@gooddata/sdk-ui-ext 11.51.0-alpha.0 → 11.51.0-alpha.2

package/esm/share/useAccessList.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAccessList.d.ts","sourceRoot":"","sources":["../../src/share/useAccessList.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAEH,KAAK,sBAAsB,EAE3B,KAAK,MAAM,EAId,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,sBAAsB,EAAmB,MAAM,sBAAsB,CAAC;AAkB7G,OAAO,KAAK,EAER,2BAA2B,EAC3B,mBAAmB,EACnB,aAAa,EAChB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,iFAAiF;IACjF,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,wFAAwF;IACxF,OAAO,EAAE,OAAO,CAAC;IACjB,iGAA+F;IAC/F,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,6EAA6E;IAC7E,YAAY,EAAE,aAAa,GAAG,SAAS,CAAC;IACxC;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,aAAa,EAAE,kBAAkB,CAAC;IAClC,6FAA2F;IAC3F,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;;;OAMG;IACH,uBAAuB,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IACtD,iEAAiE;IACjE,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC1C,+DAA+D;IAC/D,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9C,iDAAiD;IACjD,SAAS,EAAE,KAAK,GAAG,SAAS,CAAC;IAC7B;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B,mFAAmF;IACnF,MAAM,EAAE,CAAC,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/F;;;OAGG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,2FAA2F;IAC3F,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;IAEjC,qGAAqG;IACrG,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACzE,8EAA8E;IAC9E,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3E;;;;OAIG;IACH,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,EACjC,UAAU,EAAE,OAAO,GACpB,WAAW,CAiUb"}
+{"version":3,"file":"useAccessList.d.ts","sourceRoot":"","sources":["../../src/share/useAccessList.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EACH,KAAK,sBAAsB,EAK9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACH,KAAK,gBAAgB,EAKxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,sBAAsB,EAAmB,MAAM,sBAAsB,CAAC;AAS7G,OAAO,EAEH,KAAK,SAAS,EASjB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EACR,2BAA2B,EAC3B,mBAAmB,EACnB,aAAa,EACb,0BAA0B,EAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC;;;;;;OAMG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC,6EAA6E;IAC7E,YAAY,EAAE,aAAa,GAAG,SAAS,CAAC;IACxC;;;OAGG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B,8DAA8D;IAC9D,aAAa,EAAE,kBAAkB,CAAC;IAClC,oFAAkF;IAClF,cAAc,EAAE,0BAA0B,CAAC;IAC3C;;;OAGG;IACH,uBAAuB,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAChE,wFAAwF;IACxF,oBAAoB,EAAE,OAAO,CAAC;IAC9B,iFAAiF;IACjF,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC1C,qDAAqD;IACrD,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9C,mDAAmD;IACnD,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAExC,mFAAmF;IACnF,MAAM,EAAE,CAAC,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/F,+FAA6F;IAC7F,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEjE;;;;OAIG;IACH,eAAe,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACxD;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAC3E,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,iEAAiE;IACjE,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;OAGG;IACH,eAAe,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAEtC,oFAAoF;IACpF,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC;IAC1D,6DAA6D;IAC7D,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,8FAA8F;IAC9F,YAAY,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,WAAW,CAyRvF"}

package/esm/share/useAccessList.js

@@ -1,140 +1,60 @@
 // (C) 2026 GoodData Corporation
-import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useCallback, useMemo, useState } from "react";
 import { idRef, objRefToString, serializeObjRef, } from "@gooddata/sdk-model";
-import { useBackendStrict, useCancelablePromise, useWorkspaceStrict } from "@gooddata/sdk-ui";
+import { convertError, useBackendStrict, useCancelablePromise, useWorkspaceStrict, } from "@gooddata/sdk-ui";
 import { useToastMessage } from "@gooddata/sdk-ui-kit";
-import { isPermissionsNotAvailable } from "./accessErrors.js";
 import { composeEffectiveWorkspaceAccess, deriveGeneralAccess, deriveInheritedWorkspaceLevel, deriveWorkspacePermissionLevel, } from "./accessSummary.js";
 import { objectShareMessages } from "./messages.js";
-import { assigneeIdentityFacts, assigneeMatchesQuery, granteeId, granteesFromAccessList, userDisplayPair, userIdentityFacts, } from "./objectShareController.helpers.js";
+import { assigneeIdentityFacts, assigneeMatchesQuery, effectivePermissionAbove, granteeId, granteesFromAccessList, mergeGrantees, userDisplayPair, userIdentityFacts, } from "./objectShareController.helpers.js";
 /**
- * Owns the backend access list. It is fetched once (per target) then seeded into
- * local state, which is authoritative while the dialog/summary is mounted:
- * mutations write through to it directly and roll back the one changed entry on
- * failure. There is no post-write refetch, so the grantee list never blanks and
- * never fights the backend's read-after-write lag. A target switch re-seeds from
- * the new fetch; the seed is gated on a per-target stamp so a late fetch for a
- * previous target can't clobber the current one.
