@gooddata/sdk-ui-ext 11.51.0-alpha.0 → 11.51.0-alpha.2

package/esm/share/useLabelScope.js

@@ -1,8 +1,26 @@
 // (C) 2026 GoodData Corporation
-import { useCallback, useEffect, useMemo, useState } from "react";
-import { useBackendStrict, useWorkspaceStrict } from "@gooddata/sdk-ui";
+import { useCallback, useMemo, useState } from "react";
+import { useBackendStrict, useCancelablePromise, useWorkspaceStrict } from "@gooddata/sdk-ui";
 import { isPermissionsNotAvailable } from "./accessErrors.js";
-import { buildLabelMutations, buildLabelMutationsForPrincipals, isGranteeGrantedIn, } from "./objectShareController.helpers.js";
+import { buildLabelMutationsForPrincipals, isGranteeGrantedIn, } from "./objectShareController.helpers.js";
+/** Pure: each grantee's in-scope label ids — primary always counts, others only where the grantee is granted. */
+function resolveScopes(results, committedGranteeIds) {
+    const resolved = {};
+    for (const id of committedGranteeIds) {
+        resolved[id] = [];
+    }
+    for (const result of results) {
+        if ("transient" in result) {
+            continue;
+        }
+        for (const id of committedGranteeIds) {
+            if (result.label.isPrimary || isGranteeGrantedIn(result.list, id)) {
+                resolved[id].push(result.label.id);
+            }
+        }
+    }
+    return resolved;
+}
 /**
  * Owns label-scope resolution + writes for {@link useObjectShareController}.
  * Resolves each grantee's scope by fetching every label's access list, tracks
@@ -11,144 +29,115 @@ import { buildLabelMutations, buildLabelMutationsForPrincipals, isGranteeGranted
  *
  * The resolved scope is local-authoritative: the probe seeds a scope only for
  * grantees it doesn't already know, so an optimistic scope written for a freshly
- * added grantee is never overwritten by the backend's lagging read. Local scopes
- * are dropped on a target switch so the next object re-resolves from scratch.
+ * added grantee is never overwritten by the backend's lagging read. Session-scoped
+ * like its owner — the target is fixed for the mount (see {@link ObjectShareDialog}).
  *
  * @internal
  */
-export function useLabelScope(target, targetKey, labels, hasList, committedGranteeIds, labelsError, labelsLoading) {
+export function useLabelScope(target, labels, hasList, committedGranteeIds, labelsError, labelsLoading) {
     const backend = useBackendStrict();
     const workspace = useWorkspaceStrict();
+    // The optimistic label-scope overlay — kept authoritative: a scope written for
+    // a fresh add / labels edit must survive the backend's lagging re-read, so the
+    // probe below only seeds grantees it doesn't already know.
     const [selectedLabelIdsByGrantee, setSelectedLabelIdsByGrantee] = useState({});
-    // Label ids whose permissions endpoint responded — not every display form is
-    // independently permissionable (some 404). `undefined` means "not resolved
-    // yet" (assume all).
-    const [permissionableLabelIds, setPermissionableLabelIds] = useState(undefined);
+    // Whether the session's first probe has settled (see `labelsInitializing`) —
+    // a fact about session history, so it is state, flipped once in onSuccess.
+    const [everResolved, setEverResolved] = useState(false);
     const labelsKey = labels.map((l) => l.id).join(",");
-    // A target switch OR a label-set change invalidates the previous probe's
-    // permissionable set; until the resolution effect re-derives it,
-    // `effectiveLabels` must fall back to all labels rather than filter against
-    // stale ids. Resetting on `labelsKey` too matters when the label set changes
-    // under the same target (e.g. labels finish loading): otherwise the old
-    // permissionable set would briefly mark scope resolved and filter the new
-    // labels against stale ids, so add/share could skip expected per-label grants.
-    useEffect(() => {
-        setPermissionableLabelIds(undefined);
-    }, [targetKey, labelsKey]);
-    // A target switch — or a label-set change under the same target (labels finish
-    // loading, a label added/removed) — drops every resolved scope so the seeding
-    // effect below re-resolves from the current label set's per-label lists rather
-    // than preserving scopes computed against the old labels. Without the labelsKey
-    // reset, an existing grantee would keep a scope missing a newly-added label even
-    // when the backend grants them access to it. (An add under the SAME labels only
-    // changes granteeIdsKey, not labelsKey, so an optimistic scope still survives.)
