@gooddata/sdk-ui-ext 11.51.0-alpha.0 → 11.51.0-alpha.2

package/esm/share/useObjectShareController.js

@@ -1,84 +1,59 @@
 // (C) 2026 GoodData Corporation
-import { useCallback, useMemo, useRef, useState } from "react";
+import { useCallback, useMemo, useState } from "react";
 import { useToastMessage } from "@gooddata/sdk-ui-kit";
 import { composeEffectiveWorkspaceAccess } from "./accessSummary.js";
 import { objectShareMessages } from "./messages.js";
-import { EMPTY_IDS, NO_LABELS, effectivePermissionAbove, granularGranteeFor, toGranularGrantee, } from "./objectShareController.helpers.js";
+import { EMPTY_IDS, NO_LABELS, granularGranteeFor, levelsAbove, levelsBelow, sortGrantees, toGranularGrantee, userDisplayPair, } from "./objectShareController.helpers.js";
 import { useAccessList } from "./useAccessList.js";
 import { useLabelScope } from "./useLabelScope.js";
 /**
- * Manages the share dialog state and backend I/O for a single shareable object.
+ * Manages the share-dialog state and backend I/O for ONE dialog session: the hook
+ * is mounted while the dialog is open, for a single target that must not change
+ * while mounted (see {@link ObjectShareDialog}). Unmounting discards every
+ * transient — pending rows, staged confirms, optimistic overlays — so no explicit
+ * reset exists or is needed.
  *
- * The access list is fetched once and seeded into local state, which is the
- * source of truth while the dialog/summary is mounted. Each access change is
- * written through to local state immediately and sent to the backend; on failure
- * the one changed entry is rolled back. There is no post-write refetch, so the
- * grantee list never blanks and never fights the backend's read-after-write lag.
- * Top-level open/close is the consumer's concern (see {@link ObjectShareDialog}).
+ * The access list is fetched once, and the displayed state is *derived* from that
+ * fetch composed with a small local edit overlay (owned by `useAccessList`). Each
+ * access change writes its overlay entry (so the row updates immediately), commits
+ * to the backend, then settles the entry on success or reverts it on failure (to
+ * the last committed entry, or the fetched value). There is no post-write refetch,
+ * so the grantee list never blanks and never fights read-after-write lag.
  *
  * Mutations follow a **commit-on-interaction** model: each access change is sent
  * immediately; the general-access toggle goes through a confirm step because it
- * is high-impact. There is no batched Save. The list is fetched eagerly so
- * `state.summary` also drives an inline access row while closed.
- *
- * Most consumers do not call this directly — render {@link ObjectShareDialog} with
- * plain props and it owns its controller. Call this (exported as `useObjectShare`)
- * only to share a single access-list fetch between the dialog and an inline summary
- * row: call it once, read `state.summary` for the row, and pass the controller into
- * the dialog. Grantee rows carry identity facts only (`name`/`email` are undefined
- * when unknown); the display fallback order is not exposed, so {@link ObjectShareDialog}
- * is the only sanctioned row renderer.
+ * is high-impact. There is no batched Save. Grantee rows carry identity facts only
+ * (`name`/`email` are undefined when unknown); the display fallback order is not
+ * exposed, so {@link ObjectShareDialog} is the only sanctioned row renderer.
  *
  * @internal
  */
 export function useObjectShareController(target, options) {
-    const { onSaved, labels = NO_LABELS, labelsError = false, labelsLoading = false, isOpen = false, } = options ?? {};
+    const { labels = NO_LABELS, labelsError = false, labelsLoading = false } = options ?? {};
     const toast = useToastMessage();
     // UI-local buffers — never backend data.
     const [subview, setSubview] = useState("main");
     const [pendingGrantees, setPendingGrantees] = useState([]);
     const [pendingGeneralAccess, setPendingGeneralAccess] = useState(undefined);
-    // True while a workspace-level re-grade is committing. The workspace rule has no
-    // grantee row to carry a `pending` flag (unlike named grantees), so this gates
-    // re-entry and disables the dropdown to keep rapid VIEW↔SHARE toggles from issuing
-    // overlapping writes that could settle out of order.
-    const [workspaceLevelSaving, setWorkspaceLevelSaving] = useState(false);
-    // The backend access list, seeded into local state (rows, general access,
-    // summary, the commit/picker primitives) lives in its own hook.