+ * Owns the backend access list for ONE dialog session: the hook is mounted while
+ * the dialog is open, for a single target that must not change while mounted
+ * (remount for a new target — see {@link ObjectShareDialog}). Unmounting discards
+ * every transient: the edit overlay, the profile, in-flight finalizers.
  *
- * Effective (inherited) permissions and display names come from that single
- * fetch: inherited access doesn't change as a result of editing a direct grant,
- * so the badge stays correct for the session without re-reading.
+ * The flow is one-directional: the list is fetched once, and the displayed state
+ * is *derived* from that fetch composed with a small local edit overlay
+ * ({@link mergeGrantees}). There is no mirrored state and no post-write refetch —
+ * a mutation writes its overlay entry (so the row updates immediately), commits to
+ * the backend, then settles the entry on success or reverts it on failure — to the
+ * committed entry it superseded (kept as `settled` on the pending edit), or to the
+ * fetched row when there was none. The grantee list therefore never blanks and
+ * never fights read-after-write lag.
  *
  * @internal
  */
-export function useAccessList(target, onSaved, dialogOpen) {
+export function useAccessList(target) {
     const backend = useBackendStrict();
     const workspace = useWorkspaceStrict();
     const toast = useToastMessage();
-    // Authoritative local state, seeded from the fetch below.
-    const [grantees, setGrantees] = useState([]);
-    // Load-time fact, deliberately NOT derived from the live list: local mutations
-    // must not change it (see the IAccessList doc).
-    const [seededWithoutGrants, setSeededWithoutGrants] = useState(false);
-    const [generalAccess, setGeneralAccess] = useState("RESTRICTED");
-    const [workspaceLevel, setWorkspaceLevel] = useState("VIEW");
-    const [inheritedWorkspaceLevel, setInheritedWorkspaceLevel] = useState(undefined);
-    // The target the local state was seeded for; undefined until the first seed.
-    // Reading state as belonging to the current target hinges on this matching
-    // `targetKey` — a target switch makes the old state stale until the re-seed.
-    const [seededTarget, setSeededTarget] = useState(undefined);
-    const [loadError, setLoadError] = useState(undefined);
-    // Assignee identities from the listing (picker + on-open resolve), keyed by
-    // grantee id: de-collapsed facts + the original ObjRef (the serialized id
-    // loses Uri-vs-Id). The signed-in user is absent from the listing; their
-    // facts derive from the profile instead.
-    const [knownAssignees, setKnownAssignees] = useState({});
-    // Memoized current-user fetch — the profile doesn't change while mounted,
-    // so resolve it at most once and share the promise across callers.
-    const currentUserCache = useRef(undefined);
-    // Kind-qualified: distinct permission targets can share an identifier (e.g. an
-    // attribute and a metric), and every target-scoped guard — the seed stamp, the
-    // async-finalizer bail-outs, the dialog's staged-confirm reset — compares this
-    // key. serializeObjRef keeps the ref's own `type` qualifier too.
-    const targetKey = target ? `${target.kind}:${serializeObjRef(target.ref)}` : undefined;
-    // Written from both the picker (loadOptions) and the on-open resolve. Must not
-    // depend on the cache it writes, or it would re-trigger loadOptions' fetch.
