@gooddata/sdk-ui-ext 11.61.0-alpha.2 → 11.61.0-alpha.4

package/esm/share/useObjectShareController.js

@@ -6,6 +6,19 @@ import { objectShareMessages } from "./messages.js";
 import { EMPTY_IDS, NO_LABELS, changesEffectiveLevel, granularGranteeFor, levelsAbove, levelsBelow, mergeDisabledLevels, sortGrantees, toGranularGrantee, } from "./objectShareController.helpers.js";
 import { useAccessList } from "./useAccessList.js";
 import { useLabelScope } from "./useLabelScope.js";
+function resolveRoleAccess({ loaded, isWorkspaceManager, canManageVisualizations, kind, callerLevel, }) {
+    if (!loaded) {
+        return undefined;
+    }
+    if (isWorkspaceManager) {
+        return "workspaceManager";
+    }
+    // The backend's EDIT is required too: inherited visualizations stay view-only for a holder.
+    if (canManageVisualizations && kind === "insight" && callerLevel === "EDIT") {
+        return "visualizationManager";
+    }
+    return undefined;
+}
 /**
  * Manages the share-dialog state and backend I/O for ONE dialog session: the hook
  * is mounted while the dialog is open, for a single target that must not change
@@ -35,7 +48,15 @@ export function useObjectShareController(target, options) {
     const [subview, setSubview] = useState("main");
     const [pendingGrantees, setPendingGrantees] = useState([]);
     const [pendingGeneralAccess, setPendingGeneralAccess] = useState(undefined);
-    const { hasList, grantees, isWorkspaceManager, selfIdentityResolved, generalAccess, workspaceLevel, workspaceInheritedLevel, workspaceLevelSaving, summary, status, loadError, commit, loadOptions, applyGranteeAdd, applyGranteeLevel, applyGranteeLock, applyGranteeRemove, settleGranteeEdit, failGranteeEdit, applyRuleEdit, settleRuleEdit, failRuleEdit, draft: draftValue, } = useAccessList(target, { draft, initialDraft, initialDraftGeneralAccess });
+    const { hasList, grantees, isWorkspaceManager, canManageVisualizations, callerLevel, selfIdentityResolved, generalAccess, workspaceLevel, workspaceInheritedLevel, workspaceLevelSaving, summary, status, loadError, commit, loadOptions, applyGranteeAdd, applyGranteeLevel, applyGranteeLock, applyGranteeRemove, settleGranteeEdit, failGranteeEdit, applyRuleEdit, settleRuleEdit, failRuleEdit, draft: draftValue, } = useAccessList(target, { draft, initialDraft, initialDraftGeneralAccess });
+    const roleAccess = resolveRoleAccess({
+        loaded: !draft && status === "success",
+        isWorkspaceManager,
+        canManageVisualizations,
+        kind: target?.kind,
+        callerLevel,
+    });
+    const roleLockedGranteeId = roleAccess === "visualizationManager" ? grantees.find((g) => g.isSelf)?.id : undefined;
     // Grantee ids the label-scope probe resolves against — a removing row is excluded
     // so its scope is dropped, not re-seeded.
     const committedGranteeIds = useMemo(() => {
@@ -218,7 +239,11 @@ export function useObjectShareController(target, options) {
         // Also refused before the label scope resolves: the re-grade below would run
         // over the assumed-all fallback and mint grants the grantee never held. The
         // UI gates on the same fact (isMutable); the controller stays authoritative.
-        if (!grantee || grantee.pending || !labelsResolved || !changesEffectiveLevel(grantee, level)) {
+        if (!grantee ||
+            grantee.pending ||
+            !labelsResolved ||
+            granteeId === roleLockedGranteeId ||
+            !changesEffectiveLevel(grantee, level)) {
             return;
         }
         applyGranteeLevel(granteeId, level);
@@ -278,6 +303,7 @@ export function useObjectShareController(target, options) {
         applyGranteeLevel,
         settleGranteeEdit,
         failGranteeEdit,
+        roleLockedGranteeId,
     ]);
     const removeGrantee = useCallback(async (granteeId) => {
         const grantee = grantees.find((g) => g.id === granteeId);
@@ -288,7 +314,11 @@ export function useObjectShareController(target, options) {
         // this keeps the controller — not the UI — authoritative. Same for an
         // unresolved label scope: the revoke below would run over the assumed-all
         // fallback and revoke (then compensate with) grants that never existed.