-    const { targetKey, hasList, grantees, seededWithoutGrants, selfIdentity, selfIdentityResolved, generalAccess, workspaceLevel, inheritedWorkspaceLevel, summary, status, loadError, accessUnavailable, commit, loadOptions, refForId, setGrantees, setGeneralAccess, setWorkspaceLevel, } = useAccessList(target, onSaved, isOpen);
-    // Always-current target key, read inside async mutation finalizers that captured
-    // an older one. A write started for object A resolves after the user navigated to
-    // object B; because local state is authoritative (no refetch), applying A's
-    // finalizer to B's seeded list would corrupt B (e.g. clobber a same-id row, or
-    // revert B's general access). Each finalizer captures the target it started for
-    // and bails if it no longer matches.
-    const targetKeyRef = useRef(targetKey);
-    targetKeyRef.current = targetKey;
-    // The committed grantee ids the label-scope probe resolves against (a removing
-    // row is excluded so its scope is dropped, not re-seeded).
-    const committedGranteeIds = useMemo(() => grantees.filter((g) => g.pending !== "removing").map((g) => g.id), [grantees]);
+    const { hasList, grantees, seededWithoutSelfGrant, selfIdentity, selfIdentityResolved, generalAccess, workspaceLevel, workspaceInheritedLevel, workspaceLevelSaving, summary, status, loadError, commit, loadOptions, applyGranteeAdd, applyGranteeLevel, applyGranteeRemove, settleGranteeEdit, failGranteeEdit, applyRuleEdit, settleRuleEdit, failRuleEdit, } = useAccessList(target);
+    // Grantee ids the label-scope probe resolves against — a removing row is excluded
+    // so its scope is dropped, not re-seeded.
+    const committedGranteeIds = useMemo(() => {
+        const ids = [];
+        for (const g of grantees) {
+            if (g.pending !== "removing") {
+                ids.push(g.id);
+            }
+        }
+        return ids;
+    }, [grantees]);
     // Per-label scope resolution + the single label-write path live in their own hook.
-    const { effectiveLabels, labelsResolved, selectedLabelIdsByGrantee, setSelectedLabelIdsByGrantee, reconcileLabelScope, reconcileLabelScopeMany, } = useLabelScope(target, targetKey, labels, hasList, committedGranteeIds, labelsError, labelsLoading);
-    // Drop the transient UI buffers when the permission target changes. The detail
-    // view is reused across objects and closes the dialog by toggling `isOpen`
-    // alone, so without this a staged add-grantee subview or general-access confirm
-    // would survive navigation and reappear on (and apply to) the next object.
-    // Reset during render — React's "adjust state on prop change" idiom — rather
-    // than in an effect, so the stale buffers never reach a commit.
-    const [lastTargetKey, setLastTargetKey] = useState(targetKey);
-    if (lastTargetKey !== targetKey) {
-        setLastTargetKey(targetKey);
-        setSubview("main");
-        setPendingGrantees([]);
-        setPendingGeneralAccess(undefined);
-        setWorkspaceLevelSaving(false);
-    }
-    const reset = useCallback(() => {
-        setSubview("main");
-        setPendingGrantees([]);
-        setPendingGeneralAccess(undefined);
-        setWorkspaceLevelSaving(false);
-    }, []);
+    const { effectiveLabels, labelsResolved, labelsInitializing, selectedLabelIdsByGrantee, setSelectedLabelIdsByGrantee, reconcileLabelScope, } = useLabelScope(target, labels, hasList, committedGranteeIds, labelsError, labelsLoading);
+    // Effective access: the direct state composed with inherited rule access.
+    // Also pins the level to VIEW while restricted, so the (hidden) dropdown
+    // never shows a stale SHARE left over from a prior grant.
+    const effectiveWorkspace = useMemo(() => composeEffectiveWorkspaceAccess(generalAccess, workspaceLevel, workspaceInheritedLevel), [generalAccess, workspaceLevel, workspaceInheritedLevel]);
+    // ── Add-grantee subview ──────────────────────────────────────────────────────
     const openAddGrantee = useCallback(() => {
         setSubview("addGrantee");
         setPendingGrantees([]);
@@ -87,6 +62,7 @@ export function useObjectShareController(target, options) {
         setSubview("main");
         setPendingGrantees([]);
     }, []);
+    // ── Shared write path (object grant + label-scope mirror) ────────────────────
     // The single object+labels write path shared by remove and general access (the
     // two changes that must keep the object grant and its label mirror consistent).