-    const cacheAssignees = useCallback((assignees) => {
-        setKnownAssignees((prev) => {
-            const next = { ...prev };
-            for (const assignee of assignees) {
-                next[granteeId(assignee.type === "user" ? "user" : "group", assignee.ref)] = {
-                    facts: assigneeIdentityFacts(assignee),
-                    ref: assignee.ref,
-                };
-            }
-            return next;
-        });
-    }, []);
-    // Initial (and target-change) load. Seeds local state once per target; thereafter
-    // local state is authoritative and mutations write through it.
+    // The only local state: the transient edit overlay. Everything else is derived.
+    const [granteeEdits, setGranteeEdits] = useState({});
+    const [ruleEdit, setRuleEditState] = useState(undefined);
+    // Serialized so an inline idRef(...) — a new object each render — doesn't refetch forever.
+    const fetchKey = target ? `${workspace}:${target.kind}:${serializeObjRef(target.ref)}` : undefined;
     const { result: fetchedList, status: fetchStatus, error: fetchError, } = useCancelablePromise({
         promise: target
             ? () => backend.workspace(workspace).objectPermissions().getAccessList(target)
             : undefined,
     }, 
-    // Key on the serialized ref, not the ObjRef object — an inline idRef(...) is a
-    // new instance each render and would otherwise refetch forever.
-    [backend, workspace, target?.kind, targetKey]);
-    // Local state belongs to the current target only once its list has been seeded
-    // AND no fetch is in flight for it. Requiring `fetchStatus === "success"` (not
-    // just a matching `seededTarget`) matters when the same object is reopened after
-    // navigating away: the deps change re-runs `useCancelablePromise`, which resets to
-    // `loading` while it refetches. Without this, the still-matching previous
-    // `seededTarget` would keep `hasList` true and surface the prior session's
-    // grantees as `success` (mutations enabled) until the new list lands.
-    const hasList = seededTarget === targetKey && targetKey !== undefined && fetchStatus === "success";
-    useEffect(() => {
-        if (fetchStatus === "success" && fetchedList) {
-            // The cancelable promise is keyed on targetKey, so this list is for it.
-            const seededGrantees = granteesFromAccessList(fetchedList);
-            setGrantees(seededGrantees);
-            setSeededWithoutGrants(seededGrantees.length === 0);
-            setGeneralAccess(deriveGeneralAccess(fetchedList.grants));
-            setWorkspaceLevel(deriveWorkspacePermissionLevel(fetchedList.grants));
-            setInheritedWorkspaceLevel(deriveInheritedWorkspaceLevel(fetchedList.grants));
-            setSeededTarget(targetKey);
-            setLoadError(undefined);
-        }
-        else if (fetchStatus === "error") {
-            setLoadError(fetchError instanceof Error ? fetchError : new Error(String(fetchError)));
-        }
-        else if (fetchStatus === "loading") {
-            // A (re)fetch is in flight — including when the same object is reopened
-            // after navigating away. Drop the seed stamp so the previous session's
-            // list isn't surfaced as the current one until the fresh fetch is seeded.
-            setSeededTarget(undefined);
-        }
-    }, [fetchStatus, fetchedList, fetchError, targetKey]);
-    const getCurrentUser = useCallback(() => {
-        if (!currentUserCache.current) {
-            currentUserCache.current = backend
-                .currentUser()
-                .getUser()
-                .catch((error) => {
-                // Don't cache a rejected promise, or a transient profile-read
-                // failure would stick for the rest of the session.
-                currentUserCache.current = undefined;
-                throw error;
-            });
-        }
-        return currentUserCache.current;
-    }, [backend]);
-    // Resolve the current user only while the dialog is open — keeps the summary-only
-    // path free of a profile request (the self-row facts it feeds aren't shown there).
+    // fetchKey already encodes workspace, kind and ref.