-        if (!grantee || grantee.pending || !labelsResolved || grantee.directLevel === undefined) {
+        if (!grantee ||
+            grantee.pending ||
+            !labelsResolved ||
+            grantee.directLevel === undefined ||
+            granteeId === roleLockedGranteeId) {
             return;
         }
         // Mark the row removed but keep it visible (muted) until the write lands.
@@ -375,6 +405,7 @@ export function useObjectShareController(target, options) {
         settleGranteeEdit,
         failGranteeEdit,
         setSelectedLabelIdsByGrantee,
+        roleLockedGranteeId,
     ]);
     const changeGranteeLabels = useCallback(async (granteeId, requested) => {
         const grantee = grantees.find((g) => g.id === granteeId);
@@ -607,7 +638,7 @@ export function useObjectShareController(target, options) {
     // Sorted for display only; the overlay stays in write-through order, so
     // add/rollback logic is unaffected. Memoized apart from the state assembly so
     // the array identity changes only when the rows do, not on every state change.
-    const sortedGrantees = useMemo(() => sortGrantees(grantees), [grantees]);
+    const sortedGrantees = useMemo(() => sortGrantees(grantees).map((g) => g.id === roleLockedGranteeId ? { ...g, level: "EDIT", effectivePermission: undefined } : g), [grantees, roleLockedGranteeId]);
     const state = useMemo(() => {
         // Row policy is classified here, not in the dialog, so a consumer
         // injecting this controller into its own UI gets the same classification.
@@ -615,22 +646,18 @@ export function useObjectShareController(target, options) {
         // it special is that the access is THEIRS. A manager is exempt, their access
         // comes from the role, so there is no ceiling to cap and no lockout to warn of.
         const ownRow = grantees.find((g) => g.isSelf);
-        const selfRow = isWorkspaceManager ? undefined : ownRow;
+        const selfRow = isWorkspaceManager || roleLockedGranteeId ? undefined : ownRow;
         const selfManagedGranteeId = selfRow?.id;
-        // The caller cannot grant above what they hold, and the server refuses such a
-        // write. Proven from their own row only: with no row their access may come from
-        // a group, which the list does not report, so capping would block a real holder.
-        // A manager has no limit, and an UNKNOWN manager status must not produce one
-        // either: unlike the confirm, a limit that guesses wrong blocks a legitimate
-        // grant, and a failed permission read would make that permanent.
-        // `=== false`, not `!isWorkspaceManager`: an unread permission must not produce a
-        // limit, or a failed read would block a caller the backend would allow.
-        const grantableDisabledLevels = isWorkspaceManager === false && selfRow ? levelsAbove(selfRow.level) : undefined;
+        // The caller cannot grant above what they hold, and the server refuses such a write.
+        // The backend's own answer covers groups, parent workspaces and workspace permissions.
+        // Without it, only the caller's own row proves a level, and only for a known
+        // non-manager: a limit that guesses wrong would block a grant the backend allows.
+        const grantableDisabledLevels = callerLevel === undefined
+            ? isWorkspaceManager === false && selfRow
+                ? levelsAbove(selfRow.level)
+                : undefined
+            : levelsAbove(callerLevel);
         const granteeControlsLocked = !selfIdentityResolved && !isWorkspaceManager && grantees.some((g) => g.kind === "user");
-        // Policy in `IObjectShareControllerState.showAdminAccessNote`: role-based access is
-        // explained by a note, not a grantee row, so it does not depend on the caller having
-        // (or lacking) a row of their own.
-        const showAdminAccessNote = !draft && status === "success" && isWorkspaceManager === true;
         return {
             subview,
             status,
@@ -640,11 +667,13 @@ export function useObjectShareController(target, options) {
             selfManagedGranteeId,
             // Policy, not just classification: the caller's own row can't be raised
             // above itself, an inherited workspace level can't be undercut.