     // Mirrors the labels first, then writes the object; if the object write fails it
@@ -95,47 +71,48 @@ export function useObjectShareController(target, options) {
     // are one logical change), remove proceeds (the object revoke is what matters; a
     // leftover label grant is only surfaced as a warning). Returns the object-write
     // result and whether the label mirror fully applied; the caller owns the local
-    // write-through, the revert and any toast beyond `commit`'s own.
+    // overlay, the revert and any toast beyond `commit`'s own.
     const applyAccessChange = useCallback(async (params) => {
         const { principal, objectMutation, successMessage, labelDesired, labelCurrent } = params;
-        const labelsOk = await reconcileLabelScope(principal, labelDesired, labelCurrent);
+        const { ok: labelsOk } = await reconcileLabelScope([principal], labelDesired, labelCurrent);
         if (!labelsOk && params.abortIfLabelsFail) {
             // Don't write the object on a half-applied label scope: undo whatever
             // mirrored and surface the failure to the caller.
-            await reconcileLabelScope(principal, labelCurrent, labelDesired);
+            await reconcileLabelScope([principal], labelCurrent, labelDesired);
             return { ok: false, labelsOk: false };
         }
         const ok = await commit([objectMutation], successMessage);
         if (!ok) {
             // Object write failed — undo the label mirror so labels and object
             // don't drift.
-            await reconcileLabelScope(principal, labelCurrent, labelDesired);
+            await reconcileLabelScope([principal], labelCurrent, labelDesired);
         }
         return { ok, labelsOk };
     }, [commit, reconcileLabelScope]);
+    // ── Grantee mutations (add / level / remove / labels) ────────────────────────
     const confirmAddGrantees = useCallback(async () => {
         if (pendingGrantees.length === 0) {
             return;
         }
-        const startedFor = targetKey;
-        // Insert the picked grantees as pending rows. Identity facts are not copied
-        // from the picker option (its name/email are display fallbacks, not facts) —
-        // rows render from the facts cache the picker fetch already populated.
+        // Insert the picked grantees as pending overlay rows, carrying the picker
+        // option's ref (exact backend ref) and display name/email straight through —
+        // there is no post-write refetch, so the row shows what the picker showed.
         const addedIds = pendingGrantees.map((g) => g.id);
         const addedRows = pendingGrantees.map((g) => ({
             id: g.id,
             kind: g.kind,
-            granteeRef: refForId(g.id),
+            granteeRef: g.ref,
+            name: g.name,
+            email: g.email,
             level: g.permissionLevel,
-            pending: "saving",
         }));
-        const mutations = pendingGrantees.map((g) => toGranularGrantee(g.kind, refForId(g.id), g.permissionLevel));
+        const mutations = pendingGrantees.map((g) => toGranularGrantee(g.kind, g.ref, g.permissionLevel));
         // Default each new grantee to ALL labels (the picker's Add is gated until
         // labels have loaded, so the set is known here). Reflect the full scope
         // before the writes so the row shows it immediately.
         const allLabelIds = effectiveLabels.map((l) => l.id);
         const allLabelIdSet = new Set(allLabelIds);
-        setGrantees((prev) => [...prev.filter((g) => !addedIds.includes(g.id)), ...addedRows]);
+        addedRows.forEach(applyGranteeAdd);
         setSelectedLabelIdsByGrantee((prev) => {
             const next = { ...prev };
             for (const id of addedIds) {
@@ -143,18 +120,11 @@ export function useObjectShareController(target, options) {
             }
             return next;
         });
-        // Leave the add subview at once so the new rows show in the main list.
         closeAddGrantee();
         const ok = await commit(mutations, objectShareMessages.toastGranteeAdded);
-        // Bail if the target switched mid-add: the new object's list was already
-        // seeded, so rolling back / clearing markers / mirroring labels by these ids
-        // would hit the wrong object.
-        if (targetKeyRef.current !== startedFor) {
-            return;
-        }
         if (!ok) {
             // Roll back the failed adds.
-            setGrantees((prev) => prev.filter((g) => !addedIds.includes(g.id)));
+            addedIds.forEach((id) => failGranteeEdit(id));
             setSelectedLabelIdsByGrantee((prev) => {
                 const next = { ...prev };
                 for (const id of addedIds) {
@@ -164,14 +134,9 @@ export function useObjectShareController(target, options) {
             });
             return;
         }
-        // Object grant landed — clear the saving marker on the new rows.