+    [backend, fetchKey]);
+    const hasList = fetchStatus === "success" && !!fetchedList;
+    const base = useMemo(() => (hasList ? granteesFromAccessList(fetchedList) : []), [hasList, fetchedList]);
+    // The profile identifies the caller's own row (self-managed classification, the
+    // admin empty-state row). The session exists only while the dialog is open, so
+    // fetch it once per session; the client caches it across sessions.
     const { result: currentUser, status: currentUserStatus } = useCancelablePromise({
-        promise: dialogOpen && targetKey ? () => getCurrentUser() : undefined,
+        promise: () => backend.currentUser().getUser(),
         onError: () => { },
-    }, 
-    // Key on target presence, not identity — the resolved user is
-    // target-independent, so a target switch must not reset it.
-    [getCurrentUser, targetKey !== undefined, dialogOpen]);
-    // Success only: while pending OR after a (silently swallowed) failure the
-    // rows' isSelf is just its unresolved default, and consumers must not treat
-    // an unidentified row as safe to mutate. Retried naturally on dialog reopen
-    // (the promise is keyed on `dialogOpen`; the failure isn't cached).
+    }, [backend]);
+    // Success only: while pending or after a swallowed failure a sole row can't be told
+    // apart from the caller's own grant, so it must not be treated as safe to mutate.
     const selfIdentityResolved = currentUserStatus === "success";
     const selfId = currentUser ? granteeId("user", idRef(currentUser.login)) : undefined;
+    // Derived from the immutable SEED (see the interface doc): a caller whose own
+    // grant was the way in must not read as grant-independent after removing it.
+    const seededWithoutSelfGrant = hasList && selfIdentityResolved && !base.some((g) => g.id === selfId);
     // De-collapsed like every listing fact — on tiger the user id is often the email.
     const selfIdentity = useMemo(() => currentUser
         ? {
@@ -142,75 +62,38 @@ export function useAccessList(target, onSaved, dialogOpen) {
             id: currentUser.login,
         }
         : undefined, [currentUser]);
-    // Rows with identity facts backfilled from the assignee cache — or, for the
-    // signed-in user's own row (absent from the listing by design), from the
-    // profile. Empty until the current target's list is seeded; a derivation, so
-    // it re-applies as the caches grow.
-    const namedGrantees = useMemo(() => {
-        if (!hasList) {
-            return [];
-        }
-        return grantees.map((g) => {
-            const known = knownAssignees[g.id]?.facts ?? (g.id === selfId ? selfIdentity : undefined);
-            const isSelf = g.id === selfId;
-            return known
-                ? { ...g, isSelf, name: g.name ?? known.name, email: g.email ?? known.email }
-                : { ...g, isSelf };
-        });
-    }, [hasList, grantees, knownAssignees, selfIdentity, selfId]);
-    // Resolve identity facts on dialog open — grants often carry only raw ids
-    // (the post-reload state). Unconditional: no missing-facts gate to keep in
-    // sync with the cache, and summary-only consumers never fetch. Keyed on the
-    // serialized targetKey so an inline-ref consumer re-rendering mid-fetch
-    // doesn't cancel it.
-    useCancelablePromise({
-        promise: target && dialogOpen
-            ? () => backend.workspace(workspace).objectPermissions().getAvailableAssignees(target)
-            : undefined,
-        onSuccess: cacheAssignees,
-        // Best-effort backfill: on error the raw id stays (pre-fix behavior, no
-        // regression) and the picker can still resolve it on demand. No toast.
-        onError: () => { },
-    }, [backend, workspace, targetKey, dialogOpen]);
-    // Stable sorted key of the currently-granted ids — drives the picker's
-    // "exclude already-granted" filter. Keyed on ids only (not names), so the
-    // picker's own name-cache writes can't change loadOptions' identity and
-    // re-trigger its fetch.
