@gooddata/sdk-ui-ext 11.51.0-alpha.0 → 11.51.0-alpha.2

package/esm/share/objectShareController.helpers.js

@@ -27,7 +27,7 @@ export function assigneeIdentityFacts(assignee) {
         ? userIdentityFacts(assignee.ref, assignee.name, assignee.email)
         : { name: groupNameFact(assignee.ref, assignee.name) };
 }
-/** Display pair per the spec's fallback order: name + email → name + userID → email + userID → userID. */
+/** Display pair, falling back: name + email → name + userID → email + userID → userID. */
 export function userDisplayPair(facts, userId) {
     if (facts.name) {
         return { name: facts.name, email: facts.email ?? userId };
@@ -45,6 +45,45 @@ export function granteeDisplayPair(grantee) {
     }
     return userDisplayPair(grantee, id);
 }
+/**
+ * Deterministic display order for grantee rows — the backend returns them
+ * unsorted (and in an order that shuffles across reloads). Own row first, then
+ * groups, then users; within each, case-insensitive by display name with the
+ * grantee id as a stable tiebreaker so equal names don't reshuffle. Returns a
+ * new array; the input is not mutated.
+ */
+export function sortGrantees(grantees) {
+    const rank = (g) => (g.isSelf ? 0 : g.kind === "group" ? 1 : 2);
+    return grantees.slice().sort((a, b) => {
+        const byRank = rank(a) - rank(b);
+        if (byRank !== 0) {
+            return byRank;
+        }
+        const byName = granteeDisplayPair(a).name.localeCompare(granteeDisplayPair(b).name, undefined, {
+            sensitivity: "base",
+        });
+        return byName === 0 ? a.id.localeCompare(b.id) : byName;
+    });
+}
+/**
+ * Deterministic display order for an attribute's labels — the backend returns
+ * display forms in an order that isn't guaranteed stable. Primary (key) label
+ * first, then the rest case-insensitive by title with the label id as a stable
+ * tiebreaker. Shared by the detail-page labels popup and the share dialog's
+ * label-access checklist so the two never disagree. Returns a new array; the
+ * input is not mutated.
+ *
+ * @internal
+ */
+export function sortShareableLabels(labels) {
+    return labels.slice().sort((a, b) => {
+        if (a.isPrimary !== b.isPrimary) {
+            return a.isPrimary ? -1 : 1;
+        }
+        const byTitle = a.title.localeCompare(b.title, undefined, { sensitivity: "base" });
+        return byTitle === 0 ? a.id.localeCompare(b.id) : byTitle;
+    });
+}
 /** Case-insensitive match of an assignee against the picker query (name, or email for users). */
 export function assigneeMatchesQuery(assignee, query) {
     if (!query) {
@@ -55,27 +94,44 @@ export function assigneeMatchesQuery(assignee, query) {
 }
 /** Permission levels from strongest to weakest; the row shows the strongest it holds. */
 const LEVELS_STRONGEST_FIRST = ["EDIT", "SHARE", "VIEW"];
+const LEVEL_RANK = { VIEW: 0, SHARE: 1, EDIT: 2 };
+/** The strongest permission level present, or undefined when none. */
+export function strongestLevel(permissions) {
+    return LEVELS_STRONGEST_FIRST.find((level) => permissions.includes(level));
+}
 /** The row's directly-granted level — the strongest permission present, defaulting to VIEW. */
 export function directLevel(permissions) {
-    return LEVELS_STRONGEST_FIRST.find((level) => permissions.includes(level)) ?? "VIEW";
+    return strongestLevel(permissions) ?? "VIEW";
+}
+/**
+ * Levels strictly above the given one, e.g. for disabling levels the caller can't
+ * grant. An undefined bound means "unknown" — nothing is above it, so no level is
+ * disabled.
+ */
+export function levelsAbove(level) {
+    return level === undefined ? [] : LEVELS_STRONGEST_FIRST.filter((l) => LEVEL_RANK[l] > LEVEL_RANK[level]);
+}
+/** Levels strictly below the given one, e.g. for disabling levels an inherited grant already exceeds. */
+export function levelsBelow(level) {
+    return LEVELS_STRONGEST_FIRST.filter((l) => LEVEL_RANK[l] < LEVEL_RANK[level]);
 }
 /**
  * The effective permission to surface as a warning, or undefined when the direct
- * grant already covers it. Set only when the grantee *inherits* SHARE (e.g. via a
- * group) but is directly granted just VIEW — i.e. the effective access is higher
+ * grant already covers it. Set only when the grantee *inherits* a level (e.g. via
+ * a group) above the directly-granted one — i.e. the effective access is higher
  * than what the row's permission control shows.
