@gooddata/sdk-ui-ext 11.52.0-alpha.6 → 11.52.0

package/esm/share/useLabelScope.js

@@ -2,8 +2,13 @@
 import { useCallback, useMemo, useState } from "react";
 import { useBackendStrict, useCancelablePromise, useWorkspaceStrict } from "@gooddata/sdk-ui";
 import { isPermissionsNotAvailable } from "./accessErrors.js";
-import { buildLabelMutationsForPrincipals, isGranteeGrantedIn, } from "./objectShareController.helpers.js";
-/** Pure: each grantee's in-scope label ids — primary always counts, others only where the grantee is granted. */
+import { buildLabelMutationsForScopes, buildLabelRegrades, granteeGrantIn, } from "./objectShareController.helpers.js";
+/**
+ * Pure: each grantee's in-scope label ids — primary always counts, others wherever
+ * the grantee holds the label, whether granted here or inherited. An inherited label
+ * is genuinely in scope: the grantee can read it, so the checklist must show it
+ * checked, exactly as the parent workspace shows it.
+ */
 function resolveScopes(results, committedGranteeIds) {
     const resolved = {};
     for (const id of committedGranteeIds) {
@@ -14,13 +19,52 @@ function resolveScopes(results, committedGranteeIds) {
             continue;
         }
         for (const id of committedGranteeIds) {
-            if (result.label.isPrimary || isGranteeGrantedIn(result.list, id)) {
+            if (result.label.isPrimary || granteeGrantIn(result.list, id)) {
                 resolved[id].push(result.label.id);
             }
         }
     }
     return resolved;
 }
+/**
+ * Pure: per-grantee label provenance, split by which question it answers. A label that is
+ * both granted here and inherited appears in BOTH maps, and that is the point — the two
+ * facts drive different decisions.
+ *
+ * - `inherited` — access survives revoking whatever this workspace granted, so the
+ *   checkbox stays checked and locked. Immutable for the session: no write from this
+ *   workspace can change a group's or a parent's grant, so deriving it from the probe
+ *   cannot go stale.
+ * - `direct` — granted HERE, so it is the only thing a write may target. This one DOES
+ *   change under our own writes, so the hook keeps it as an optimistic overlay seeded from
+ *   here rather than re-deriving it from a probe that runs once per session.
+ *
+ * The primary label is excluded from both: it is locked for every grantee regardless, and
+ * never written.
+ */
+function resolveLabelProvenance(results, committedGranteeIds) {
+    const inherited = {};
+    const direct = {};
+    for (const id of committedGranteeIds) {
+        inherited[id] = [];
+        direct[id] = [];
+    }
+    for (const result of results) {
+        if ("transient" in result || result.label.isPrimary) {
+            continue;
+        }
+        for (const id of committedGranteeIds) {
+            const grant = granteeGrantIn(result.list, id);
+            if (grant?.inherited) {
+                inherited[id].push(result.label.id);
+            }
+            if (grant?.direct) {
+                direct[id].push(result.label.id);
+            }
+        }
+    }
+    return { inherited, direct };
+}
 /**
  * Owns label-scope resolution + writes for {@link useObjectShareController}.
  * Resolves each grantee's scope by fetching every label's access list, tracks
@@ -41,6 +85,10 @@ export function useLabelScope(target, labels, hasList, committedGranteeIds, labe
     // a fresh add / labels edit must survive the backend's lagging re-read, so the
     // probe below only seeds grantees it doesn't already know.
     const [selectedLabelIdsByGrantee, setSelectedLabelIdsByGrantee] = useState({});
+    // Which labels THIS workspace grants each grantee. Optimistic for the same reason the
+    // scope is, and for a sharper one: our own revokes and grants change it, and the probe
+    // will not run again to notice.
+    const [directLabelIdsByGrantee, setDirectLabelIdsByGrantee] = useState({});
     // Whether the session's first probe has settled (see `labelsInitializing`) —
     // a fact about session history, so it is state, flipped once in onSuccess.
     const [everResolved, setEverResolved] = useState(false);
@@ -52,6 +100,7 @@ export function useLabelScope(target, labels, hasList, committedGranteeIds, labe
     if (seenLabelsKey !== labelsKey) {
         setSeenLabelsKey(labelsKey);
         setSelectedLabelIdsByGrantee({});
+        setDirectLabelIdsByGrantee({});
     }
     // Probe each label's access list to learn which are permissionable (some 404) and
     // which each grantee holds. `hasList` gates it: a list with no named grantees keeps
@@ -73,6 +122,7 @@ export function useLabelScope(target, labels, hasList, committedGranteeIds, labe
         onSuccess: (results) => {
             setEverResolved(true);
             const resolved = resolveScopes(results, committedGranteeIds);
+            const { direct } = resolveLabelProvenance(results, committedGranteeIds);
             // Seed only grantees we don't already have a scope for — an optimistic
             // scope is authoritative and must survive this re-resolution. Fired once
             // per resolution (onSuccess), so reading `prev` is safe.