-    const excludedIdsKey = useMemo(() => grantees
-        .filter((g) => g.pending !== "removing")
-        .map((g) => g.id)
-        .sort()
-        .join(","), [grantees]);
+    const grantees = useMemo(() => mergeGrantees(base, granteeEdits, selfId, selfIdentity), [base, granteeEdits, selfId, selfIdentity]);
+    const generalAccess = ruleEdit?.generalAccess ?? deriveGeneralAccess(fetchedList?.grants ?? []);
+    const workspaceLevel = ruleEdit?.level ?? deriveWorkspacePermissionLevel(fetchedList?.grants ?? []);
+    const workspaceLevelSaving = ruleEdit?.pending ?? false;
+    const workspaceInheritedLevel = useMemo(() => deriveInheritedWorkspaceLevel(fetchedList?.grants ?? []), [fetchedList]);
+    // Keyed on plain values so the summary's identity changes exactly when its
+    // content does — consumers (the dialog's onSummaryChange) rely on that.
+    const granteeCount = grantees.filter((g) => g.pending !== "removing").length;
     const summary = useMemo(() => {
         if (!hasList) {
             return undefined;
         }
-        // The summary shows effective access: an inherited rule counts as
-        // workspace access even when this workspace holds no rule of its own.
+        // Effective access: an inherited rule counts as WORKSPACE even without a local rule.
         return {
-            ...composeEffectiveWorkspaceAccess(generalAccess, workspaceLevel, inheritedWorkspaceLevel),
-            granteeCount: namedGrantees.filter((g) => g.pending !== "removing").length,
+            ...composeEffectiveWorkspaceAccess(generalAccess, workspaceLevel, workspaceInheritedLevel),
+            granteeCount,
         };
-    }, [hasList, generalAccess, workspaceLevel, inheritedWorkspaceLevel, namedGrantees]);
-    // "success" only once the *current* target's list has been seeded. After a
-    // target switch the previous seed is stale (seededTarget !== targetKey), so
-    // gating on hasList keeps the status at "loading" until the new list lands —
-    // never "success" with no list, which would let the dialog enable mutations
-    // and the catalog row hide both summary and skeleton.
-    const status = target
-        ? fetchStatus === "error"
-            ? "error"
-            : hasList
-                ? "success"
-                : "loading"
-        : "idle";
-    // Derived from the live fetch (status + error travel together), not the
-    // persisted loadError — so a target switch can't briefly flag the new target
-    // with the previous target's 404 before the load effect updates loadError.
-    const accessUnavailable = fetchStatus === "error" && isPermissionsNotAvailable(fetchError);
-    // Write a single grant change to the backend, then toast. The caller applies
-    // the optimistic local write-through and rolls it back on failure; there is no
-    // refetch — local state stays authoritative.
+    }, [hasList, generalAccess, workspaceLevel, workspaceInheritedLevel, granteeCount]);
+    // "success" waits for `hasList` so consumers never see success with nothing to show.
+    const deriveStatus = () => {
+        if (!target) {
+            return "idle";
+        }
+        if (fetchStatus === "error") {
+            return "error";
+        }
+        return hasList ? "success" : "loading";
+    };
+    const status = deriveStatus();
+    // Typed SDK error, the house pattern (see InsightView) — not a hand-rolled Error.
+    const loadError = useMemo(() => (fetchStatus === "error" ? convertError(fetchError) : undefined), [fetchStatus, fetchError]);
+    // The caller owns the optimistic overlay write and its rollback; there is no refetch.
     const commit = useCallback(async (mutate, successMessage) => {
         if (!target) {
             return false;
@@ -221,18 +104,20 @@ export function useAccessList(target, onSaved, dialogOpen) {
                 .objectPermissions()
                 .manageObjectPermissions(target, mutate);
             toast.addSuccess(successMessage);
-            onSaved?.();
             return true;
         }
         catch {
             toast.addError(objectShareMessages.toastError);
             return false;
         }
-    }, [backend, workspace, target, toast, onSaved]);
-    // Picker loader — fetches available assignees on demand, filters by the typed
-    // query, and excludes anything already granted. Depends only on the
-    // granted set (grantees), so its identity changes only when that set actually
-    // changes. It must NOT write state that feeds its own deps.