  */
-export function effectivePermissionAbove(direct, inheritedPermissions) {
-    // A direct EDIT already outranks any inherited SHARE — never warn in that case.
-    return direct === "VIEW" && inheritedPermissions.includes("SHARE") ? "SHARE" : undefined;
+export function effectivePermissionAbove(direct, inheritedLevel) {
+    return inheritedLevel && LEVEL_RANK[inheritedLevel] > LEVEL_RANK[direct] ? inheritedLevel : undefined;
 }
 /** The permission-derived fields shared by every grantee row, regardless of kind. */
 function granteeAccess(permissions, inheritedPermissions) {
     const level = directLevel(permissions);
+    const inheritedLevel = strongestLevel(inheritedPermissions);
     return {
         level,
-        effectivePermission: effectivePermissionAbove(level, inheritedPermissions),
-        inheritsShare: inheritedPermissions.includes("SHARE"),
+        effectivePermission: effectivePermissionAbove(level, inheritedLevel),
+        inheritedLevel,
     };
 }
 export function granteesFromAccessList(list) {
@@ -105,7 +161,85 @@ export function granteesFromAccessList(list) {
     }
     return out;
 }
-/** The permission set a grant carries at each level; a higher level always implies VIEW. */
+/**
+ * Pure composition of the fetched base with the transient overlay — the hook's
+ * `grantees` derive from this with no effect and no mirrored state. Marks the
+ * caller's own row via `selfId`, backfilling its facts from `selfIdentity` (the
+ * self row is absent from the grant list by design). Input arrays are not mutated.
+ *
+ * @internal
+ */
+export function mergeGrantees(base, edits, selfId, selfIdentity) {
+    const markSelf = (g) => {
+        const isSelf = g.id === selfId;
+        return isSelf && selfIdentity
+            ? { ...g, isSelf, name: g.name ?? selfIdentity.name, email: g.email ?? selfIdentity.email }
+            : { ...g, isSelf };
+    };
+    // The row an id last COMMITTED to: an added `settled` is that row outright (the
+    // base may hold a stale pre-removal version of the same id), a level `settled`
+    // overlays the base row, otherwise the base row itself (undefined for an
+    // overlay-born id with no history).
+    const committedRow = (g, settled) => {
+        if (settled?.kind === "added") {
+            return settled.grantee;
+        }
+        if (g && settled?.kind === "level") {
+            return {
+                ...g,
+                level: settled.level,
+                effectivePermission: effectivePermissionAbove(settled.level, g.inheritedLevel),
+            };
+        }
+        return g;
+    };
+    // One renderer per id: for each id, exactly one of the branches below emits at
+    // most one row — every base id resolves here, and the loop after handles only
+    // ids born in the overlay. Growing this case-by-case instead bred duplicate-row
+    // bugs whenever an edit history (re-add, re-remove) crossed the base boundary.
+    const renderEntry = (g, edit) => {
+        if (!edit) {
+            return g;
+        }
+        if (edit.kind === "removed") {
+            // Visible (muted, at its last committed state) only while the revoke is
+            // in flight; a settled removal renders nothing — its entry persists to
+            // keep the base row hidden.
