22 @@ export interface IAccessList {
     hasList: boolean;
     /** Local grantee rows — seeded from the fetch, then authoritative; mutations write through. */
     grantees: IObjectShareGrantee[];
-    /** Workspace vs restricted general access — local state; mutations write through. */
+    /**
+     * Workspace vs restricted general access granted by THIS workspace's own rule —
+     * local state; mutations write through. Excludes inherited (parent-workspace)
+     * rule access, which is exposed separately as `inheritedWorkspaceLevel`.
+     */
     generalAccess: GeneralAccessValue;
     /** Workspace-rule permission level (VIEW/SHARE) — local state; mutations write through. */
     workspaceLevel: "VIEW" | "SHARE";
+    /**
+     * Strongest workspace-wide level inherited from parent workspaces, or undefined
+     * when none. Seeded from the fetch and never mutated: inherited access cannot
+     * be changed from this workspace, so no write-through applies. Effective
+     * (displayed) general access is WORKSPACE whenever this is set, regardless of
+     * the direct `generalAccess` state.
+     */
+    inheritedWorkspaceLevel: "VIEW" | "SHARE" | undefined;
     /** Inline access summary, or undefined before the first load. */
     summary: IObjectAccessSummary | undefined;
     /** Top-level load status surfaced as the controller status. */

package/esm/share/useAccessList.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAccessList.d.ts","sourceRoot":"","sources":["../../src/share/useAccessList.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAEH,KAAK,sBAAsB,EAE3B,KAAK,MAAM,EAGd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,sBAAsB,EAAmB,MAAM,sBAAsB,CAAC;AAa7G,OAAO,KAAK,EAER,2BAA2B,EAC3B,mBAAmB,EACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,iFAAiF;IACjF,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,wFAAwF;IACxF,OAAO,EAAE,OAAO,CAAC;IACjB,iGAA+F;IAC/F,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,uFAAqF;IACrF,aAAa,EAAE,kBAAkB,CAAC;IAClC,6FAA2F;IAC3F,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,iEAAiE;IACjE,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC1C,+DAA+D;IAC/D,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9C,iDAAiD;IACjD,SAAS,EAAE,KAAK,GAAG,SAAS,CAAC;IAC7B;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B,mFAAmF;IACnF,MAAM,EAAE,CAAC,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/F;;;;OAIG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3F;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC;;;;;;;;OAQG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B,2FAA2F;IAC3F,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;IAEjC,qGAAqG;IACrG,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACzE,8EAA8E;IAC9E,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3E;;;;OAIG;IACH,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,EACjC,UAAU,EAAE,OAAO,GACpB,WAAW,CAkTb"}
+{"version":3,"file":"useAccessList.d.ts","sourceRoot":"","sources":["../../src/share/useAccessList.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAEH,KAAK,sBAAsB,EAE3B,KAAK,MAAM,EAGd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,sBAAsB,EAAmB,MAAM,sBAAsB,CAAC;AAkB7G,OAAO,KAAK,EAER,2BAA2B,EAC3B,mBAAmB,EACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,iFAAiF;IACjF,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,wFAAwF;IACxF,OAAO,EAAE,OAAO,CAAC;IACjB,iGAA+F;IAC/F,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC;;;;OAIG;IACH,aAAa,EAAE,kBAAkB,CAAC;IAClC,6FAA2F;IAC3F,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;;;OAMG;IACH,uBAAuB,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IACtD,iEAAiE;IACjE,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC1C,+DAA+D;IAC/D,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9C,iDAAiD;IACjD,SAAS,EAAE,KAAK,GAAG,SAAS,CAAC;IAC7B;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B,mFAAmF;IACnF,MAAM,EAAE,CAAC,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/F;;;;OAIG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3F;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC;;;;;;;;OAQG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B,2FAA2F;IAC3F,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;IAEjC,qGAAqG;IACrG,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACzE,8EAA8E;IAC9E,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3E;;;;OAIG;IACH,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,EACjC,UAAU,EAAE,OAAO,GACpB,WAAW,CAwTb"}

package/esm/share/useAccessList.js

@@ -4,7 +4,7 @@ import { idRef, objRefToString, } from "@gooddata/sdk-model";
 import { useBackendStrict, useCancelablePromise, useWorkspaceStrict } from "@gooddata/sdk-ui";
 import { useToastMessage } from "@gooddata/sdk-ui-kit";
 import { isPermissionsNotAvailable } from "./accessErrors.js";
-import { deriveGeneralAccess, deriveWorkspacePermissionLevel } from "./accessSummary.js";
+import { composeEffectiveWorkspaceAccess, deriveGeneralAccess, deriveInheritedWorkspaceLevel, deriveWorkspacePermissionLevel, } from "./accessSummary.js";
 import { objectShareMessages } from "./messages.js";
 import { assigneeIdentityFacts, assigneeMatchesQuery, granteeId, granteesFromAccessList, userDisplayPair, userIdentityFacts, } from "./objectShareController.helpers.js";
 /**
@@ -30,6 +30,7 @@ export function useAccessList(target, onSaved, dialogOpen) {
     const [grantees, setGrantees] = useState([]);
     const [generalAccess, setGeneralAccess] = useState("RESTRICTED");
     const [workspaceLevel, setWorkspaceLevel] = useState("VIEW");
+    const [inheritedWorkspaceLevel, setInheritedWorkspaceLevel] = useState(undefined);
     // The target the local state was seeded for; undefined until the first seed.