+    }, [backend, workspace, target, toast]);
+    // Ids the picker excludes as already-granted — INCLUDING rows whose removal is
+    // still in flight: offering those would let a re-add overlap the pending revoke
+    // on one id, and the settle/fail finalizers act on the id's current overlay
+    // entry, not the write that started them. A settled removal drops out of the
+    // merged view, so the id becomes offerable exactly when the revoke has landed.
+    const excludedIds = useMemo(() => new Set(grantees.map((g) => g.id)), [grantees]);
+    // Each option carries its backend `ref` so the add flow grants against the exact ref.
     const loadOptions = useCallback(async (search) => {
         if (!target) {
             return { groups: [], users: [] };
@@ -242,54 +127,122 @@ export function useAccessList(target, onSaved, dialogOpen) {
             .objectPermissions()
             .getAvailableAssignees(target);
         const query = search.trim().toLowerCase();
-        const withIds = assignees.map((a) => ({
-            assignee: a,
-            id: granteeId(a.type === "user" ? "user" : "group", a.ref),
+        const users = [];
+        const groups = [];
+        for (const assignee of assignees) {
+            const kind = assignee.type === "user" ? "user" : "group";
+            const id = granteeId(kind, assignee.ref);
+            if (excludedIds.has(id) || !assigneeMatchesQuery(assignee, query)) {
+                continue;
+            }
+            if (assignee.type === "user") {
+                users.push({
+                    id,
+                    ref: assignee.ref,
+                    kind: "user",
+                    // Same name → email → id fallback the grantee rows use.
+                    ...userDisplayPair(assigneeIdentityFacts(assignee), objRefToString(assignee.ref)),
+                });
+            }
+            else {
+                groups.push({ id, ref: assignee.ref, kind: "group", name: assignee.name });
+            }
+        }
+        return { users, groups };
+    }, [backend, workspace, target, excludedIds]);
+    const applyGranteeAdd = useCallback((grantee) => {
+        setGranteeEdits((prev) => {
+            const current = prev[grantee.id];
+            // Re-adding a removed base row supersedes the committed removal — carry
+            // it, so a failed add restores the removal instead of dropping the entry
+            // and resurrecting the base row at its pre-removal level.
+            const settled = current ? { ...current, settled: undefined } : undefined;
+            return { ...prev, [grantee.id]: { kind: "added", grantee, pending: true, settled } };
+        });
+    }, []);
+    const applyGranteeLevel = useCallback((id, level) => {
+        setGranteeEdits((prev) => {
+            const current = prev[id];
+            // Keep one level of history: the committed entry this edit supersedes.
+            const settled = current ? { ...current, settled: undefined } : undefined;
+            if (current?.kind === "added") {
+                // Overlay-born row: stay an `added` entry, or the merge would drop it.
+                const grantee = {
+                    ...current.grantee,
+                    level,
+                    effectivePermission: effectivePermissionAbove(level, current.grantee.inheritedLevel),
+                };
+                return { ...prev, [id]: { kind: "added", grantee, pending: true, settled } };
+            }
+            return { ...prev, [id]: { kind: "level", level, pending: true, settled } };
+        });
+    }, []);
+    const applyGranteeRemove = useCallback((id) => {
+        setGranteeEdits((prev) => {
+            const current = prev[id];
+            const settled = current ? { ...current, settled: undefined } : undefined;
+            return { ...prev, [id]: { kind: "removed", pending: true, settled } };
+        });
+    }, []);
+    const settleGranteeEdit = useCallback((id) => {
+        setGranteeEdits((prev) => {
+            const current = prev[id];
+            if (!current) {
+                return prev;
+            }
+            // A settled removal always keeps its entry: for a base row (including a
+            // removed re-added one) it is what keeps the row hidden; for an
+            // overlay-born row it renders nothing and is harmless.