+            const committed = edit.pending ? committedRow(g, edit.settled) : undefined;
+            return committed ? { ...committed, pending: "removing" } : undefined;
+        }
+        if (edit.kind === "level") {
+            return g
+                ? {
+                    ...g,
+                    level: edit.level,
+                    effectivePermission: effectivePermissionAbove(edit.level, g.inheritedLevel),
+                    pending: edit.pending ? "saving" : undefined,
+                }
+                : undefined;
+        }
+        return { ...edit.grantee, pending: edit.pending ? "saving" : undefined };
+    };
+    const out = [];
+    const baseIds = new Set(base.map((g) => g.id));
+    for (const g of base) {
+        const row = renderEntry(g, edits[g.id]);
+        if (row) {
+            out.push(markSelf(row));
+        }
+    }
+    for (const [id, edit] of Object.entries(edits)) {
+        if (baseIds.has(id)) {
+            continue;
+        }
+        const row = renderEntry(undefined, edit);
+        if (row) {
+            out.push(markSelf(row));
+        }
+    }
+    return out;
+}
+/** Permission set per level; a higher level always implies VIEW. */
 const PERMISSIONS_BY_LEVEL = {
     none: [],
     VIEW: ["VIEW"],

package/esm/share/objectShareController.types.d.ts

@@ -1,12 +1,10 @@
 import type { AccessGranularPermission, ObjRef } from "@gooddata/sdk-model";
+import type { GoodDataSdkError } from "@gooddata/sdk-ui";
 import type { GeneralAccessValue, IUiGranteeAsyncOptions, IUiPickedGrantee } from "@gooddata/sdk-ui-kit";
 import type { IObjectAccessSummary, IObjectShareLabel } from "./types.js";
 /**
  * Permission level surfaced in the share dialog — the model's granular access
- * permission (VIEW / EDIT / SHARE). `EDIT` is display-only: the dialog reflects
- * an EDIT grant as a read-only "Can edit" row but cannot assign or change it
- * (granting EDIT is not part of the share UI), so only VIEW and SHARE are
- * selectable in the permission menu.
+ * permission (VIEW / SHARE / EDIT), assignable from the permission menu.
  *
  * @internal
  */
@@ -57,11 +55,11 @@ export interface IObjectShareGrantee extends IGranteeIdentityFacts {
      */
     effectivePermission?: ObjectSharePermissionLevel;
     /**
-     * Whether the grantee inherits SHARE (e.g. via a group), regardless of the
-     * current direct `level`. Retained from the fetch so `effectivePermission` can
-     * be recomputed locally when the direct level changes (no refetch).
+     * Strongest permission the grantee inherits (e.g. via a group), regardless of
+     * the current direct `level`. Retained from the fetch so `effectivePermission`
+     * can be recomputed locally when the direct level changes (no refetch).
      */
-    inheritsShare?: boolean;
+    inheritedLevel?: ObjectSharePermissionLevel;
     /**
      * Row-level in-flight state for optimistic updates: `"saving"` while a level
      * change or freshly-added grant is being committed, `"removing"` while a
@@ -75,63 +73,68 @@ export interface IObjectShareGrantee extends IGranteeIdentityFacts {
 export interface IObjectShareControllerState {
     subview: "main" | "addGrantee";
     status: "idle" | "loading" | "success" | "error" | "saving";
-    error?: Error;
+    error?: GoodDataSdkError;
+    summary: IObjectAccessSummary | undefined;
+    grantees: IObjectShareGrantee[];
     /**
-     * Whether object-level permissions are unavailable to the current user — the
-     * manage-gated access-list endpoint returned 404, the backend's signal that
-     * the caller cannot manage this object's sharing. Distinct from a transient
-     * load error (5xx / network), which may still resolve: consumers use this to
-     * hide the share UI entirely rather than to retry.
+     * Id of the grantee row whose permission menu manages the signed-in user's
+     * OWN access — set only when the sole explicit grant is the caller's own
+     * (the "restrict own access" design). Consumers gate lowering behind a
+     * confirm and disable the levels above the row's own.
      */
-    accessUnavailable: boolean;
-    summary: IObjectAccessSummary | undefined;
+    selfManagedGranteeId: string | undefined;
     /**
-     * Stable serialized key of the current target's ref, or undefined when none.
-     * Consumers key target-scoped transient UI (e.g. a staged confirmation) on it,
-     * so nothing staged for one object can be applied to another.
+     * Levels the self-managed row's permission menu must disable — those above the
+     * caller's own current level (you can't raise yourself). Set exactly when
+     * `selfManagedGranteeId` is; every other row is unconstrained here (the backend
+     * is the authority on what may be granted).
      */
-    targetKey: string | undefined;
+    selfManagedDisabledLevels: ObjectSharePermissionLevel[] | undefined;
     /**
-     * Signed-in user's identity, once the profile resolves. Feeds their
-     * synthesized row when they can manage the object without holding any
-     * grant (administrator access) and the grantee list is empty.
+     * Levels the workspace-rule permission menu must disable — those below an
+     * inherited workspace grant, which can't be lowered from this workspace.