-    useEffect(() => {
+    // Drop every resolved scope when the label SET changes (labels finish loading, a
+    // label added/removed) — the probe must re-resolve, or a grantee keeps a scope
+    // missing a newly-granted label. Render-time adjust-on-change.
+    const [seenLabelsKey, setSeenLabelsKey] = useState(labelsKey);
+    if (seenLabelsKey !== labelsKey) {
+        setSeenLabelsKey(labelsKey);
         setSelectedLabelIdsByGrantee({});
-    }, [targetKey, labelsKey]);
-    // Stable string key of the committed grantee ids — the array is rebuilt each
-    // render, so the effect keys on this instead to re-resolve only on a real change.
-    const granteeIdsKey = committedGranteeIds.slice().sort().join(",");
-    // Resolve each grantee's label scope: fetch every label's access list once and
-    // record, per grantee, which labels they appear in (primary label always counts).
-    // Keyed on the committed grantee ids + labels so it re-resolves after add/remove.
-    // `hasList` is a dep too: a list that loads with no named grantees keeps
-    // `granteeIdsKey` empty, so without it the effect would never run and the
-    // permissionable set (404 filtering) would never resolve.
-    useEffect(() => {
-        if (!target || labels.length === 0 || !hasList) {
-            return;
-        }
-        let cancelled = false;
-        Promise.all(labels.map((label) => backend
-            .workspace(workspace)
-            .objectPermissions()
-            .getAccessList({ kind: "label", ref: label.ref })
-            .then((list) => ({ label, list }))
-            // Only a definitive 404 means the label can't take a per-label
-            // grant. A transient failure (5xx / 403 / network) must NOT drop a
-            // real label — return it without grant info so it stays grantable.
-            .catch((error) => ({ label, transient: !isPermissionsNotAvailable(error) })))).then((results) => {
-            if (cancelled) {
-                return;
-            }
-            const resolved = {};
-            for (const id of committedGranteeIds) {
-                resolved[id] = [];
-            }
-            const permissionable = new Set();
-            for (const result of results) {
-                if ("transient" in result) {
-                    // Keep transiently-failed labels permissionable (don't hide a real
-                    // label); skip definitively-not-permissionable ones (404).
-                    if (result.transient) {
-                        permissionable.add(result.label.id);
-                    }
-                    continue;
-                }
-                const { label, list } = result;
-                permissionable.add(label.id);
-                for (const id of committedGranteeIds) {
-                    // Primary label is always part of the scope; others are scoped
-                    // only when the grantee actually holds a grant on that label.
-                    if (label.isPrimary || isGranteeGrantedIn(list, id)) {
-                        resolved[id].push(label.id);
-                    }
-                }
-            }
+    }
+    // Probe each label's access list to learn which are permissionable (some 404) and
+    // which each grantee holds. `hasList` gates it: a list with no named grantees keeps
+    // `granteeIdsKey` empty, but the permissionable set (404 filtering) must still resolve.
+    const { result: labelLists } = useCancelablePromise({
+        promise: target && labels.length > 0 && hasList
+            ? () => Promise.all(labels.map((label) => backend
+                .workspace(workspace)
+                .objectPermissions()
+                .getAccessList({ kind: "label", ref: label.ref })
+                .then((list) => ({ label, list }))
+                // Only a definitive 404 means the label can't take a
+                // grant; a transient failure must NOT drop a real label.
+                .catch((error) => ({
+                label,
+                transient: !isPermissionsNotAvailable(error),
+            }))))
+            : undefined,
+        onSuccess: (results) => {
+            setEverResolved(true);
+            const resolved = resolveScopes(results, committedGranteeIds);
+            // Seed only grantees we don't already have a scope for — an optimistic
+            // scope is authoritative and must survive this re-resolution. Fired once
+            // per resolution (onSuccess), so reading `prev` is safe.
             setSelectedLabelIdsByGrantee((prev) => {
-                // Seed a scope only for grantees we don't already have one for. A
-                // scope written optimistically (a fresh add, a labels edit) is
-                // local-authoritative and must survive the re-resolution that the
-                // grantee-set change triggers — the backend's lagging read would
-                // otherwise reset it. Grantees gone from the list are dropped.
                 const next = {};
                 for (const id of committedGranteeIds) {
                     next[id] = prev[id] ?? resolved[id];
                 }
                 return next;
             });
-            setPermissionableLabelIds(permissionable);
-        });
-        return () => {
-            cancelled = true;
-        };
-        // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [backend, workspace, targetKey, labelsKey, granteeIdsKey, hasList]);
-    // Only labels whose permissions endpoint responded are scope-controllable; until
-    // resolution completes (permissionableLabelIds undefined) assume all are usable.