+            return { ...prev, [id]: { ...current, pending: false, settled: undefined } };
+        });
+    }, []);
+    const failGranteeEdit = useCallback((id) => {
+        setGranteeEdits((prev) => {
+            const current = prev[id];
+            if (!current) {
+                return prev;
+            }
+            if (current.settled) {
+                return { ...prev, [id]: current.settled };
+            }
+            const { [id]: _omit, ...rest } = prev;
+            return rest;
+        });
+    }, []);
+    const applyRuleEdit = useCallback((edit) => {
+        setRuleEditState((current) => ({
+            ...edit,
+            settled: current ? { ...current, settled: undefined } : undefined,
         }));
-        // Remember every assignee's real name + ref so granted rows can show them
-        // even when the access-list grant later returns only a raw id. Safe here:
-        // the caches aren't dependencies of loadOptions, so this won't re-trigger it.
-        cacheAssignees(assignees);
-        const excluded = new Set(excludedIdsKey ? excludedIdsKey.split(",") : []);
-        const selectable = withIds
-            .filter(({ id }) => !excluded.has(id)) // hide anyone already granted
-            .filter(({ assignee }) => assigneeMatchesQuery(assignee, query));
-        return {
-            users: selectable
-                .filter(({ assignee }) => assignee.type === "user")
-                .map(({ assignee, id }) => ({
-                id,
-                kind: "user",
-                // Same fallback pairs as the grantee rows.
-                ...userDisplayPair(assigneeIdentityFacts(assignee), objRefToString(assignee.ref)),
-            })),
-            groups: selectable
-                .filter(({ assignee }) => assignee.type !== "user")
-                .map(({ assignee, id }) => ({ id, kind: "group", name: assignee.name })),
-        };
-    }, [backend, workspace, target, excludedIdsKey, cacheAssignees]);
-    // Reuse the picker's original ref (preserves UriRef vs IdentifierRef);
-    // fall back to the serialized id only if it wasn't cached.
-    const refForId = useCallback((id) => knownAssignees[id]?.ref ?? { identifier: id.split(":", 2)[1] }, [knownAssignees]);
+    }, []);
+    const settleRuleEdit = useCallback(() => {
+        setRuleEditState((current) => current ? { ...current, pending: false, settled: undefined } : current);
+    }, []);
+    const failRuleEdit = useCallback(() => {
+        setRuleEditState((current) => current?.settled);
+    }, []);
     return {
-        targetKey,
         hasList,
-        grantees: namedGrantees,
-        seededWithoutGrants,
+        grantees,
+        seededWithoutSelfGrant,
         selfIdentity,
         selfIdentityResolved,
         generalAccess,
         workspaceLevel,
-        inheritedWorkspaceLevel,
+        workspaceInheritedLevel,
+        workspaceLevelSaving,
         summary,
         status,
         loadError,
-        accessUnavailable,
         commit,
         loadOptions,
-        refForId,
-        setGrantees,
-        setGeneralAccess,
-        setWorkspaceLevel,
+        applyGranteeAdd,
+        applyGranteeLevel,
+        applyGranteeRemove,
+        settleGranteeEdit,
+        failGranteeEdit,
+        applyRuleEdit,
+        settleRuleEdit,
+        failRuleEdit,
     };
 }

package/esm/share/useLabelScope.d.ts

@@ -25,22 +25,27 @@ export interface ILabelScope {
      * on the "assume all labels" placeholder.
      */
     labelsResolved: boolean;
+    /**
+     * True until the session's FIRST scope resolution settles (labels metadata +
+     * the initial per-label probe). Unlike {@link labelsResolved} it never turns
+     * back on: a later re-probe (a grantee or label-set change) only re-disables
+     * controls. Lets the dialog hold its loading placeholders until controls are
+     * actionable without flashing back to them mid-session; a resolution that
+     * settles with failures counts too, so an error can't hold placeholders
+     * forever.
+     */
+    labelsInitializing: boolean;
     /** Per-grantee label scope: grantee id → label ids in scope (primary always in). */
     selectedLabelIdsByGrantee: Record<string, string[]>;
     setSelectedLabelIdsByGrantee: React.Dispatch<React.SetStateAction<Record<string, string[]>>>;
     /**
      * The single per-label write path. Diffs `desired` vs `current` over the
-     * permissionable labels and grants/revokes for one principal. Returns false
-     * if any write fails (callers surface the error and roll back).