+     * Undefined when no level is inherited.
      */
-    selfIdentity: ISelfIdentity | undefined;
+    workspaceDisabledLevels: ObjectSharePermissionLevel[] | undefined;
     /**
-     * Whether the profile request resolved successfully. Until then — or after a
-     * silently-swallowed failure — `isSelf` on the rows is only its unresolved
-     * default, so a sole grantee row cannot be told apart from the caller's own
-     * grant and must not be offered destructive controls.
+     * Whether grantee-row controls must stay disabled because a sole USER row
+     * cannot be told apart from the caller's own grant yet (profile pending or
+     * silently failed) — mutating it then would bypass the self-restriction
+     * confirm. Group rows and multi-row lists never set this.
      */
-    selfIdentityResolved: boolean;
+    granteeControlsLocked: boolean;
     /**
-     * Whether the manage-gated access list was LOADED with zero explicit grants —
-     * the caller reached it without holding a grant of their own. A load-time
-     * fact (never recomputed from the live list): removing your own sole grant
-     * empties the list but does not make this true.
+     * Display pair for the synthesized administrator self row, or undefined when
+     * no such row applies. Set while the DISPLAYED list is empty for a caller whose
+     * list loaded without a grant of their own and no workspace-wide share-capable
+     * rule explains the access — they can only have passed the backend's gate
+     * through administrator/manager rights. Adding a grantee hides the row;
+     * removing the last one brings it back. (Derived from the immutable seed:
+     * removing your own grant empties the list but never synthesizes this row.)
      */
-    seededWithoutGrants: boolean;
-    grantees: IObjectShareGrantee[];
+    adminSelfRow: {
+        name: string;
+        email?: string;
+    } | undefined;
     generalAccess: GeneralAccessValue;
     /**
      * Permission level of the all-workspace-members rule when general access is
      * WORKSPACE. Drives the workspace row's permission dropdown. Meaningless (and
-     * not shown) while general access is RESTRICTED. Capped at VIEW/SHARE — EDIT is
-     * never offered for the workspace rule.
+     * not shown) while general access is RESTRICTED.
      */
-    workspaceLevel: "VIEW" | "SHARE";
+    workspaceLevel: ObjectSharePermissionLevel;
     /**
-     * Whether workspace-wide access is (at least partly) inherited from a parent
-     * workspace. Inherited rule access grants every user of this workspace access
-     * too, yet cannot be revoked from here — consumers disable the Restricted
-     * option and explain why. `generalAccess` and `workspaceLevel` are effective
-     * values that already account for it.
+     * Strongest workspace-wide level inherited from parent workspaces, or
+     * undefined when none. Inherited access grants every user of this workspace
+     * access too, yet cannot be revoked or lowered from here — consumers disable
+     * the Restricted option and the workspace-rule levels below this.
+     * `generalAccess` and `workspaceLevel` already account for it.
      */
-    workspaceAccessInherited: boolean;
+    workspaceInheritedLevel: ObjectSharePermissionLevel | undefined;
     /**
      * Whether the workspace-rule level dropdown must be read-only: this workspace
      * holds no rule of its own to re-grade (access is inherited-only), or an
-     * inherited SHARE pins the effective level regardless of the direct grant.
+     * inherited EDIT pins the effective level regardless of the direct grant.
      */
     workspaceLevelLocked: boolean;
     /**
@@ -152,6 +155,14 @@ export interface IObjectShareControllerState {
      * keep the Add action disabled.
      */
     labelsResolved: boolean;
+    /**
+     * True until the session's FIRST label-scope resolution settles. Unlike
+     * {@link labelsResolved} it never turns back on (a mid-session re-probe only
+     * re-disables controls), and a resolution that settles with failures counts
+     * too — so loading placeholders keyed on it can't stick forever or flash
+     * back mid-session.
+     */
+    labelsInitializing: boolean;
     /**
      * Per-grantee label scope: grantee id → the label ids that grantee can access.