     // Reading state as belonging to the current target hinges on this matching
     // `targetKey` — a target switch makes the old state stale until the re-seed.
@@ -82,6 +83,7 @@ export function useAccessList(target, onSaved, dialogOpen) {
             setGrantees(granteesFromAccessList(fetchedList));
             setGeneralAccess(deriveGeneralAccess(fetchedList.grants));
             setWorkspaceLevel(deriveWorkspacePermissionLevel(fetchedList.grants));
+            setInheritedWorkspaceLevel(deriveInheritedWorkspaceLevel(fetchedList.grants));
             setSeededTarget(targetKey);
             setLoadError(undefined);
         }
@@ -164,12 +166,13 @@ export function useAccessList(target, onSaved, dialogOpen) {
         if (!hasList) {
             return undefined;
         }
+        // The summary shows effective access: an inherited rule counts as
+        // workspace access even when this workspace holds no rule of its own.
         return {
-            generalAccess,
-            workspaceLevel: generalAccess === "WORKSPACE" ? workspaceLevel : "VIEW",
+            ...composeEffectiveWorkspaceAccess(generalAccess, workspaceLevel, inheritedWorkspaceLevel),
             granteeCount: namedGrantees.filter((g) => g.pending !== "removing").length,
         };
-    }, [hasList, generalAccess, workspaceLevel, namedGrantees]);
+    }, [hasList, generalAccess, workspaceLevel, inheritedWorkspaceLevel, namedGrantees]);
     // "success" only once the *current* target's list has been seeded. After a
     // target switch the previous seed is stale (seededTarget !== targetKey), so
     // gating on hasList keeps the status at "loading" until the new list lands —
@@ -266,6 +269,7 @@ export function useAccessList(target, onSaved, dialogOpen) {
         grantees: namedGrantees,
         generalAccess,
         workspaceLevel,
+        inheritedWorkspaceLevel,
         summary,
         status,
         loadError,

package/esm/share/useObjectShareController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useObjectShareController.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareController.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAkB1E,OAAO,EACH,KAAK,sBAAsB,EAI3B,KAAK,sBAAsB,EAE9B,MAAM,kCAAkC,CAAC;AAI1C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,sBAAsB,GACjC,sBAAsB,CAuyBxB"}
+{"version":3,"file":"useObjectShareController.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareController.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAmB1E,OAAO,EACH,KAAK,sBAAsB,EAI3B,KAAK,sBAAsB,EAE9B,MAAM,kCAAkC,CAAC;AAI1C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,sBAAsB,GACjC,sBAAsB,CAo0BxB"}

package/esm/share/useObjectShareController.js

@@ -2,6 +2,7 @@
 import { useCallback, useMemo, useRef, useState } from "react";
 import { areObjRefsEqual } from "@gooddata/sdk-model";
 import { useToastMessage, } from "@gooddata/sdk-ui-kit";
+import { composeEffectiveWorkspaceAccess } from "./accessSummary.js";
 import { objectShareMessages } from "./messages.js";
 import { EMPTY_IDS, NO_LABELS, effectivePermissionAbove, granularGranteeFor, toGranularGrantee, } from "./objectShareController.helpers.js";
 import { useAccessList } from "./useAccessList.js";
@@ -49,7 +50,7 @@ export function useObjectShareController(target, options) {
     const [workspaceLevelSaving, setWorkspaceLevelSaving] = useState(false);
     // The backend access list, seeded into local state (rows, general access,
     // summary, the commit/picker primitives) lives in its own hook.