@@ -83,6 +133,14 @@ export function useLabelScope(target, labels, hasList, committedGranteeIds, labe
                 }
                 return next;
             });
+            // Same rule for the direct set: what we wrote outranks what the probe read.
+            setDirectLabelIdsByGrantee((prev) => {
+                const next = {};
+                for (const id of committedGranteeIds) {
+                    next[id] = prev[id] ?? direct[id];
+                }
+                return next;
+            });
         },
     }, 
     // Keyed on the label set's stable string hash, not the array (rebuilt every
@@ -112,6 +170,30 @@ export function useLabelScope(target, labels, hasList, committedGranteeIds, labe
         }
         return permissionable;
     }, [labelLists]);
+    // Inheritance is the one fact no write from here can change, so it stays a pure
+    // derivation of the probe — there is no optimistic version of "someone else granted
+    // this", and nothing we do can make it stale.
+    const inheritedLabelIdsByGrantee = useMemo(() => (labelLists ? resolveLabelProvenance(labelLists, committedGranteeIds).inherited : {}), [labelLists, committedGranteeIds]);
+    const recordDirectLabelWrites = useCallback((granteeId, granted, revoked) => {
+        if (granted.length === 0 && revoked.length === 0) {
+            return;
+        }
+        setDirectLabelIdsByGrantee((prev) => {
+            const dropped = new Set(revoked);
+            const kept = (prev[granteeId] ?? []).filter((id) => !dropped.has(id));
+            return { ...prev, [granteeId]: Array.from(new Set([...kept, ...granted])) };
+        });
+    }, []);
+    const forgetGranteeLabels = useCallback((granteeId) => {
+        setSelectedLabelIdsByGrantee((prev) => {
+            const { [granteeId]: _scope, ...rest } = prev;
+            return rest;
+        });
+        setDirectLabelIdsByGrantee((prev) => {
+            const { [granteeId]: _direct, ...rest } = prev;
+            return rest;
+        });
+    }, []);
     // Only permissionable labels are scope-controllable; assume all until resolved.
     const effectiveLabels = useMemo(() => hasList && permissionableLabelIds
         ? labels.filter((l) => permissionableLabelIds.has(l.id))
@@ -137,8 +219,9 @@ export function useLabelScope(target, labels, hasList, committedGranteeIds, labe
     // drift. Writes settle independently (allSettled), and the failed labels are
     // reported by id — never collapsed into one boolean, or a partial failure would
     // roll callers back past writes that actually landed.
-    const reconcileLabelScope = useCallback(async (principals, desiredLabelIds, currentLabelIds) => {
-        const writes = buildLabelMutationsForPrincipals(principals, desiredLabelIds, currentLabelIds, effectiveLabels);
+    // Issues one manageObjectPermissions per label and reports the failures by id.
+    // Shared by the scope diff and the level re-grade so both settle identically.
+    const writeLabels = useCallback(async (writes) => {
         if (writes.length === 0) {
             return { ok: true, failedLabelIds: [] };
         }
@@ -148,13 +231,22 @@ export function useLabelScope(target, labels, hasList, committedGranteeIds, labe
             .filter((_, i) => results[i].status === "rejected")
             .map((w) => w.id);
         return { ok: failedLabelIds.length === 0, failedLabelIds };
-    }, [effectiveLabels, backend, workspace]);
+    }, [backend, workspace]);
+    const reconcileLabelScopes = useCallback((changes) => writeLabels(buildLabelMutationsForScopes(changes, effectiveLabels)), [effectiveLabels, writeLabels]);
+    const reconcileLabelScope = useCallback((principals, desiredLabelIds, currentLabelIds) => reconcileLabelScopes(principals.map((principal) => ({ principal, desiredLabelIds, currentLabelIds }))), [reconcileLabelScopes]);
+    const regradeLabelScope = useCallback((principals, scopeLabelIds) => writeLabels(buildLabelRegrades(principals, scopeLabelIds, effectiveLabels)), [effectiveLabels, writeLabels]);
     return {
         effectiveLabels,
         labelsResolved,
         labelsInitializing,
         selectedLabelIdsByGrantee,
         setSelectedLabelIdsByGrantee,
+        inheritedLabelIdsByGrantee,
+        directLabelIdsByGrantee,
+        recordDirectLabelWrites,
+        forgetGranteeLabels,