      * The primary label is always included. Empty entry means "all labels" has not
@@ -167,8 +178,6 @@ export interface IObjectShareControllerState {
  * @internal
  */
 export interface IObjectShareControllerActions {
-    /** Reset transient dialog state (subview + pending buffers). Call on dialog close. */
-    reset: () => void;
     openAddGrantee: () => void;
     closeAddGrantee: () => void;
     setPendingGrantees: (next: IUiPickedGrantee[]) => void;
@@ -195,12 +204,12 @@ export interface IObjectShareControllerActions {
     /** Commit the pending general access change. Auto-saves. */
     confirmGeneralAccessChange: () => Promise<void>;
     /**
-     * Change the all-workspace-members rule's permission level (VIEW/SHARE).
-     * Only meaningful while general access is WORKSPACE. Auto-saves, no confirm —
-     * unlike the high-impact RESTRICTED↔WORKSPACE toggle, this only re-grades an
+     * Change the all-workspace-members rule's permission level. Only meaningful
+     * while general access is WORKSPACE. Auto-saves, no confirm — unlike the
+     * high-impact RESTRICTED↔WORKSPACE toggle, this only re-grades an
      * already-granted rule.
      */
-    changeWorkspaceLevel: (level: "VIEW" | "SHARE") => Promise<void>;
+    changeWorkspaceLevel: (level: ObjectSharePermissionLevel) => Promise<void>;
 }
 /**
  * @internal
@@ -210,17 +219,11 @@ export interface IObjectShareController {
     actions: IObjectShareControllerActions;
 }
 /**
- * Options for {@link useObjectShare}.
+ * Options for {@link useObjectShareController}.
  *
  * @internal
  */
 export interface IUseObjectShareOptions {
-    /**
-     * Fires after each successful access mutation (add grantee, change level,
-     * remove, general access toggle). Use it to keep UI outside the dialog in
-     * sync with edits made inside it (e.g. refresh an inline access row).
-     */
-    onSaved?: () => void;
     /**
      * Labels (display forms) of the shared attribute, enabling the per-grantee
      * label-scope picker. Omit for objects without labels (e.g. facts).
@@ -235,13 +238,9 @@ export interface IUseObjectShareOptions {
      */
     labelsError?: boolean;
     /**
-     * Whether the object's labels are still loading. While true the controller stays
-     * label-unresolved (same gating as `labelsError`): the labels aren't passed yet,
-     * so an empty list must not be mistaken for a label-free object — otherwise row
-     * controls would reconcile against an empty set and orphan real per-label grants.
+     * Whether the object's labels are still loading. Same gating as `labelsError`:
+     * the labels aren't passed yet, so an empty list must not read as label-free.
      */
     labelsLoading?: boolean;
-    /** Whether the share dialog is open; a summary-only consumer leaves it false. */
-    isOpen?: boolean;
 }
 //# sourceMappingURL=objectShareController.types.d.ts.map

package/esm/share/objectShareController.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"objectShareController.types.d.ts","sourceRoot":"","sources":["../../src/share/objectShareController.types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEzG,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAElE;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IAClC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,qBAAqB;IACxD,EAAE,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAC9D,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,0BAA0B,CAAC;IAClC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IACxC,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5D,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;;OAMG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAE1C;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,aAAa,GAAG,SAAS,CAAC;IACxC;;;;;OAKG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,aAAa,EAAE,kBAAkB,CAAC;IAClC;;;;;OAKG;IACH,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;;;OAMG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAE9B;;;OAGG;IACH,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpD,mEAAiE;IACjE,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C,qEAAqE;IACrE,eAAe,EAAE,gBAAgB,EAAE,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC1C,sFAAsF;IACtF,KAAK,EAAE,MAAM,IAAI,CAAC;IAElB,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,kBAAkB,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACvD;;;;OAIG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,kDAAkD;IAClD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC,oEAAoE;IACpE,qBAAqB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,oCAAoC;IACpC,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;OAGG;IACH,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF,+DAA+D;IAC/D,0BAA0B,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/D,yBAAyB,EAAE,MAAM,IAAI,CAAC;IACtC,4DAA4D;IAC5D,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,2BAA2B,CAAC;IACnC,OAAO,EAAE,6BAA6B,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAC;CACpB"}