-        setGrantees((prev) => prev.map((g) => (addedIds.includes(g.id) ? { ...g, pending: undefined } : g)));
         // One label write per label carrying all added grantees, not one per grantee.
-        const principals = pendingGrantees.map((g) => ({ kind: g.kind, granteeRef: refForId(g.id) }));
-        const { ok: labelsOk, failedLabelIds } = await reconcileLabelScopeMany(principals, allLabelIdSet, EMPTY_IDS);
-        if (targetKeyRef.current !== startedFor) {
-            return;
-        }
+        const principals = pendingGrantees.map((g) => ({ kind: g.kind, granteeRef: g.ref }));
+        const { ok: labelsOk, failedLabelIds } = await reconcileLabelScope(principals, allLabelIdSet, EMPTY_IDS);
         if (!labelsOk) {
             toast.addWarning(objectShareMessages.toastLabelScopePartial);
             // Drop only the failed labels, keeping those that landed — otherwise local
@@ -186,16 +151,21 @@ export function useObjectShareController(target, options) {
                 return next;
             });
         }
+        // Settle only now — the add is one logical operation (object grant + label
+        // grants), and an unlocked row mid-way would let a remove or label edit race
+        // the in-flight label grants. The `added` entries persist (base never had
+        // these rows); only the saving marker clears.
+        addedIds.forEach((id) => settleGranteeEdit(id));
     }, [
         pendingGrantees,
-        targetKey,
         commit,
         closeAddGrantee,
         effectiveLabels,
-        reconcileLabelScopeMany,
-        refForId,
+        reconcileLabelScope,
         toast,
-        setGrantees,
+        applyGranteeAdd,
+        settleGranteeEdit,
+        failGranteeEdit,
         setSelectedLabelIdsByGrantee,
     ]);
     const changePermissionLevel = useCallback(async (granteeId, level) => {
@@ -203,67 +173,48 @@ export function useObjectShareController(target, options) {
         if (!grantee || grantee.level === level || grantee.pending) {
             return;
         }
-        const startedFor = targetKey;
-        const previousLevel = grantee.level;
-        // Recompute the inherited-SHARE badge for the new direct level: raising a
-        // VIEW grant to SHARE makes the inherited SHARE no longer "above" the
-        // direct grant (badge hidden); lowering it back surfaces the warning again.
-        const nextEffective = effectivePermissionAbove(level, grantee.inheritsShare ? ["SHARE"] : []);
-        // Show the new level immediately (marked saving), then write it through.
-        setGrantees((prev) => prev.map((g) => g.id === granteeId
-            ? { ...g, level, effectivePermission: nextEffective, pending: "saving" }
-            : g));
+        applyGranteeLevel(granteeId, level);
         const ok = await commit([toGranularGrantee(grantee.kind, grantee.granteeRef, level)], objectShareMessages.toastAccessUpdated);
-        // The target may have changed while the write was in flight; applying this
-        // finalizer to the newly seeded list would corrupt the other object's row.
-        if (targetKeyRef.current !== startedFor) {
-            return;
+        // The settled entry persists on success (base still holds the old level);
+        // failure restores the last committed entry, or the fetched row.
+        if (ok) {
+            settleGranteeEdit(granteeId);
         }
-        setGrantees((prev) => prev.map((g) => g.id === granteeId
-            ? {
-                ...g,
-                level: ok ? level : previousLevel,
-                effectivePermission: ok
-                    ? nextEffective
-                    : effectivePermissionAbove(previousLevel, g.inheritsShare ? ["SHARE"] : []),
-                pending: undefined,
-            }
-            : g));
-    }, [grantees, targetKey, commit, setGrantees]);
+        else {
+            failGranteeEdit(granteeId);
+        }
+    }, [grantees, commit, applyGranteeLevel, settleGranteeEdit, failGranteeEdit]);
     const removeGrantee = useCallback(async (granteeId) => {
         const grantee = grantees.find((g) => g.id === granteeId);
         if (!grantee || grantee.pending) {
             return;
         }
-        const startedFor = targetKey;
         // Mark the row removed but keep it visible (muted) until the write lands.
-        setGrantees((prev) => prev.map((g) => (g.id === granteeId ? { ...g, pending: "removing" } : g)));
+        applyGranteeRemove(granteeId);
         // Revoke the grantee's per-label grants too — they are independent
-        // access-list entries, so the object revoke alone would leave them behind
-        // (current = all permissionable). The object revoke is what matters; a
-        // label revoke that fails is non-fatal (surfaced as a warning), so don't
-        // abort on it.