         reconcileLabelScope,
+        reconcileLabelScopes,
+        regradeLabelScope,
     };
 }

package/esm/share/useObjectShareController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useObjectShareController.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareController.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAiB1E,OAAO,EACH,KAAK,sBAAsB,EAI3B,KAAK,sBAAsB,EAE9B,MAAM,kCAAkC,CAAC;AAI1C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,sBAAsB,GACjC,sBAAsB,CA+kBxB"}
+{"version":3,"file":"useObjectShareController.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareController.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAkB1E,OAAO,EACH,KAAK,sBAAsB,EAI3B,KAAK,sBAAsB,EAE9B,MAAM,kCAAkC,CAAC;AAI1C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,sBAAsB,GACjC,sBAAsB,CAkxBxB"}

package/esm/share/useObjectShareController.js

@@ -3,7 +3,7 @@ import { useCallback, useMemo, useState } from "react";
 import { useToastMessage } from "@gooddata/sdk-ui-kit";
 import { composeEffectiveWorkspaceAccess } from "./accessSummary.js";
 import { objectShareMessages } from "./messages.js";
-import { EMPTY_IDS, NO_LABELS, granularGranteeFor, levelsAbove, levelsBelow, sortGrantees, toGranularGrantee, userDisplayPair, } from "./objectShareController.helpers.js";
+import { EMPTY_IDS, NO_LABELS, changesEffectiveLevel, granularGranteeFor, levelsAbove, levelsBelow, sortGrantees, toGranularGrantee, userDisplayPair, } from "./objectShareController.helpers.js";
 import { useAccessList } from "./useAccessList.js";
 import { useLabelScope } from "./useLabelScope.js";
 /**
@@ -35,7 +35,7 @@ export function useObjectShareController(target, options) {
     const [subview, setSubview] = useState("main");
     const [pendingGrantees, setPendingGrantees] = useState([]);
     const [pendingGeneralAccess, setPendingGeneralAccess] = useState(undefined);
-    const { hasList, grantees, seededWithoutSelfGrant, selfIdentity, selfIdentityResolved, generalAccess, workspaceLevel, workspaceInheritedLevel, workspaceLevelSaving, summary, status, loadError, commit, loadOptions, applyGranteeAdd, applyGranteeLevel, applyGranteeRemove, settleGranteeEdit, failGranteeEdit, applyRuleEdit, settleRuleEdit, failRuleEdit, } = useAccessList(target);
+    const { hasList, grantees, seededWithoutSelfGrant, selfIdentity, selfIdentityResolved, generalAccess, workspaceLevel, workspaceInheritedLevel, workspaceLevelSaving, summary, status, loadError, commit, loadOptions, applyGranteeAdd, applyGranteeLevel, applyGranteeLock, applyGranteeRemove, settleGranteeEdit, failGranteeEdit, applyRuleEdit, settleRuleEdit, failRuleEdit, } = useAccessList(target);
     // Grantee ids the label-scope probe resolves against — a removing row is excluded
     // so its scope is dropped, not re-seeded.
     const committedGranteeIds = useMemo(() => {
@@ -48,7 +48,16 @@ export function useObjectShareController(target, options) {
         return ids;
     }, [grantees]);
     // Per-label scope resolution + the single label-write path live in their own hook.
-    const { effectiveLabels, labelsResolved, labelsInitializing, selectedLabelIdsByGrantee, setSelectedLabelIdsByGrantee, reconcileLabelScope, } = useLabelScope(target, labels, hasList, committedGranteeIds, labelsError, labelsLoading);
+    const { effectiveLabels, labelsResolved, labelsInitializing, selectedLabelIdsByGrantee, setSelectedLabelIdsByGrantee, inheritedLabelIdsByGrantee, directLabelIdsByGrantee, recordDirectLabelWrites, forgetGranteeLabels, reconcileLabelScope, reconcileLabelScopes, regradeLabelScope, } = useLabelScope(target, labels, hasList, committedGranteeIds, labelsError, labelsLoading);
+    // The labels THIS workspace granted — the only ones a write may touch. Read straight
+    // from the tracked direct set rather than subtracting "inherited" from the scope: the
+    // subtraction relied on the probe still describing our own grants, and after a revoke it
+    // did not, so a later re-grade re-created access that had just been removed. A label
+    // held by inheritance ALONE is absent here, so no write can reach it: revoking one is a
+    // no-op whose compensation could mint a real grant, and re-grading one would invent one.
+    // A dual-granted label IS here — its local grant is ours to revoke and re-grade, or it
+    // would outlive the inherited grant hiding it.