-            selfManagedDisabledLevels: selfRow ? levelsAbove(selfRow.level) : undefined,
+            selfManagedDisabledLevels: selfRow ? levelsAbove(callerLevel ?? selfRow.level) : undefined,
             workspaceDisabledLevels: mergeDisabledLevels(workspaceInheritedLevel ? levelsBelow(workspaceInheritedLevel) : undefined, grantableDisabledLevels),
             grantableDisabledLevels,
+            callerLevel,
             granteeControlsLocked,
-            showAdminAccessNote,
+            roleAccess,
+            roleLockedGranteeId,
             ...effectiveWorkspace,
             workspaceInheritedLevel: workspaceInheritedLevel,
             workspaceLevelLocked: generalAccess !== "WORKSPACE" || workspaceInheritedLevel === "EDIT",
@@ -664,7 +693,9 @@ export function useObjectShareController(target, options) {
         summary,
         selfIdentityResolved,
         isWorkspaceManager,
-        draft,
+        roleAccess,
+        roleLockedGranteeId,
+        callerLevel,
         grantees,
         sortedGrantees,
         effectiveWorkspace,

package/esm/share/useObjectShareDialog.d.ts

@@ -57,7 +57,9 @@ export interface IObjectShareDialogViewModel {
      */
     isRowRemoveDisabled: (grantee: IObjectShareGrantee) => boolean;
     /** Tooltip explaining why Remove access is disabled on this row. */
-    rowRemoveDisabledTooltip: string;
+    rowRemoveDisabledTooltip: (grantee: IObjectShareGrantee) => string;
+    /** Whether this row's direct grant is above the caller's level, so nothing on it may change. */
+    isRowAboveCaller: (grantee: IObjectShareGrantee) => boolean;
     /** Whether this row's controls must stay disabled (see `granteeControlsLocked`). */
     isRowControlsLocked: (grantee: IObjectShareGrantee) => boolean;
     /** Close the whole dialog, handing the draft over and discarding any staged self-restriction. */

package/esm/share/useObjectShareDialog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useObjectShareDialog.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareDialog.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAQ/D,OAAO,KAAK,EACR,6BAA6B,EAC7B,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAsB1E;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IACxC,yFAAyF;IACzF,KAAK,EAAE,2BAA2B,CAAC;IACnC,yEAAyE;IACzE,OAAO,EAAE,6BAA6B,CAAC;IAEvC,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,0BAA0B,EAAE,OAAO,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,EAAE,OAAO,CAAC;IAEnC;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB,kGAAkG;IAClG,uBAAuB,EAAE,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAClE;;;OAGG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAC9F,2EAA2E;IAC3E,wBAAwB,EAAE,CACtB,OAAO,EAAE,mBAAmB,KAC3B,OAAO,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACrE,wFAAwF;IACxF,uBAAuB,EAAE,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAClE,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAC/D,oEAAoE;IACpE,wBAAwB,EAAE,MAAM,CAAC;IACjC,oFAAoF;IACpF,mBAAmB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAE/D,iGAAiG;IACjG,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB;;;OAGG;IACH,qBAAqB,EAAE,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACjG,qGAAqG;IACrG,WAAW,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACpD,qFAAqF;IACrF,oBAAoB,EAAE,MAAM,IAAI,CAAC;IACjC,6FAA6F;IAC7F,qBAAqB,EAAE,MAAM,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,UAAU,2BAA2B;IACjC,sFAAsF;IACtF,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC7C,oGAAoG;IACpG,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,mFAAmF;IACnF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC1D,2FAA2F;IAC3F,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iGAAiG;IACjG,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wFAAwF;IACxF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yEAAyE;IACzE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACnD,2DAA2D;IAC3D,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,iFAAiF;IACjF,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EACjC,MAAM,EACN,OAAO,EACP,eAAe,EACf,KAAK,EACL,aAAa,EACb,YAAY,EACZ,yBAAyB,EACzB,MAAM,EACN,aAAa,EACb,WAAW,GACd,EAAE,2BAA2B,GAAG,2BAA2B,CAmK3D"}