+{"version":3,"file":"objectShareController.types.d.ts","sourceRoot":"","sources":["../../src/share/objectShareController.types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEzG,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAElE;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IAClC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,qBAAqB;IACxD,EAAE,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAC9D,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,0BAA0B,CAAC;IAClC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;OAIG;IACH,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAC5C;;;;OAIG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IACxC,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5D,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC1C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC;;;;;OAKG;IACH,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC;;;;;OAKG;IACH,yBAAyB,EAAE,0BAA0B,EAAE,GAAG,SAAS,CAAC;IACpE;;;;OAIG;IACH,uBAAuB,EAAE,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAClE;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC3D,aAAa,EAAE,kBAAkB,CAAC;IAClC;;;;OAIG;IACH,cAAc,EAAE,0BAA0B,CAAC;IAC3C;;;;;;OAMG;IACH,uBAAuB,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAChE;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAE9B;;;OAGG;IACH,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpD,mEAAiE;IACjE,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C,qEAAqE;IACrE,eAAe,EAAE,gBAAgB,EAAE,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC1C,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,kBAAkB,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACvD;;;;OAIG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,kDAAkD;IAClD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC,oEAAoE;IACpE,qBAAqB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,oCAAoC;IACpC,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;OAGG;IACH,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF,+DAA+D;IAC/D,0BAA0B,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/D,yBAAyB,EAAE,MAAM,IAAI,CAAC;IACtC,4DAA4D;IAC5D,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,KAAK,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,2BAA2B,CAAC;IACnC,OAAO,EAAE,6BAA6B,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACnC;;;OAGG;IACH,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B"}

package/esm/share/types.d.ts

@@ -1,4 +1,4 @@
-import type { ObjRef } from "@gooddata/sdk-model";
+import type { AccessGranularPermission, ObjRef } from "@gooddata/sdk-model";
 import type { GeneralAccessValue } from "@gooddata/sdk-ui-kit";
 /**
  * A label (attribute display form) of the shared attribute. The share dialog
@@ -31,9 +31,8 @@ export interface IObjectShareLabel {
  *
  * - `generalAccess` — `RESTRICTED` if only named grantees can access the object;
  *   `WORKSPACE` if the workspace-wide rule grant is present with non-empty permissions.
- * - `workspaceLevel` — the rule grant's permission level; `VIEW` by default,
- *   `SHARE` when the rule explicitly permits `SHARE`. EDIT is intentionally not
- *   surfaced (the UI caps at VIEW/SHARE).
+ * - `workspaceLevel` — the rule grant's permission level: the strongest level the
+ *   rule permits, `VIEW` by default.
  * - `granteeCount` — number of named grantees (users + groups). Excludes the
  *   workspace-wide rule grant itself.
  *
@@ -41,7 +40,7 @@ export interface IObjectShareLabel {
  */
 export interface IObjectAccessSummary {
     generalAccess: GeneralAccessValue;
-    workspaceLevel: "VIEW" | "SHARE";
+    workspaceLevel: AccessGranularPermission;
     granteeCount: number;
 }
 //# sourceMappingURL=types.d.ts.map

package/esm/share/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/share/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAC9B,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oBAAoB;IACjC,aAAa,EAAE,kBAAkB,CAAC;IAClC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/share/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAC9B,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,oBAAoB;IACjC,aAAa,EAAE,kBAAkB,CAAC;IAClC,cAAc,EAAE,wBAAwB,CAAC;IACzC,YAAY,EAAE,MAAM,CAAC;CACxB"}

package/esm/share/useAccessList.d.ts

@@ -1,7 +1,9 @@
 import type { IObjectPermissionsObject } from "@gooddata/sdk-backend-spi";
-import { type IGranularAccessGrantee, type ObjRef } from "@gooddata/sdk-model";
+import { type IGranularAccessGrantee } from "@gooddata/sdk-model";
+import { type GoodDataSdkError } from "@gooddata/sdk-ui";
 import { type GeneralAccessValue, type IUiGranteeAsyncOptions } from "@gooddata/sdk-ui-kit";
-import type { IObjectShareControllerState, IObjectShareGrantee, ISelfIdentity } from "./objectShareController.types.js";
+import { type IRuleEdit } from "./objectShareController.helpers.js";
+import type { IObjectShareControllerState, IObjectShareGrantee, ISelfIdentity, ObjectSharePermissionLevel } from "./objectShareController.types.js";
 import type { IObjectAccessSummary } from "./types.js";
 /**
  * The owned access list for {@link useObjectShareController}.