+    const directLabelScopeOf = useCallback((granteeId) => new Set(directLabelIdsByGrantee[granteeId] ?? effectiveLabels.map((l) => l.id)), [directLabelIdsByGrantee, effectiveLabels]);
     // Effective access: the direct state composed with inherited rule access.
     // Also pins the level to VIEW while restricted, so the (hidden) dropdown
     // never shows a stale SHARE left over from a prior grant.
@@ -74,12 +83,12 @@ export function useObjectShareController(target, options) {
     // overlay, the revert and any toast beyond `commit`'s own.
     const applyAccessChange = useCallback(async (params) => {
         const { principal, objectMutation, successMessage, labelDesired, labelCurrent } = params;
-        const { ok: labelsOk } = await reconcileLabelScope([principal], labelDesired, labelCurrent);
+        const { ok: labelsOk, failedLabelIds } = await reconcileLabelScope([principal], labelDesired, labelCurrent);
         if (!labelsOk && params.abortIfLabelsFail) {
             // Don't write the object on a half-applied label scope: undo whatever
             // mirrored and surface the failure to the caller.
             await reconcileLabelScope([principal], labelCurrent, labelDesired);
-            return { ok: false, labelsOk: false };
+            return { ok: false, labelsOk: false, failedLabelIds };
         }
         const ok = await commit([objectMutation], successMessage);
         if (!ok) {
@@ -87,7 +96,10 @@ export function useObjectShareController(target, options) {
             // don't drift.
             await reconcileLabelScope([principal], labelCurrent, labelDesired);
         }
-        return { ok, labelsOk };
+        // The failed ids are reported, not just counted: a caller that keeps the row
+        // must keep those labels in its scope, or the local state would claim access
+        // the backend still grants and a later edit would diff against a lie.
+        return { ok, labelsOk, failedLabelIds };
     }, [commit, reconcileLabelScope]);
     // ── Grantee mutations (add / level / remove / labels) ────────────────────────
     const confirmAddGrantees = useCallback(async () => {
@@ -105,18 +117,30 @@ export function useObjectShareController(target, options) {
             name: g.name,
             email: g.email,
             level: g.permissionLevel,
+            // The add writes a grant in THIS workspace, so the new row holds a
+            // direct grant at the picked level — without it the row would read as
+            // inherited-only and its Remove would be (correctly) refused.
+            directLevel: g.permissionLevel,
         }));
         const mutations = pendingGrantees.map((g) => toGranularGrantee(g.kind, g.ref, g.permissionLevel));
-        // Default each new grantee to ALL labels (the picker's Add is gated until
-        // labels have loaded, so the set is known here). Reflect the full scope
-        // before the writes so the row shows it immediately.
+        // Each grantee is granted the label scope picked in the add dialog; an
+        // untouched picker leaves it undefined, which means ALL labels (the picker's
+        // Add is gated until labels have loaded, so the set is known here). The
+        // primary label is always in scope, exactly as `changeGranteeLabels` keeps it.
+        // Reflect each scope before the writes so the rows show them immediately.
         const allLabelIds = effectiveLabels.map((l) => l.id);
-        const allLabelIdSet = new Set(allLabelIds);
+        const primaryLabelIds = effectiveLabels.filter((l) => l.isPrimary).map((l) => l.id);
+        const scopeById = new Map(pendingGrantees.map((g) => [
+            g.id,
+            g.labelIds === undefined
+                ? allLabelIds
+                : Array.from(new Set([...g.labelIds, ...primaryLabelIds])),
+        ]));
         addedRows.forEach(applyGranteeAdd);
         setSelectedLabelIdsByGrantee((prev) => {
             const next = { ...prev };
             for (const id of addedIds) {
-                next[id] = allLabelIds;
+                next[id] = scopeById.get(id);
             }
             return next;
         });
@@ -134,19 +158,30 @@ export function useObjectShareController(target, options) {
             });
             return;
         }
-        // One label write per label carrying all added grantees, not one per grantee.
-        const principals = pendingGrantees.map((g) => ({ kind: g.kind, granteeRef: g.ref }));
-        const { ok: labelsOk, failedLabelIds } = await reconcileLabelScope(principals, allLabelIdSet, EMPTY_IDS);
+        // One label write per label carrying all added grantees, not one per grantee —
+        // even when their scopes differ, so a shared label stays a single call. Each
+        // label grant carries that grantee's picked level, so the label mirrors the
+        // object grant instead of landing on VIEW.