+{"version":3,"file":"useObjectShareDialog.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareDialog.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAU/D,OAAO,KAAK,EACR,6BAA6B,EAC7B,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAsB1E;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IACxC,yFAAyF;IACzF,KAAK,EAAE,2BAA2B,CAAC;IACnC,yEAAyE;IACzE,OAAO,EAAE,6BAA6B,CAAC;IAEvC,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,0BAA0B,EAAE,OAAO,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,EAAE,OAAO,CAAC;IAEnC;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB,kGAAkG;IAClG,uBAAuB,EAAE,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAClE;;;OAGG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAC9F,2EAA2E;IAC3E,wBAAwB,EAAE,CACtB,OAAO,EAAE,mBAAmB,KAC3B,OAAO,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACrE,wFAAwF;IACxF,uBAAuB,EAAE,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAClE,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAC/D,oEAAoE;IACpE,wBAAwB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,MAAM,CAAC;IACnE,gGAAgG;IAChG,gBAAgB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAC5D,oFAAoF;IACpF,mBAAmB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAE/D,iGAAiG;IACjG,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB;;;OAGG;IACH,qBAAqB,EAAE,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACjG,qGAAqG;IACrG,WAAW,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACpD,qFAAqF;IACrF,oBAAoB,EAAE,MAAM,IAAI,CAAC;IACjC,6FAA6F;IAC7F,qBAAqB,EAAE,MAAM,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,UAAU,2BAA2B;IACjC,sFAAsF;IACtF,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC7C,oGAAoG;IACpG,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,mFAAmF;IACnF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC1D,2FAA2F;IAC3F,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iGAAiG;IACjG,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wFAAwF;IACxF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yEAAyE;IACzE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACnD,2DAA2D;IAC3D,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,iFAAiF;IACjF,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EACjC,MAAM,EACN,OAAO,EACP,eAAe,EACf,KAAK,EACL,aAAa,EACb,YAAY,EACZ,yBAAyB,EACzB,MAAM,EACN,aAAa,EACb,WAAW,GACd,EAAE,2BAA2B,GAAG,2BAA2B,CA0N3D"}

package/esm/share/useObjectShareDialog.js

@@ -2,7 +2,7 @@
 import { useCallback, useEffect, useState } from "react";
 import { useIntl } from "react-intl";
 import { objectShareMessages } from "./messages.js";
-import { changesEffectiveLevel, levelsBelow, removalChangesEffectiveLevel, } from "./objectShareController.helpers.js";
+import { ALL_LEVELS, changesEffectiveLevel, levelsAbove, levelsBelow, removalChangesEffectiveLevel, } from "./objectShareController.helpers.js";
 import { useObjectShareController } from "./useObjectShareController.js";
 /**
  * Level picks an inherited grant already covers, which the controller refuses as
@@ -54,9 +54,10 @@ export function useObjectShareDialog({ target, onClose, onSummaryChange, draft,
         onClose();
     }, [currentDraft, onDraftChange, onClose]);
     // A row belongs to the signed-in user's own sole grant when the controller has
-    // classified it as self-managed — those changes route through the confirm.
+    // classified it as self-managed — lowering it routes through the confirm, raising it
+    // (allowed when a group grants more) commits directly.
     const onRowPermissionChange = useCallback((grantee, level) => {
-        if (state.selfManagedGranteeId === grantee.id) {
+        if (state.selfManagedGranteeId === grantee.id && levelsBelow(grantee.level).includes(level)) {
             // Stage the confirm only for a pick that would really move the level the
             // user effectively holds. Comparing against the displayed level instead
             // opened "Restrict your access?" for a pick under an inherited floor, which
@@ -95,7 +96,34 @@ export function useObjectShareDialog({ target, onClose, onSummaryChange, draft,
     }, [pendingSelfChange, actions]);
     const onSelfRestrictCancel = useCallback(() => setPendingSelfChange(undefined), []);
     const inheritedCoveredTooltip = intl.formatMessage(objectShareMessages.granteeLevelInheritedCovered);
+    // The server refuses changing or removing a grant above the caller's own level.