-    const { targetKey, hasList, grantees, generalAccess, workspaceLevel, summary, status, loadError, accessUnavailable, commit, loadOptions, refForId, getCurrentUserRef, canTransferOwnership, setGrantees, setGeneralAccess, setWorkspaceLevel, } = useAccessList(target, onSaved, isOpen);
+    const { targetKey, hasList, grantees, generalAccess, workspaceLevel, inheritedWorkspaceLevel, summary, status, loadError, accessUnavailable, commit, loadOptions, refForId, getCurrentUserRef, canTransferOwnership, setGrantees, setGeneralAccess, setWorkspaceLevel, } = useAccessList(target, onSaved, isOpen);
     // Always-current target key, read inside async mutation finalizers that captured
     // an older one. A write started for object A resolves after the user navigated to
     // object B; because local state is authoritative (no refetch), applying A's
@@ -336,10 +337,19 @@ export function useObjectShareController(target, options) {
         setSelectedLabelIdsByGrantee,
     ]);
     const requestGeneralAccessChange = useCallback((next) => {
-        if (next !== generalAccess) {
+        // Inherited rule access can't be revoked from this workspace, so a
+        // Restricted request can never be honored — refuse it (the radio row
+        // is also disabled). Compare against the effective value the radio
+        // shows: with inherited access it is WORKSPACE even when this
+        // workspace holds no rule of its own.
+        if (inheritedWorkspaceLevel && next === "RESTRICTED") {
+            return;
+        }
+        const effective = inheritedWorkspaceLevel ? "WORKSPACE" : generalAccess;
+        if (next !== effective) {
             setPendingGeneralAccess(next);
         }
-    }, [generalAccess]);
+    }, [generalAccess, inheritedWorkspaceLevel]);
     const confirmGeneralAccessChange = useCallback(async () => {
         const next = pendingGeneralAccess;
         if (!next || next === generalAccess) {
@@ -410,9 +420,14 @@ export function useObjectShareController(target, options) {
     ]);
     const changeWorkspaceLevel = useCallback(async (level) => {
         // Only re-grade an already-granted workspace rule; ignore no-ops, calls made
-        // while access is restricted (no rule to re-grade), and re-entry while a
+        // while this workspace grants no rule of its own (inherited-only access has
+        // nothing to re-grade), calls while an inherited SHARE pins the effective
+        // level (a direct downgrade couldn't change it), and re-entry while a
         // previous re-grade is still in flight (would overlap writes).
-        if (generalAccess !== "WORKSPACE" || level === workspaceLevel || workspaceLevelSaving) {
+        if (generalAccess !== "WORKSPACE" ||
+            inheritedWorkspaceLevel === "SHARE" ||
+            level === workspaceLevel ||
+            workspaceLevelSaving) {
             return;
         }
         const startedFor = targetKey;
@@ -433,7 +448,15 @@ export function useObjectShareController(target, options) {
             setWorkspaceLevel(previousLevel);
         }
         setWorkspaceLevelSaving(false);
-    }, [generalAccess, workspaceLevel, workspaceLevelSaving, targetKey, commit, setWorkspaceLevel]);
+    }, [
+        generalAccess,
+        inheritedWorkspaceLevel,
+        workspaceLevel,
+        workspaceLevelSaving,
+        targetKey,
+        commit,
+        setWorkspaceLevel,
+    ]);
     const openTransferOwnership = useCallback(() => {
         setSubview("transferOwnership");
         setTransferTargetState(undefined);
@@ -643,11 +666,14 @@ export function useObjectShareController(target, options) {
         accessUnavailable,
         summary,
         grantees,
-        generalAccess,
-        // The workspace rule isn't granted while restricted, so its level is
-        // meaningless then — pin to VIEW so the (hidden) dropdown never shows a
-        // stale SHARE left over from a prior workspace grant.
-        workspaceLevel: generalAccess === "WORKSPACE" ? workspaceLevel : "VIEW",
+        // Effective access: the direct state composed with inherited rule
+        // access. Also pins the level to VIEW while restricted, so the (hidden)
+        // dropdown never shows a stale SHARE left over from a prior grant.
+        ...composeEffectiveWorkspaceAccess(generalAccess, workspaceLevel, inheritedWorkspaceLevel),
+        workspaceAccessInherited: inheritedWorkspaceLevel !== undefined,
+        // No direct rule to re-grade (inherited-only access), or an inherited
+        // SHARE pins the effective level — either way the dropdown is read-only.