+        const { ok: labelsOk, failedLabelIds } = await reconcileLabelScopes(pendingGrantees.map((g) => ({
+            principal: { kind: g.kind, granteeRef: g.ref, level: g.permissionLevel },
+            desiredLabelIds: new Set(scopeById.get(g.id)),
+            currentLabelIds: EMPTY_IDS,
+        })));
+        const failed = new Set(failedLabelIds);
+        // Every label grant that landed is now a grant of OURS — record it, or a later
+        // removal would not know to revoke it.
+        for (const id of addedIds) {
+            recordDirectLabelWrites(id, scopeById.get(id).filter((labelId) => !failed.has(labelId)), []);
+        }
         if (!labelsOk) {
             toast.addWarning(objectShareMessages.toastLabelScopePartial);
-            // Drop only the failed labels, keeping those that landed — otherwise local
-            // scope under-reports and changeGranteeLabels later skips their revokes.
-            const failed = new Set(failedLabelIds);
-            const survived = allLabelIds.filter((id) => !failed.has(id));
+            // Drop only the failed labels from each grantee's own scope, keeping those
+            // that landed — otherwise local scope under-reports and changeGranteeLabels
+            // later skips their revokes.
             setSelectedLabelIdsByGrantee((prev) => {
                 const next = { ...prev };
                 for (const id of addedIds) {
-                    next[id] = survived;
+                    next[id] = scopeById.get(id).filter((labelId) => !failed.has(labelId));
                 }
                 return next;
             });
@@ -161,7 +196,8 @@ export function useObjectShareController(target, options) {
         commit,
         closeAddGrantee,
         effectiveLabels,
-        reconcileLabelScope,
+        reconcileLabelScopes,
+        recordDirectLabelWrites,
         toast,
         applyGranteeAdd,
         settleGranteeEdit,
@@ -170,23 +206,83 @@ export function useObjectShareController(target, options) {
     ]);
     const changePermissionLevel = useCallback(async (granteeId, level) => {
         const grantee = grantees.find((g) => g.id === granteeId);
-        if (!grantee || grantee.level === level || grantee.pending) {
+        // A pick that cannot move the effective level is refused rather than quietly
+        // strengthening the grant made here — the rule lives in `changesEffectiveLevel`
+        // so every reaction to a pick agrees, and no confirm is staged for a no-op.
+        // Also refused before the label scope resolves: the re-grade below would run
+        // over the assumed-all fallback and mint grants the grantee never held. The
+        // UI gates on the same fact (isMutable); the controller stays authoritative.
+        if (!grantee || grantee.pending || !labelsResolved || !changesEffectiveLevel(grantee, level)) {
             return;
         }
         applyGranteeLevel(granteeId, level);
+        // A label grant is an independent access-list entry carrying its own
+        // level, so re-grading the object alone would leave the grantee's labels
+        // at the level they were granted at.
+        //
+        // Order so a label grant is never left above the object grant: lower the
+        // labels BEFORE lowering the object, and raise the object BEFORE raising
+        // the labels. Either way a failure leaves labels no broader than the
+        // object, and a failed object write puts the labels back.
+        const previousLevel = grantee.directLevel ?? grantee.level;
+        const lowering = levelsBelow(previousLevel).includes(level);
+        const scope = directLabelScopeOf(granteeId);
+        const regradeLabels = (to) => regradeLabelScope([{ kind: grantee.kind, granteeRef: grantee.granteeRef, level: to }], scope);
+        let labelsOk = true;
+        if (lowering) {
+            labelsOk = (await regradeLabels(level)).ok;
+            if (!labelsOk) {
+                // A label that kept the old, HIGHER level while the object dropped
+                // would leave label access above object access — the one state this
+                // ordering exists to prevent. So abort: put every in-scope label back
+                // and leave the object alone. Same all-or-nothing policy the
+                // general-access change applies to its label mirror.
+                await regradeLabels(previousLevel);
+                failGranteeEdit(granteeId);
+                toast.addError(objectShareMessages.toastError);
+                return;
+            }
+        }
         const ok = await commit([toGranularGrantee(grantee.kind, grantee.granteeRef, level)], objectShareMessages.toastAccessUpdated);
         // The settled entry persists on success (base still holds the old level);
         // failure restores the last committed entry, or the fetched row.
-        if (ok) {
-            settleGranteeEdit(granteeId);
-        }
-        else {
+        if (!ok) {
+            if (lowering) {
+                await regradeLabels(previousLevel);
+            }
             failGranteeEdit(granteeId);
+            return;
+        }
+        if (!lowering) {
+            labelsOk = (await regradeLabels(level)).ok;
+        }
+        settleGranteeEdit(granteeId);
+        if (!labelsOk) {
+            // The object level changed but some labels kept the old one — warn so
+            // the partial state isn't mistaken for success.