+        // access-list entries, so the object revoke alone would leave them behind.
+        // The revoke runs over the grantee's KNOWN scope: if the object revoke
+        // then fails, the compensation re-grants exactly that scope, never labels
+        // the grantee didn't hold. The object revoke is what matters; a label
+        // revoke that fails is non-fatal (surfaced as a warning), so don't abort
+        // on it.
         const { ok, labelsOk } = await applyAccessChange({
             principal: { kind: grantee.kind, granteeRef: grantee.granteeRef },
             objectMutation: toGranularGrantee(grantee.kind, grantee.granteeRef, "none"),
             successMessage: objectShareMessages.toastAccessUpdated,
             labelDesired: EMPTY_IDS,
-            labelCurrent: new Set(effectiveLabels.map((l) => l.id)),
+            labelCurrent: new Set(selectedLabelIdsByGrantee[granteeId] ?? effectiveLabels.map((l) => l.id)),
             abortIfLabelsFail: false,
         });
-        // Bail if the target switched mid-write: the row no longer belongs to the
-        // seeded list, and dropping/restoring "it" would hit the other object.
-        if (targetKeyRef.current !== startedFor) {
-            return;
-        }
         if (!ok) {
             // Object revoke failed (applyAccessChange already re-granted the
             // labels) — restore the row.
-            setGrantees((prev) => prev.map((g) => (g.id === granteeId ? { ...g, pending: undefined } : g)));
+            failGranteeEdit(granteeId);
             return;
         }
-        // Object revoke landed — drop the row from local state.
-        setGrantees((prev) => prev.filter((g) => g.id !== granteeId));
+        // Object revoke landed. For a fetched row the settled `removed` entry
+        // persists to keep it hidden; a revoked overlay-born row drops entirely.
+        settleGranteeEdit(granteeId);
         setSelectedLabelIdsByGrantee((prev) => {
             const { [granteeId]: _omit, ...rest } = prev;
             return rest;
@@ -275,16 +226,18 @@ export function useObjectShareController(target, options) {
         }
     }, [
         grantees,
-        targetKey,
         applyAccessChange,
         effectiveLabels,
+        selectedLabelIdsByGrantee,
         toast,
-        setGrantees,
+        applyGranteeRemove,
+        settleGranteeEdit,
+        failGranteeEdit,
         setSelectedLabelIdsByGrantee,
     ]);
     const changeGranteeLabels = useCallback(async (granteeId, requested) => {
         const grantee = grantees.find((g) => g.id === granteeId);
-        if (!grantee || !target) {
+        if (!grantee || grantee.pending || !target) {
             return;
         }
         // Primary label is always in scope; never let it be dropped.
@@ -293,49 +246,65 @@ export function useObjectShareController(target, options) {
         const currentScope = selectedLabelIdsByGrantee[granteeId] ?? effectiveLabels.map((l) => l.id);
         const desired = new Set(nextScope);
         const current = new Set(currentScope);
-        const startedFor = targetKey;
-        // Reflect the new scope immediately; restore it on failure.
-        const previousScope = currentScope;
-        setSelectedLabelIdsByGrantee((prev) => ({ ...prev, [granteeId]: nextScope }));
-        const ok = await reconcileLabelScope({ kind: grantee.kind, granteeRef: grantee.granteeRef }, desired, current);
-        // Bail if the target switched mid-write — the scope map now belongs to the
-        // other object, so neither the success no-op nor the rollback applies here.
-        if (targetKeyRef.current !== startedFor) {
+        // Applying the checklist unchanged is a no-op — don't lock the row or
+        // toast success over zero writes.
+        if (desired.size === current.size && nextScope.every((id) => current.has(id))) {
             return;
         }
+        // Reflect the new scope immediately and lock the row until the writes
+        // settle — an overlapping label edit or removal would race these writes
+        // on the same labels. The lock reuses the level overlay at the unchanged
+        // level; pending is the only fact it adds.