-    // While the current target's list isn't loaded yet, ignore a permissionable set
-    // left over from a previous object so we never mis-filter the new labels.
+        },
+    }, 
+    // Keyed on the label set's stable string hash, not the array (rebuilt every
+    // render — listing it would refetch each render, an infinite loop). NOT keyed
+    // on the grantee set: adds and removes maintain their scope optimistically,
+    // so a per-grantee-change re-probe would only discard its own results while
+    // flipping labelsResolved false and disabling controls for the round trip.
+    [backend, workspace, labelsKey, hasList]);
+    // Permissionable ids derived straight from the probe result — `undefined` (assume
+    // all) until it resolves, which also invalidates automatically on a dep change
+    // (useCancelablePromise resets to loading), so no separate reset is needed.
+    const permissionableLabelIds = useMemo(() => {
+        if (!labelLists) {
+            return undefined;
+        }
+        const permissionable = new Set();
+        for (const result of labelLists) {
+            // Keep transiently-failed labels permissionable; skip definitive 404s.
+            if ("transient" in result) {
+                if (result.transient) {
+                    permissionable.add(result.label.id);
+                }
+            }
+            else {
+                permissionable.add(result.label.id);
+            }
+        }
+        return permissionable;
+    }, [labelLists]);
+    // Only permissionable labels are scope-controllable; assume all until resolved.
     const effectiveLabels = useMemo(() => hasList && permissionableLabelIds
         ? labels.filter((l) => permissionableLabelIds.has(l.id))
         : labels, [labels, permissionableLabelIds, hasList]);
-    // Resolution is done when the probe has produced a permissionable set, or when
-    // there are genuinely no labels to probe (a label-free object). Until then
-    // callers must treat the scope as unknown (not "all selected").
-    //
-    // Crucially, an EMPTY `labels` list only means "resolved" when labels aren't
-    // still loading and didn't error: while they load, the consumer hasn't passed
-    // them yet (labels === [] with loading true), and on error they can't be known.
-    // Treating either as resolved would let row controls reconcile against an empty
-    // label set and silently orphan real per-label grants. So stay unresolved while
-    // labels are pending, regardless of the current (possibly empty) list.
+    // A transiently-failed probe means that label's per-grantee grants are UNKNOWN —
+    // the label stays visible (permissionable), but the scope must not count as
+    // resolved: edits would diff against an invented current and could orphan or
+    // skip that label's real grants. Same philosophy as the `labelsError` gate.
+    const hasTransientProbe = labelLists?.some((r) => "transient" in r && r.transient) ?? false;
+    // Resolved once the probe produced a permissionable set with no unknowns, or for
+    // a genuinely label-free object. An EMPTY `labels` list counts as resolved only
+    // when labels aren't still loading and didn't error — otherwise row controls
+    // would reconcile against an empty set and silently orphan real per-label grants.
     const labelsPending = labelsError || labelsLoading;
-    const labelsResolved = !labelsPending && (labels.length === 0 || permissionableLabelIds !== undefined);
-    // The single per-label write path. Diffs `desired` vs `current` over the
-    // permissionable labels and applies the grants/revokes for one principal
-    // (a grantee, or the all-workspace-users rule). Returns false if ANY write
-    // fails — callers surface the error and roll back, so a partial write never
-    // looks like success (no silent .catch). Used by add, remove, general access
-    // and the labels picker alike, so their label behavior can't drift.
-    const reconcileLabelScope = useCallback(async (principal, desiredLabelIds, currentLabelIds) => {
-        const writes = buildLabelMutations(principal, desiredLabelIds, currentLabelIds, effectiveLabels);
-        if (writes.length === 0) {
-            return true;
-        }
-        const svc = backend.workspace(workspace).objectPermissions();
-        const results = await Promise.allSettled(writes.map((w) => svc.manageObjectPermissions({ kind: "label", ref: w.ref }, [w.grantee])));
-        return results.every((r) => r.status === "fulfilled");
-    }, [effectiveLabels, backend, workspace]);
-    const reconcileLabelScopeMany = useCallback(async (principals, desiredLabelIds, currentLabelIds) => {
+    const labelsResolved = !labelsPending &&
+        (labels.length === 0 || (permissionableLabelIds !== undefined && !hasTransientProbe));
+    // First-resolution only: metadata still loading, or a probe will run and hasn't
+    // settled once. A metadata ERROR is not initializing (nothing more will load —
+    // the dialog reveals with disabled controls instead of holding placeholders).