+    const isRowAboveCaller = useCallback((grantee) => state.callerLevel !== undefined &&
+        grantee.directLevel !== undefined &&
+        levelsAbove(state.callerLevel).includes(grantee.directLevel), [state.callerLevel]);
+    const coveredByWorkspacePermissionTooltip = intl.formatMessage(objectShareMessages.granteeCoveredByWorkspacePermission);
+    const aboveCallerUserTooltip = intl.formatMessage(objectShareMessages.granteeAboveCallerUser);
+    const aboveCallerGroupTooltip = intl.formatMessage(objectShareMessages.granteeAboveCallerGroup);
+    const rowLock = useCallback((grantee) => {
+        if (isRowAboveCaller(grantee)) {
+            const tooltip = grantee.kind === "group" ? aboveCallerGroupTooltip : aboveCallerUserTooltip;
+            return { levels: [...ALL_LEVELS], tooltip };
+        }
+        if (state.roleLockedGranteeId === grantee.id) {
+            return { levels: levelsBelow("EDIT"), tooltip: coveredByWorkspacePermissionTooltip };
+        }
+        return undefined;
+    }, [
+        isRowAboveCaller,
+        state.roleLockedGranteeId,
+        aboveCallerUserTooltip,
+        aboveCallerGroupTooltip,
+        coveredByWorkspacePermissionTooltip,
+    ]);
     const rowDisabledLevels = useCallback((grantee) => {
+        const lock = rowLock(grantee);
+        if (lock) {
+            return lock.levels;
+        }
         const self = state.selfManagedGranteeId === grantee.id ? (state.selfManagedDisabledLevels ?? []) : [];
         // Self caps levels ABOVE the row and coverage disables those BELOW, so those
         // two are disjoint; the grant limit can overlap either.
@@ -107,8 +135,12 @@ export function useObjectShareDialog({ target, onClose, onSummaryChange, draft,
             ]),
         ];
         return merged.length > 0 ? merged : undefined;
-    }, [state.selfManagedGranteeId, state.selfManagedDisabledLevels, state.grantableDisabledLevels]);
+    }, [rowLock, state.selfManagedGranteeId, state.selfManagedDisabledLevels, state.grantableDisabledLevels]);
     const rowDisabledLevelTooltips = useCallback((grantee) => {
+        const lock = rowLock(grantee);
+        if (lock) {
+            return Object.fromEntries(lock.levels.map((level) => [level, lock.tooltip]));
+        }
         const covered = inheritedCoveredLevels(grantee);
         if (covered.length === 0) {
             return undefined;
@@ -118,8 +150,11 @@ export function useObjectShareDialog({ target, onClose, onSummaryChange, draft,
             map[level] = inheritedCoveredTooltip;
         }
         return map;
-    }, [inheritedCoveredTooltip]);
-    const isRowRemoveDisabled = useCallback((grantee) => grantee.directLevel === undefined, []);
+    }, [rowLock, inheritedCoveredTooltip]);
+    const isRowRemoveDisabled = useCallback((grantee) => grantee.directLevel === undefined || rowLock(grantee) !== undefined, [rowLock]);
+    const removeInheritedTooltip = intl.formatMessage(objectShareMessages.granteeRemoveInherited);
+    const rowRemoveDisabledTooltip = useCallback((grantee) => rowLock(grantee)?.tooltip ?? removeInheritedTooltip, [rowLock, removeInheritedTooltip]);
+    const grantLimitTooltip = intl.formatMessage(objectShareMessages.toastEscalationRefused);
     // Only USER rows can be the caller's own, so a group row stays usable while the
     // profile is unresolved.