@@ -9,93 +11,92 @@ import type { IObjectAccessSummary } from "./types.js";
  * @internal
  */
 export interface IAccessList {
-    /** Stable serialized key of the current target's ref, or undefined when none. */
-    targetKey: string | undefined;
-    /** True once the current target's list has been fetched and seeded into local state. */
+    /** True once the target's list has been fetched. */
     hasList: boolean;
-    /** Local grantee rows — seeded from the fetch, then authoritative; mutations write through. */
+    /** Display rows: the fetched list composed with the local edit overlay. */
     grantees: IObjectShareGrantee[];
     /**
-     * Whether the manage-gated fetch seeded ZERO explicit grants for the current
-     * target — i.e. the caller reached the access list without holding a grant of
-     * their own (grant-independent access). A load-time fact: locally emptying the
-     * list later (e.g. removing your own sole grant) must not retroactively claim
-     * grant-independent access, so this is never recomputed from the live list.
+     * Whether the fetched list held no grant for the SIGNED-IN user — they reached
+     * this manage-gated list without a grant of their own (grant-independent access:
+     * admin/manager rights, or a workspace rule reported separately). Derived from
+     * the immutable seed, never the live overlay: a caller whose own grant was the
+     * way in must not read as grant-independent after locally removing it.
      */
-    seededWithoutGrants: boolean;
+    seededWithoutSelfGrant: boolean;
     /** Signed-in user's identity facts + login id, once the profile resolves. */
     selfIdentity: ISelfIdentity | undefined;
     /**
-     * Whether the profile request resolved successfully — until then (or after a
-     * failure) rows' `isSelf` is only its unresolved default, so a sole grantee
-     * row cannot be told apart from the caller's own grant.
+     * Whether the profile resolved. Until then a sole grantee row can't be told apart
+     * from the caller's own grant, so its `isSelf` is only an unresolved default.
      */
     selfIdentityResolved: boolean;
-    /**
-     * Workspace vs restricted general access granted by THIS workspace's own rule —
-     * local state; mutations write through. Excludes inherited (parent-workspace)
-     * rule access, which is exposed separately as `inheritedWorkspaceLevel`.
-     */
+    /** Direct general access (excludes inherited rule access). */
     generalAccess: GeneralAccessValue;
-    /** Workspace-rule permission level (VIEW/SHARE) — local state; mutations write through. */
-    workspaceLevel: "VIEW" | "SHARE";
+    /** Workspace-rule permission level — the rule overlay if edited, else fetched. */
+    workspaceLevel: ObjectSharePermissionLevel;
     /**
-     * Strongest workspace-wide level inherited from parent workspaces, or undefined
-     * when none. Seeded from the fetch and never mutated: inherited access cannot
-     * be changed from this workspace, so no write-through applies. Effective
-     * (displayed) general access is WORKSPACE whenever this is set, regardless of
-     * the direct `generalAccess` state.
+     * Strongest workspace level inherited from parent workspaces. Cannot be changed
+     * from here, so effective general access is WORKSPACE whenever it's set.
      */
-    inheritedWorkspaceLevel: "VIEW" | "SHARE" | undefined;
-    /** Inline access summary, or undefined before the first load. */
+    workspaceInheritedLevel: ObjectSharePermissionLevel | undefined;
+    /** True while a workspace-rule re-grade is committing (the rule overlay is pending). */
+    workspaceLevelSaving: boolean;
+    /** Access summary of the displayed state, or undefined before the first load. */
     summary: IObjectAccessSummary | undefined;
-    /** Top-level load status surfaced as the controller status. */
+    /** Load status surfaced as the controller status. */
     status: IObjectShareControllerState["status"];
-    /** Error from the initial/target-change load. */
-    loadError: Error | undefined;
-    /**
-     * Whether the current target's load was denied because the caller can't manage
-     * its permissions (manage-gated endpoint returns 404). Derived from the live
-     * fetch, not the persisted `loadError`, so it can't lag a target switch and
-     * flag a new target with the previous one's 404.
-     */
-    accessUnavailable: boolean;
+    /** Typed SDK error from the load, or undefined. */
+    loadError: GoodDataSdkError | undefined;
     /** Write a grant change to the backend and toast. False on failure; no refetch. */
     commit: (mutate: IGranularAccessGrantee[], successMessage: {
         id: string;
     }) => Promise<boolean>;
+    /** Picker loader — available assignees filtered by query, excluding already-granted ones. */
+    loadOptions: (search: string) => Promise<IUiGranteeAsyncOptions>;
     /**
-     * Picker loader — available assignees filtered by query, excluding
-     * already-granted grantees (add-grantee picker).