+    const labelsInitializing = labelsLoading || (labels.length > 0 && !everResolved);
+    // The single per-label write path (see the interface doc) — used by add, remove,
+    // general access and the labels picker alike, so their label behavior can't
+    // drift. Writes settle independently (allSettled), and the failed labels are
+    // reported by id — never collapsed into one boolean, or a partial failure would
+    // roll callers back past writes that actually landed.
+    const reconcileLabelScope = useCallback(async (principals, desiredLabelIds, currentLabelIds) => {
         const writes = buildLabelMutationsForPrincipals(principals, desiredLabelIds, currentLabelIds, effectiveLabels);
         if (writes.length === 0) {
             return { ok: true, failedLabelIds: [] };
@@ -163,9 +152,9 @@ export function useLabelScope(target, targetKey, labels, hasList, committedGrant
     return {
         effectiveLabels,
         labelsResolved,
+        labelsInitializing,
         selectedLabelIdsByGrantee,
         setSelectedLabelIdsByGrantee,
         reconcileLabelScope,
-        reconcileLabelScopeMany,
     };
 }

package/esm/share/useObjectShareController.d.ts

@@ -1,27 +1,24 @@
 import type { IObjectPermissionsObject } from "@gooddata/sdk-backend-spi";
 import { type IObjectShareController, type IUseObjectShareOptions } from "./objectShareController.types.js";
 /**
- * Manages the share dialog state and backend I/O for a single shareable object.
+ * Manages the share-dialog state and backend I/O for ONE dialog session: the hook
+ * is mounted while the dialog is open, for a single target that must not change
+ * while mounted (see {@link ObjectShareDialog}). Unmounting discards every
+ * transient — pending rows, staged confirms, optimistic overlays — so no explicit
+ * reset exists or is needed.
  *
- * The access list is fetched once and seeded into local state, which is the
- * source of truth while the dialog/summary is mounted. Each access change is
- * written through to local state immediately and sent to the backend; on failure
- * the one changed entry is rolled back. There is no post-write refetch, so the
- * grantee list never blanks and never fights the backend's read-after-write lag.
- * Top-level open/close is the consumer's concern (see {@link ObjectShareDialog}).
+ * The access list is fetched once, and the displayed state is *derived* from that
+ * fetch composed with a small local edit overlay (owned by `useAccessList`). Each
+ * access change writes its overlay entry (so the row updates immediately), commits
+ * to the backend, then settles the entry on success or reverts it on failure (to
+ * the last committed entry, or the fetched value). There is no post-write refetch,
+ * so the grantee list never blanks and never fights read-after-write lag.
  *
  * Mutations follow a **commit-on-interaction** model: each access change is sent
  * immediately; the general-access toggle goes through a confirm step because it
- * is high-impact. There is no batched Save. The list is fetched eagerly so
- * `state.summary` also drives an inline access row while closed.
- *
- * Most consumers do not call this directly — render {@link ObjectShareDialog} with
- * plain props and it owns its controller. Call this (exported as `useObjectShare`)
- * only to share a single access-list fetch between the dialog and an inline summary
- * row: call it once, read `state.summary` for the row, and pass the controller into
- * the dialog. Grantee rows carry identity facts only (`name`/`email` are undefined
- * when unknown); the display fallback order is not exposed, so {@link ObjectShareDialog}
- * is the only sanctioned row renderer.
+ * is high-impact. There is no batched Save. Grantee rows carry identity facts only
+ * (`name`/`email` are undefined when unknown); the display fallback order is not
+ * exposed, so {@link ObjectShareDialog} is the only sanctioned row renderer.
  *
  * @internal
  */

package/esm/share/useObjectShareController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useObjectShareController.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareController.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAc1E,OAAO,EACH,KAAK,sBAAsB,EAI3B,KAAK,sBAAsB,EAE9B,MAAM,kCAAkC,CAAC;AAI1C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,sBAAsB,GACjC,sBAAsB,CAmmBxB"}
+{"version":3,"file":"useObjectShareController.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareController.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAiB1E,OAAO,EACH,KAAK,sBAAsB,EAI3B,KAAK,sBAAsB,EAE9B,MAAM,kCAAkC,CAAC;AAI1C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,sBAAsB,GACjC,sBAAsB,CA+kBxB"}