+            toast.addWarning(objectShareMessages.toastLabelScopePartial);
         }
-    }, [grantees, commit, applyGranteeLevel, settleGranteeEdit, failGranteeEdit]);
+    }, [
+        grantees,
+        labelsResolved,
+        commit,
+        directLabelScopeOf,
+        regradeLabelScope,
+        toast,
+        applyGranteeLevel,
+        settleGranteeEdit,
+        failGranteeEdit,
+    ]);
     const removeGrantee = useCallback(async (granteeId) => {
         const grantee = grantees.find((g) => g.id === granteeId);
-        if (!grantee || grantee.pending) {
+        // Only a grant made in THIS workspace can be revoked here. With access
+        // inherited-only (a group, or a parent workspace) there is nothing local
+        // to revoke: the write would be an empty-permissions no-op that the row
+        // then reported as removed. The menu also disables Remove in that case;
+        // this keeps the controller — not the UI — authoritative. Same for an
+        // unresolved label scope: the revoke below would run over the assumed-all
+        // fallback and revoke (then compensate with) grants that never existed.
+        if (!grantee || grantee.pending || !labelsResolved || grantee.directLevel === undefined) {
             return;
         }
         // Mark the row removed but keep it visible (muted) until the write lands.
@@ -198,12 +294,20 @@ export function useObjectShareController(target, options) {
         // the grantee didn't hold. The object revoke is what matters; a label
         // revoke that fails is non-fatal (surfaced as a warning), so don't abort
         // on it.
-        const { ok, labelsOk } = await applyAccessChange({
-            principal: { kind: grantee.kind, granteeRef: grantee.granteeRef },
+        const { ok, labelsOk, failedLabelIds } = await applyAccessChange({
+            // The level matters only for the compensating re-grant if the object
+            // revoke fails: without it the labels would come back at the default
+            // VIEW, quietly downgrading an EDIT/SHARE grantee we just failed to
+            // remove.
+            principal: {
+                kind: grantee.kind,
+                granteeRef: grantee.granteeRef,
+                level: grantee.directLevel,
+            },
             objectMutation: toGranularGrantee(grantee.kind, grantee.granteeRef, "none"),
             successMessage: objectShareMessages.toastAccessUpdated,
             labelDesired: EMPTY_IDS,
-            labelCurrent: new Set(selectedLabelIdsByGrantee[granteeId] ?? effectiveLabels.map((l) => l.id)),
+            labelCurrent: directLabelScopeOf(granteeId),
             abortIfLabelsFail: false,
         });
         if (!ok) {
@@ -215,10 +319,37 @@ export function useObjectShareController(target, options) {
         // Object revoke landed. For a fetched row the settled `removed` entry
         // persists to keep it hidden; a revoked overlay-born row drops entirely.
         settleGranteeEdit(granteeId);
-        setSelectedLabelIdsByGrantee((prev) => {
-            const { [granteeId]: _omit, ...rest } = prev;
-            return rest;
-        });
+        // Every local label grant is gone except the ones whose revoke failed — record
+        // that, so a later write on a surviving row cannot act on grants we removed.
+        const revokedIds = [...directLabelScopeOf(granteeId)].filter((id) => !failedLabelIds.includes(id));
+        recordDirectLabelWrites(granteeId, [], revokedIds);
+        if (grantee.inheritedLevel === undefined) {
+            // Row is gone for good; drop its bookkeeping — unless a label revoke
+            // failed. The direct set is then the ONLY record that the label is still
+            // granted (the probe never re-runs), and forgetting it would let the
+            // grant outlive a same-session re-add: reseeded from the new writes
+            // alone, no later diff would ever revoke it.
+            if (failedLabelIds.length === 0) {
+                forgetGranteeLabels(granteeId);
+            }
+        }
+        else {
+            // A grantee who also inherits survives as an inherited-only row, so its
+            // scope must survive too — narrowed to what the removal could not take away.
+            // Dropping the entry would fall back to "all labels" (the probe does not
+            // re-run for grantee changes) and overstate what they can reach. Any label
+            // whose revoke FAILED stays in: the backend still grants it.
+            setSelectedLabelIdsByGrantee((prev) => {
+                const keep = new Set([
+                    ...(inheritedLabelIdsByGrantee[granteeId] ?? []),
+                    ...failedLabelIds,
+                ]);
+                const survivingIds = effectiveLabels
+                    .filter((l) => l.isPrimary || keep.has(l.id))
+                    .map((l) => l.id);
+                return { ...prev, [granteeId]: survivingIds };
+            });
+        }
         if (!labelsOk) {
             // Object access is gone but some per-label grants couldn't be
             // revoked — warn so the leftover scope isn't mistaken for success.