+        applyGranteeLevel(granteeId, grantee.level);
+        setSelectedLabelIdsByGrantee((prev) => ({ ...prev, [granteeId]: nextScope }));
+        const { ok, failedLabelIds } = await reconcileLabelScope([{ kind: grantee.kind, granteeRef: grantee.granteeRef }], desired, current);
         if (ok) {
+            settleGranteeEdit(granteeId);
             toast.addSuccess(objectShareMessages.toastAccessUpdated);
-            onSaved?.();
+            return;
+        }
+        failGranteeEdit(granteeId);
+        // Label writes settle independently: keep what landed and flip only the
+        // failed labels back, so the local scope matches the backend exactly —
+        // restoring the whole previous scope would un-track the writes that
+        // succeeded, and later edits would diff against a false state.
+        const failed = new Set(failedLabelIds);
+        const landedScope = Array.from(new Set([...nextScope, ...currentScope])).filter((id) => (failed.has(id) ? current : desired).has(id));
+        setSelectedLabelIdsByGrantee((prev) => ({ ...prev, [granteeId]: landedScope }));
+        const anyLanded = landedScope.length !== currentScope.length || landedScope.some((id) => !current.has(id));
+        if (anyLanded) {
+            toast.addWarning(objectShareMessages.toastLabelScopePartial);
         }
         else {
             toast.addError(objectShareMessages.toastError);
-            setSelectedLabelIdsByGrantee((prev) => ({ ...prev, [granteeId]: previousScope }));
         }
     }, [
         grantees,
         target,
-        targetKey,
         effectiveLabels,
         selectedLabelIdsByGrantee,
         reconcileLabelScope,
         toast,
-        onSaved,
+        applyGranteeLevel,
+        settleGranteeEdit,
+        failGranteeEdit,
         setSelectedLabelIdsByGrantee,
     ]);
+    // ── Workspace-rule mutations (general access + rule level) ───────────────────
     const requestGeneralAccessChange = useCallback((next) => {
         // Inherited rule access can't be revoked from this workspace, so a
         // Restricted request can never be honored — refuse it (the radio row
         // is also disabled). Compare against the effective value the radio
         // shows: with inherited access it is WORKSPACE even when this
         // workspace holds no rule of its own.
-        if (inheritedWorkspaceLevel && next === "RESTRICTED") {
+        if (workspaceInheritedLevel && next === "RESTRICTED") {
             return;
         }
-        const effective = inheritedWorkspaceLevel ? "WORKSPACE" : generalAccess;
+        const effective = workspaceInheritedLevel ? "WORKSPACE" : generalAccess;
         if (next !== effective) {
             setPendingGeneralAccess(next);
         }
-    }, [generalAccess, inheritedWorkspaceLevel]);
+    }, [generalAccess, workspaceInheritedLevel]);
     const confirmGeneralAccessChange = useCallback(async () => {
         const next = pendingGeneralAccess;
         if (!next || next === generalAccess) {
@@ -349,17 +318,16 @@ export function useObjectShareController(target, options) {
         if (workspaceLevelSaving) {
             return;
         }
-        const startedFor = targetKey;
-        const previous = generalAccess;
-        const previousWorkspaceLevel = workspaceLevel;
         // Apply the new value and close the confirm at once — the radio + summary
         // reflect `next` immediately; the write commits in the background. The
         // workspace rule is always written as VIEW, so reflect VIEW now too —
         // otherwise the summary would keep a SHARE level left over from the fetch.
-        setGeneralAccess(next);
-        if (next === "WORKSPACE") {
-            setWorkspaceLevel("VIEW");
-        }
+        // PENDING until the whole labels+object save settles: the radio and the
+        // level menu must stay locked, or a re-grade started meanwhile would race
+        // this save on the same allWorkspaceUsers rule and could land first, letting
+        // the delayed VIEW write downgrade what the UI shows.
+        const nextLevel = next === "WORKSPACE" ? "VIEW" : workspaceLevel;
+        applyRuleEdit({ generalAccess: next, level: nextLevel, pending: true });
         setPendingGeneralAccess(undefined);
         const principal = { allWorkspaceUsers: true };
         const allIds = new Set(effectiveLabels.map((l) => l.id));
@@ -376,18 +344,15 @@ export function useObjectShareController(target, options) {
             labelCurrent: current,
             abortIfLabelsFail: true,
         });
-        // Bail if the target switched mid-write — reverting now would change the
-        // other object's general access.
-        if (targetKeyRef.current !== startedFor) {
-            return;
+        if (ok) {
+            settleRuleEdit();
         }
-        if (!ok) {
+        else {
             // Labels or object write failed (applyAccessChange already undid the
-            // label mirror) — revert the value (and the workspace level). The
-            // label-abort path produced no toast, so surface the error here; a
+            // label mirror) — revert to the last committed rule state, or the fetch.