+     * Overlay a freshly picked grantee as a pending added row. Applied synchronously,
+     * before the write. Re-adding a removed base row supersedes the committed removal
+     * (carried as `settled`, restored if the add fails).
      */
-    loadOptions: (search: string) => Promise<IUiGranteeAsyncOptions>;
-    /** Resolve a grantee id back to the picker's original ObjRef (preserves Uri vs Id ref). */
-    refForId: (id: string) => ObjRef;
-    /** Write through a local grantee-row change (insert / level / remove); rolled back by the caller. */
-    setGrantees: React.Dispatch<React.SetStateAction<IObjectShareGrantee[]>>;
-    /** Write through a local general-access change; rolled back by the caller. */
-    setGeneralAccess: React.Dispatch<React.SetStateAction<GeneralAccessValue>>;
+    applyGranteeAdd: (grantee: IObjectShareGrantee) => void;
+    /**
+     * Overlay a pending level change. A row born in the overlay (added since the
+     * fetch) stays an `added` entry with the new level — base doesn't hold it, so a
+     * plain level entry would drop the row from the merged view.
+     */
+    applyGranteeLevel: (id: string, level: ObjectSharePermissionLevel) => void;
+    /** Overlay a pending removal; the row renders muted until the write settles. */
+    applyGranteeRemove: (id: string) => void;
+    /** Commit the pending edit for `id` after a successful write. */
+    settleGranteeEdit: (id: string) => void;
     /**
-     * Write through the local workspace-rule permission level. A general-access write
-     * always grants workspace VIEW, so the caller sets this to keep the summary from
-     * showing a stale SHARE inherited from the initial fetch.
+     * Revert the pending edit for `id` after a failed write: restore the committed
+     * entry it superseded, or drop the entry (back to the fetched row) if none.
      */
-    setWorkspaceLevel: React.Dispatch<React.SetStateAction<"VIEW" | "SHARE">>;
+    failGranteeEdit: (id: string) => void;
+    /** Overlay the all-workspace-users rule edit (pending while a re-grade commits). */
+    applyRuleEdit: (edit: Omit<IRuleEdit, "settled">) => void;
+    /** Commit the pending rule edit after a successful write. */
+    settleRuleEdit: () => void;
+    /** Revert the rule edit after a failed write: the superseded committed edit, or the fetch. */
+    failRuleEdit: () => void;
 }
 /**
- * Owns the backend access list. It is fetched once (per target) then seeded into
- * local state, which is authoritative while the dialog/summary is mounted:
- * mutations write through to it directly and roll back the one changed entry on
- * failure. There is no post-write refetch, so the grantee list never blanks and
- * never fights the backend's read-after-write lag. A target switch re-seeds from
- * the new fetch; the seed is gated on a per-target stamp so a late fetch for a
- * previous target can't clobber the current one.
+ * Owns the backend access list for ONE dialog session: the hook is mounted while
+ * the dialog is open, for a single target that must not change while mounted
+ * (remount for a new target — see {@link ObjectShareDialog}). Unmounting discards
+ * every transient: the edit overlay, the profile, in-flight finalizers.
  *
- * Effective (inherited) permissions and display names come from that single
- * fetch: inherited access doesn't change as a result of editing a direct grant,
- * so the badge stays correct for the session without re-reading.
+ * The flow is one-directional: the list is fetched once, and the displayed state
+ * is *derived* from that fetch composed with a small local edit overlay
+ * ({@link mergeGrantees}). There is no mirrored state and no post-write refetch —
+ * a mutation writes its overlay entry (so the row updates immediately), commits to
+ * the backend, then settles the entry on success or reverts it on failure — to the
+ * committed entry it superseded (kept as `settled` on the pending edit), or to the
+ * fetched row when there was none. The grantee list therefore never blanks and
+ * never fights read-after-write lag.
  *
  * @internal
  */
-export declare function useAccessList(target: IObjectPermissionsObject | undefined, onSaved: (() => void) | undefined, dialogOpen: boolean): IAccessList;
+export declare function useAccessList(target: IObjectPermissionsObject | undefined): IAccessList;
 //# sourceMappingURL=useAccessList.d.ts.map