@@ -226,9 +357,13 @@ export function useObjectShareController(target, options) {
         }
     }, [
         grantees,
+        labelsResolved,
         applyAccessChange,
+        directLabelScopeOf,
+        recordDirectLabelWrites,
+        forgetGranteeLabels,
         effectiveLabels,
-        selectedLabelIdsByGrantee,
+        inheritedLabelIdsByGrantee,
         toast,
         applyGranteeRemove,
         settleGranteeEdit,
@@ -237,27 +372,54 @@ export function useObjectShareController(target, options) {
     ]);
     const changeGranteeLabels = useCallback(async (granteeId, requested) => {
         const grantee = grantees.find((g) => g.id === granteeId);
-        if (!grantee || grantee.pending || !target) {
+        // Refused before the label scope resolves — the diff below would otherwise
+        // run against the assumed-all fallback (the UI gates on the same fact via
+        // `isMutable`; the controller stays authoritative).
+        if (!grantee || grantee.pending || !labelsResolved || !target) {
             return;
         }
-        // Primary label is always in scope; never let it be dropped.
+        // The primary label is always in scope, and so is a label the grantee only
+        // inherits: there is no local grant to revoke, so dropping it would report
+        // access removed that this workspace cannot reach. The checklist locks both;
+        // this keeps the controller — not the UI — authoritative.
         const primaryIds = effectiveLabels.filter((l) => l.isPrimary).map((l) => l.id);
-        const nextScope = Array.from(new Set([...requested, ...primaryIds]));
+        const inheritedIds = inheritedLabelIdsByGrantee[granteeId] ?? [];
+        const nextScope = Array.from(new Set([...requested, ...primaryIds, ...inheritedIds]));
         const currentScope = selectedLabelIdsByGrantee[granteeId] ?? effectiveLabels.map((l) => l.id);
         const desired = new Set(nextScope);
-        const current = new Set(currentScope);
+        // Inherited labels join the CURRENT side too: an add-path scope is seeded
+        // before inheritance is known for the new row, so without this an untouched
+        // Apply would diff an inherited label as newly checked and grant it locally.
+        const current = new Set([...currentScope, ...inheritedIds]);
         // Applying the checklist unchanged is a no-op — don't lock the row or
         // toast success over zero writes.
         if (desired.size === current.size && nextScope.every((id) => current.has(id))) {
             return;
         }
         // Reflect the new scope immediately and lock the row until the writes
-        // settle — an overlapping label edit or removal would race these writes
-        // on the same labels. The lock reuses the level overlay at the unchanged
-        // level; pending is the only fact it adds.
-        applyGranteeLevel(granteeId, grantee.level);
+        // settle — an overlapping label edit or removal would race these writes on
+        // the same labels. A lock-only overlay, because this changes no object
+        // access: re-applying the displayed level would persist the EFFECTIVE level
+        // as this row's direct grant, so an inherited EDIT over a direct VIEW would
+        // become a local EDIT after any label edit.
+        applyGranteeLock(granteeId);
         setSelectedLabelIdsByGrantee((prev) => ({ ...prev, [granteeId]: nextScope }));
-        const { ok, failedLabelIds } = await reconcileLabelScope([{ kind: grantee.kind, granteeRef: grantee.granteeRef }], desired, current);
+        // Labels newly brought into scope are granted at the level the grantee
+        // holds on the object — with no grant of their own here (inherited-only
+        // access) there is no level to mirror, so VIEW stands.
+        const { ok, failedLabelIds } = await reconcileLabelScope([
+            {
+                kind: grantee.kind,
+                granteeRef: grantee.granteeRef,
+                level: grantee.directLevel ?? "VIEW",
+            },
+        ], desired, current);
+        // Record what the writes actually did to OUR grants: a label brought into scope
+        // gains one, a label dropped loses one. Only over the labels this workspace could
+        // write — an inherited-only label is absent from the diff either way.