+            // The label-abort path produced no toast, so surface the error here; a
             // failed object write already toasted via commit, so don't double up.
-            setGeneralAccess(previous);
-            setWorkspaceLevel(previousWorkspaceLevel);
+            failRuleEdit();
             if (!labelsOk) {
                 toast.addError(objectShareMessages.toastError);
             }
@@ -397,54 +362,52 @@ export function useObjectShareController(target, options) {
         generalAccess,
         workspaceLevel,
         workspaceLevelSaving,
-        targetKey,
         applyAccessChange,
         effectiveLabels,
         toast,
-        setGeneralAccess,
-        setWorkspaceLevel,
+        applyRuleEdit,
+        settleRuleEdit,
+        failRuleEdit,
     ]);
     const changeWorkspaceLevel = useCallback(async (level) => {
+        // The dropdown displays the EFFECTIVE level (direct composed with
+        // inherited), so no-ops must be judged against it: with an inherited
+        // SHARE over a direct VIEW the menu shows SHARE checked, and clicking
+        // it must not silently escalate the persisted direct rule to SHARE.
+        const effectiveLevel = effectiveWorkspace.workspaceLevel;
         // Only re-grade an already-granted workspace rule; ignore no-ops, calls made
         // while this workspace grants no rule of its own (inherited-only access has
-        // nothing to re-grade), calls while an inherited SHARE pins the effective
-        // level (a direct downgrade couldn't change it), and re-entry while a
+        // nothing to re-grade), calls for levels below an inherited one (a direct
+        // downgrade couldn't lower the effective level), and re-entry while a
         // previous re-grade is still in flight (would overlap writes).
         if (generalAccess !== "WORKSPACE" ||
-            inheritedWorkspaceLevel === "SHARE" ||
-            level === workspaceLevel ||
+            levelsBelow(workspaceInheritedLevel ?? "VIEW").includes(level) ||
+            level === effectiveLevel ||
             workspaceLevelSaving) {
             return;
         }
-        const startedFor = targetKey;
-        const previousLevel = workspaceLevel;
-        // Reflect the new level immediately and mark the write in flight, then commit
-        // it. Labels are untouched — they were already mirrored when workspace access
-        // was granted; this changes only the rule's permission grade.
-        setWorkspaceLevel(level);
-        setWorkspaceLevelSaving(true);
+        // Labels are untouched — already mirrored when workspace access was granted;
+        // this only re-grades the rule's permission level.
+        applyRuleEdit({ generalAccess: "WORKSPACE", level, pending: true });
         const ok = await commit([granularGranteeFor({ allWorkspaceUsers: true }, level)], objectShareMessages.toastGeneralAccessUpdated);
-        // Bail if the target switched mid-write — the workspace level now belongs to
-        // the other object, so neither keeping nor rolling back applies here. The
-        // saving flag is reset on the new target's seed, so don't touch it.
-        if (targetKeyRef.current !== startedFor) {
-            return;
+        if (ok) {
+            settleRuleEdit();
         }
-        if (!ok) {
-            setWorkspaceLevel(previousLevel);
+        else {
+            failRuleEdit();
         }
-        setWorkspaceLevelSaving(false);
     }, [
         generalAccess,
-        inheritedWorkspaceLevel,
-        workspaceLevel,
+        workspaceInheritedLevel,
+        effectiveWorkspace,
         workspaceLevelSaving,
-        targetKey,
         commit,
-        setWorkspaceLevel,
+        applyRuleEdit,
+        settleRuleEdit,
+        failRuleEdit,
     ]);
+    // ── Assembly: actions + state view exposed to consumers ──────────────────────
     const actions = useMemo(() => ({
-        reset,
         openAddGrantee,
         closeAddGrantee,
         setPendingGrantees,
@@ -458,7 +421,6 @@ export function useObjectShareController(target, options) {
         confirmGeneralAccessChange,
         changeWorkspaceLevel,
     }), [
-        reset,
         openAddGrantee,
         closeAddGrantee,
         loadOptions,
@@ -470,48 +432,73 @@ export function useObjectShareController(target, options) {
         confirmGeneralAccessChange,
         changeWorkspaceLevel,
     ]);
-    const state = useMemo(() => ({
-        subview,
-        status,
-        error: loadError,
-        accessUnavailable,
-        summary,
-        targetKey,
-        selfIdentity,
-        selfIdentityResolved,
-        seededWithoutGrants,
-        grantees,
-        // Effective access: the direct state composed with inherited rule
-        // access. Also pins the level to VIEW while restricted, so the (hidden)
-        // dropdown never shows a stale SHARE left over from a prior grant.