     const isRowControlsLocked = useCallback((grantee) => state.granteeControlsLocked && grantee.kind === "user", [state.granteeControlsLocked]);
@@ -136,12 +171,13 @@ export function useObjectShareDialog({ target, onClose, onSummaryChange, draft,
         isLoading,
         workspaceDisabledLevels: state.workspaceDisabledLevels,
         grantableDisabledLevels: state.grantableDisabledLevels,
-        grantLimitTooltip: intl.formatMessage(objectShareMessages.toastEscalationRefused),
+        grantLimitTooltip,
         rowDisabledLevels,
         rowDisabledLevelTooltips,
         isRowRemoveDisabled,
         isRowControlsLocked,
-        rowRemoveDisabledTooltip: intl.formatMessage(objectShareMessages.granteeRemoveInherited),
+        rowRemoveDisabledTooltip,
+        isRowAboveCaller,
         onClose: closeDialog,
         onRowPermissionChange,
         onRowRemove,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gooddata/sdk-ui-ext",
-  "version": "11.61.0-alpha.2",
+  "version": "11.61.0-alpha.4",
   "description": "GoodData.UI SDK - Extensions",
   "license": "LicenseRef-LICENSE",
   "author": "GoodData Corporation",
@@ -63,20 +63,20 @@
     "ts-invariant": "0.10.3",
     "tslib": "2.8.1",
     "uuid": "11.1.1",
-    "@gooddata/sdk-backend-base": "11.61.0-alpha.2",
-    "@gooddata/sdk-embedding": "11.61.0-alpha.2",
-    "@gooddata/sdk-backend-spi": "11.61.0-alpha.2",
-    "@gooddata/sdk-ui": "11.61.0-alpha.2",
-    "@gooddata/sdk-model": "11.61.0-alpha.2",
-    "@gooddata/sdk-ui-filters": "11.61.0-alpha.2",
-    "@gooddata/sdk-ui-charts": "11.61.0-alpha.2",
-    "@gooddata/sdk-ui-geo": "11.61.0-alpha.2",
-    "@gooddata/sdk-ui-pivot": "11.61.0-alpha.2",
-    "@gooddata/sdk-ui-kit": "11.61.0-alpha.2",
-    "@gooddata/sdk-ui-vis-commons": "11.61.0-alpha.2",
-    "@gooddata/sdk-ui-semantic-search": "11.61.0-alpha.2",
-    "@gooddata/sdk-ui-theme-provider": "11.61.0-alpha.2",
-    "@gooddata/util": "11.61.0-alpha.2"
+    "@gooddata/sdk-backend-base": "11.61.0-alpha.4",
+    "@gooddata/sdk-backend-spi": "11.61.0-alpha.4",
+    "@gooddata/sdk-embedding": "11.61.0-alpha.4",
+    "@gooddata/sdk-model": "11.61.0-alpha.4",
+    "@gooddata/sdk-ui": "11.61.0-alpha.4",
+    "@gooddata/sdk-ui-charts": "11.61.0-alpha.4",
+    "@gooddata/sdk-ui-filters": "11.61.0-alpha.4",
+    "@gooddata/sdk-ui-geo": "11.61.0-alpha.4",
+    "@gooddata/sdk-ui-kit": "11.61.0-alpha.4",
+    "@gooddata/sdk-ui-pivot": "11.61.0-alpha.4",
+    "@gooddata/sdk-ui-semantic-search": "11.61.0-alpha.4",
+    "@gooddata/sdk-ui-theme-provider": "11.61.0-alpha.4",
+    "@gooddata/sdk-ui-vis-commons": "11.61.0-alpha.4",
+    "@gooddata/util": "11.61.0-alpha.4"
   },
   "devDependencies": {
     "@microsoft/api-documenter": "7.30.16",
@@ -120,12 +120,12 @@
     "typescript": "7.0.2",
     "vitest": "4.1.11",
     "vitest-dom": "0.1.1",
-    "@gooddata/oxlint-config": "11.61.0-alpha.2",
-    "@gooddata/eslint-config": "11.61.0-alpha.2",
-    "@gooddata/i18n-toolkit": "11.61.0-alpha.2",
-    "@gooddata/sdk-backend-mockingbird": "11.61.0-alpha.2",
-    "@gooddata/reference-workspace": "11.61.0-alpha.2",
-    "@gooddata/stylelint-config": "11.61.0-alpha.2"
+    "@gooddata/eslint-config": "11.61.0-alpha.4",
+    "@gooddata/oxlint-config": "11.61.0-alpha.4",
+    "@gooddata/i18n-toolkit": "11.61.0-alpha.4",
+    "@gooddata/stylelint-config": "11.61.0-alpha.4",
+    "@gooddata/sdk-backend-mockingbird": "11.61.0-alpha.4",
+    "@gooddata/reference-workspace": "11.61.0-alpha.4"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",