+        const failedIds = new Set(failedLabelIds);
+        const writable = directLabelScopeOf(granteeId);
+        recordDirectLabelWrites(granteeId, nextScope.filter((id) => !current.has(id) && !failedIds.has(id)), currentScope.filter((id) => writable.has(id) && !desired.has(id) && !failedIds.has(id)));
         if (ok) {
             settleGranteeEdit(granteeId);
             toast.addSuccess(objectShareMessages.toastAccessUpdated);
@@ -281,11 +443,15 @@ export function useObjectShareController(target, options) {
     }, [
         grantees,
         target,
+        labelsResolved,
         effectiveLabels,
         selectedLabelIdsByGrantee,
+        inheritedLabelIdsByGrantee,
+        directLabelScopeOf,
+        recordDirectLabelWrites,
         reconcileLabelScope,
         toast,
-        applyGranteeLevel,
+        applyGranteeLock,
         settleGranteeEdit,
         failGranteeEdit,
         setSelectedLabelIdsByGrantee,
@@ -479,6 +645,7 @@ export function useObjectShareController(target, options) {
             labelsResolved,
             labelsInitializing,
             selectedLabelIdsByGrantee,
+            inheritedLabelIdsByGrantee,
             pendingGeneralAccess,
             pendingGrantees,
         };
@@ -500,6 +667,7 @@ export function useObjectShareController(target, options) {
         labelsResolved,
         labelsInitializing,
         selectedLabelIdsByGrantee,
+        inheritedLabelIdsByGrantee,
         pendingGeneralAccess,
         pendingGrantees,
     ]);

package/esm/share/useObjectShareDialog.d.ts

@@ -44,6 +44,13 @@ export interface IObjectShareDialogViewModel {
      * for the signed-in user's own sole grant, undefined for every other row.
      */
     rowDisabledLevels: (grantee: IObjectShareGrantee) => ObjectSharePermissionLevel[] | undefined;
+    /**
+     * Whether Remove access must render disabled: the grantee holds no grant in this
+     * workspace, so there is nothing here to revoke (their access is inherited).
+     */
+    isRowRemoveDisabled: (grantee: IObjectShareGrantee) => boolean;
+    /** Tooltip explaining why Remove access is disabled on this row. */
+    rowRemoveDisabledTooltip: string;
     /** Close the whole dialog, discarding any staged self-restriction. */
     onClose: () => void;
     /**

package/esm/share/useObjectShareDialog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useObjectShareDialog.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareDialog.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAE1E,OAAO,EACH,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAClC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAY1E;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IACxC,yFAAyF;IACzF,KAAK,EAAE,2BAA2B,CAAC;IACnC,yEAAyE;IACzE,OAAO,EAAE,6BAA6B,CAAC;IAEvC,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4EAA0E;IAC1E,0BAA0B,EAAE,OAAO,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,EAAE,OAAO,CAAC;IAEnC;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB,kGAAkG;IAClG,uBAAuB,EAAE,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAClE;;;OAGG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAE9F,sEAAsE;IACtE,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB;;;OAGG;IACH,qBAAqB,EAAE,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACjG,qGAAqG;IACrG,WAAW,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACpD,qFAAqF;IACrF,oBAAoB,EAAE,MAAM,IAAI,CAAC;IACjC,+FAA6F;IAC7F,qBAAqB,EAAE,MAAM,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,UAAU,2BAA2B;IACjC,wFAAsF;IACtF,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC7C,oGAAoG;IACpG,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,mFAAmF;IACnF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC1D,2FAA2F;IAC3F,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iGAAiG;IACjG,WAAW,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EACjC,MAAM,EACN,OAAO,EACP,eAAe,EACf,MAAM,EACN,aAAa,EACb,WAAW,EACd,EAAE,2BAA2B,GAAG,2BAA2B,CAwF3D"}
+{"version":3,"file":"useObjectShareDialog.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareDialog.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAI1E,OAAO,EACH,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAClC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAY1E;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IACxC,yFAAyF;IACzF,KAAK,EAAE,2BAA2B,CAAC;IACnC,yEAAyE;IACzE,OAAO,EAAE,6BAA6B,CAAC;IAEvC,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4EAA0E;IAC1E,0BAA0B,EAAE,OAAO,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,EAAE,OAAO,CAAC;IAEnC;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB,kGAAkG;IAClG,uBAAuB,EAAE,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAClE;;;OAGG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAC9F;;;OAGG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAC/D,oEAAoE;IACpE,wBAAwB,EAAE,MAAM,CAAC;IAEjC,sEAAsE;IACtE,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB;;;OAGG;IACH,qBAAqB,EAAE,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACjG,qGAAqG;IACrG,WAAW,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACpD,qFAAqF;IACrF,oBAAoB,EAAE,MAAM,IAAI,CAAC;IACjC,+FAA6F;IAC7F,qBAAqB,EAAE,MAAM,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,UAAU,2BAA2B;IACjC,wFAAsF;IACtF,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC7C,oGAAoG;IACpG,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,mFAAmF;IACnF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC1D,2FAA2F;IAC3F,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iGAAiG;IACjG,WAAW,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EACjC,MAAM,EACN,OAAO,EACP,eAAe,EACf,MAAM,EACN,aAAa,EACb,WAAW,EACd,EAAE,2BAA2B,GAAG,2BAA2B,CA6G3D"}