-     */
-    reconcileLabelScope: (principal: LabelScopePrincipal, desiredLabelIds: ReadonlySet<string>, currentLabelIds: ReadonlySet<string>) => Promise<boolean>;
-    /**
-     * Multi-principal {@link reconcileLabelScope}: one `manageObjectPermissions`
-     * per label carrying all principals that change on it (used by Add). Reports
-     * `failedLabelIds` so the caller can keep the labels that landed rather than
-     * discard the whole scope on a partial failure.
+     * permissionable labels and issues one `manageObjectPermissions` per changed
+     * label, carrying every principal that changes on it. Reports `failedLabelIds`
+     * so callers can keep the labels that landed rather than treat a partial
+     * failure as all-or-nothing (each label write settles independently).
      */
-    reconcileLabelScopeMany: (principals: LabelScopePrincipal[], desiredLabelIds: ReadonlySet<string>, currentLabelIds: ReadonlySet<string>) => Promise<{
+    reconcileLabelScope: (principals: LabelScopePrincipal[], desiredLabelIds: ReadonlySet<string>, currentLabelIds: ReadonlySet<string>) => Promise<{
         ok: boolean;
         failedLabelIds: string[];
     }>;
@@ -53,10 +58,10 @@ export interface ILabelScope {
  *
  * The resolved scope is local-authoritative: the probe seeds a scope only for
  * grantees it doesn't already know, so an optimistic scope written for a freshly
- * added grantee is never overwritten by the backend's lagging read. Local scopes
- * are dropped on a target switch so the next object re-resolves from scratch.
+ * added grantee is never overwritten by the backend's lagging read. Session-scoped
+ * like its owner — the target is fixed for the mount (see {@link ObjectShareDialog}).
  *
  * @internal
  */
-export declare function useLabelScope(target: IObjectPermissionsObject | undefined, targetKey: string | undefined, labels: IObjectShareLabel[], hasList: boolean, committedGranteeIds: string[], labelsError: boolean, labelsLoading: boolean): ILabelScope;
+export declare function useLabelScope(target: IObjectPermissionsObject | undefined, labels: IObjectShareLabel[], hasList: boolean, committedGranteeIds: string[], labelsError: boolean, labelsLoading: boolean): ILabelScope;
 //# sourceMappingURL=useLabelScope.d.ts.map

package/esm/share/useLabelScope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useLabelScope.d.ts","sourceRoot":"","sources":["../../src/share/useLabelScope.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAI1E,OAAO,EACH,KAAK,mBAAmB,EAI3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IACxB;;;;OAIG;IACH,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC;;;;;;;;OAQG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,sFAAoF;IACpF,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,4BAA4B,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F;;;;OAIG;IACH,mBAAmB,EAAE,CACjB,SAAS,EAAE,mBAAmB,EAC9B,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,KACnC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;;;;OAKG;IACH,uBAAuB,EAAE,CACrB,UAAU,EAAE,mBAAmB,EAAE,EACjC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,KACnC,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,OAAO,EAAE,OAAO,EAChB,mBAAmB,EAAE,MAAM,EAAE,EAC7B,WAAW,EAAE,OAAO,EACpB,aAAa,EAAE,OAAO,GACvB,WAAW,CAqMb"}
+{"version":3,"file":"useLabelScope.d.ts","sourceRoot":"","sources":["../../src/share/useLabelScope.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAK1E,OAAO,EACH,KAAK,mBAAmB,EAG3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA6BpD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IACxB;;;;OAIG;IACH,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC;;;;;;;;OAQG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B,sFAAoF;IACpF,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,4BAA4B,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F;;;;;;OAMG;IACH,mBAAmB,EAAE,CACjB,UAAU,EAAE,mBAAmB,EAAE,EACjC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,KACnC,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,MAAM,EAAE,iBAAiB,EAAE,EAC3B,OAAO,EAAE,OAAO,EAChB,mBAAmB,EAAE,MAAM,EAAE,EAC7B,WAAW,EAAE,OAAO,EACpB,aAAa,EAAE,OAAO,GACvB,WAAW,CAmKb"}