-        ...composeEffectiveWorkspaceAccess(generalAccess, workspaceLevel, inheritedWorkspaceLevel),
-        workspaceAccessInherited: inheritedWorkspaceLevel !== undefined,
-        // No direct rule to re-grade (inherited-only access), or an inherited
-        // SHARE pins the effective level — either way the dropdown is read-only.
-        workspaceLevelLocked: generalAccess !== "WORKSPACE" || inheritedWorkspaceLevel === "SHARE",
-        workspaceLevelSaving,
-        labels: effectiveLabels,
-        labelsResolved,
-        selectedLabelIdsByGrantee,
-        pendingGeneralAccess,
-        pendingGrantees,
-    }), [
+    // Sorted for display only; the overlay stays in write-through order, so
+    // add/rollback logic is unaffected. Memoized apart from the state assembly so
+    // the array identity changes only when the rows do, not on every state change.
+    const sortedGrantees = useMemo(() => sortGrantees(grantees), [grantees]);
+    const state = useMemo(() => {
+        // Row policy is classified here, not in the dialog, so a consumer
+        // injecting this controller into its own UI gets the same classification.
+        const selfManagedGranteeId = grantees.length === 1 && grantees[0].isSelf ? grantees[0].id : undefined;
+        const granteeControlsLocked = grantees.length === 1 && grantees[0].kind === "user" && !selfIdentityResolved;
+        // A workspace-wide share-capable rule (SHARE or EDIT) is the one way other
+        // than admin/manager rights through the manage gate — no Admin badge then.
+        const workspaceShareCapable = effectiveWorkspace.generalAccess === "WORKSPACE" && effectiveWorkspace.workspaceLevel !== "VIEW";
+        // The synthesized Admin row shows only while NO other permissions are set:
+        // the caller must have reached the list without a grant of their own
+        // (`seededWithoutSelfGrant` — a non-admin who locally removes their own
+        // grant must not gain the badge) and the list must currently be empty, so
+        // adding a grantee hides it and removing the last one brings it back.
+        const adminSelfRow = status === "success" &&
+            seededWithoutSelfGrant &&
+            grantees.length === 0 &&
+            !workspaceShareCapable &&
+            selfIdentity
+            ? userDisplayPair(selfIdentity, selfIdentity.id)
+            : undefined;
+        return {
+            subview,
+            status,
+            error: loadError,
+            summary,
+            grantees: sortedGrantees,
+            selfManagedGranteeId,
+            // Policy, not just classification: the caller's own sole row can't be
+            // raised above itself, an inherited workspace level can't be undercut.
+            selfManagedDisabledLevels: selfManagedGranteeId ? levelsAbove(grantees[0].level) : undefined,
+            workspaceDisabledLevels: workspaceInheritedLevel
+                ? levelsBelow(workspaceInheritedLevel)
+                : undefined,
+            granteeControlsLocked,
+            adminSelfRow,
+            ...effectiveWorkspace,
+            workspaceInheritedLevel: workspaceInheritedLevel,
+            workspaceLevelLocked: generalAccess !== "WORKSPACE" || workspaceInheritedLevel === "EDIT",
+            workspaceLevelSaving,
+            labels: effectiveLabels,
+            labelsResolved,
+            labelsInitializing,
+            selectedLabelIdsByGrantee,
+            pendingGeneralAccess,
+            pendingGrantees,
+        };
+    }, [
         subview,
         status,
         loadError,
-        accessUnavailable,
         summary,
-        targetKey,
         selfIdentity,
         selfIdentityResolved,
-        seededWithoutGrants,
+        seededWithoutSelfGrant,
         grantees,
+        sortedGrantees,
+        effectiveWorkspace,
         generalAccess,
-        workspaceLevel,
-        inheritedWorkspaceLevel,
+        workspaceInheritedLevel,
         workspaceLevelSaving,
         effectiveLabels,
         labelsResolved,
+        labelsInitializing,
         selectedLabelIdsByGrantee,
         pendingGeneralAccess,
         pendingGrantees,