+        workspaceLevelLocked: generalAccess !== "WORKSPACE" || inheritedWorkspaceLevel === "SHARE",
         workspaceLevelSaving,
         labels: effectiveLabels,
         labelsResolved,
@@ -668,6 +694,7 @@ export function useObjectShareController(target, options) {
         grantees,
         generalAccess,
         workspaceLevel,
+        inheritedWorkspaceLevel,
         workspaceLevelSaving,
         effectiveLabels,
         labelsResolved,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gooddata/sdk-ui-ext",
-  "version": "11.47.0-alpha.4",
+  "version": "11.47.0-alpha.5",
   "description": "GoodData.UI SDK - Extensions",
   "license": "LicenseRef-LICENSE",
   "author": "GoodData Corporation",
@@ -63,20 +63,20 @@
     "ts-invariant": "0.10.3",
     "tslib": "2.8.1",
     "uuid": "11.1.1",
-    "@gooddata/sdk-backend-base": "11.47.0-alpha.4",
-    "@gooddata/sdk-model": "11.47.0-alpha.4",
-    "@gooddata/sdk-backend-spi": "11.47.0-alpha.4",
-    "@gooddata/sdk-ui": "11.47.0-alpha.4",
-    "@gooddata/sdk-embedding": "11.47.0-alpha.4",
-    "@gooddata/sdk-ui-charts": "11.47.0-alpha.4",
-    "@gooddata/sdk-ui-filters": "11.47.0-alpha.4",
-    "@gooddata/sdk-ui-geo": "11.47.0-alpha.4",
-    "@gooddata/sdk-ui-kit": "11.47.0-alpha.4",
-    "@gooddata/sdk-ui-semantic-search": "11.47.0-alpha.4",
-    "@gooddata/sdk-ui-theme-provider": "11.47.0-alpha.4",
-    "@gooddata/sdk-ui-vis-commons": "11.47.0-alpha.4",
-    "@gooddata/util": "11.47.0-alpha.4",
-    "@gooddata/sdk-ui-pivot": "11.47.0-alpha.4"
+    "@gooddata/sdk-backend-spi": "11.47.0-alpha.5",
+    "@gooddata/sdk-embedding": "11.47.0-alpha.5",
+    "@gooddata/sdk-model": "11.47.0-alpha.5",
+    "@gooddata/sdk-backend-base": "11.47.0-alpha.5",
+    "@gooddata/sdk-ui": "11.47.0-alpha.5",
+    "@gooddata/sdk-ui-charts": "11.47.0-alpha.5",
+    "@gooddata/sdk-ui-filters": "11.47.0-alpha.5",
+    "@gooddata/sdk-ui-geo": "11.47.0-alpha.5",
+    "@gooddata/sdk-ui-kit": "11.47.0-alpha.5",
+    "@gooddata/sdk-ui-pivot": "11.47.0-alpha.5",
+    "@gooddata/sdk-ui-semantic-search": "11.47.0-alpha.5",
+    "@gooddata/sdk-ui-theme-provider": "11.47.0-alpha.5",
+    "@gooddata/sdk-ui-vis-commons": "11.47.0-alpha.5",
+    "@gooddata/util": "11.47.0-alpha.5"
   },
   "devDependencies": {
     "@microsoft/api-documenter": "^7.17.0",
@@ -124,12 +124,12 @@
     "typescript": "5.9.3",
     "vitest": "4.1.8",
     "vitest-dom": "0.1.1",
-    "@gooddata/eslint-config": "11.47.0-alpha.4",
-    "@gooddata/i18n-toolkit": "11.47.0-alpha.4",
-    "@gooddata/oxlint-config": "11.47.0-alpha.4",
-    "@gooddata/reference-workspace": "11.47.0-alpha.4",
-    "@gooddata/sdk-backend-mockingbird": "11.47.0-alpha.4",
-    "@gooddata/stylelint-config": "11.47.0-alpha.4"
+    "@gooddata/eslint-config": "11.47.0-alpha.5",
+    "@gooddata/i18n-toolkit": "11.47.0-alpha.5",
+    "@gooddata/oxlint-config": "11.47.0-alpha.5",
+    "@gooddata/reference-workspace": "11.47.0-alpha.5",
+    "@gooddata/sdk-backend-mockingbird": "11.47.0-alpha.5",
+    "@gooddata/stylelint-config": "11.47.0-alpha.5"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",