@gooddata/sdk-ui-ext 11.61.0-alpha.3 → 11.61.0-alpha.5

package/esm/share/useAccessList.d.ts

@@ -27,6 +27,11 @@ export interface IAccessList {
      * the backend would allow. The Admin self row needs an explicit `true`.
      */
     isWorkspaceManager: boolean | undefined;
+    /**
+     * Whether the caller may edit and share every visualization of this workspace through the
+     * MANAGE_VISUALIZATIONS or MANAGE workspace permission, or **undefined** while pending or after it failed.
+     */
+    canManageVisualizations: boolean | undefined;
     /**
      * The strongest level the caller holds on the target, from every source the backend
      * resolves (own grants, groups, parent workspaces, workspace permissions), or

package/esm/share/useAccessList.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAccessList.d.ts","sourceRoot":"","sources":["../../src/share/useAccessList.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,wBAAwB,EAAiC,MAAM,2BAA2B,CAAC;AACzG,OAAO,EAEH,KAAK,sBAAsB,EAK9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACH,KAAK,gBAAgB,EAKxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,sBAAsB,EAAmB,MAAM,sBAAsB,CAAC;AAqB7G,OAAO,KAAK,EAER,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,SAAS,EACT,aAAa,EACb,0BAA0B,EAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,6EAA6E;IAC7E,YAAY,EAAE,aAAa,GAAG,SAAS,CAAC;IACxC;;;;;;;;;OASG;IACH,kBAAkB,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC;;;;OAIG;IACH,WAAW,EAAE,0BAA0B,GAAG,SAAS,CAAC;IACpD;;;OAGG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B,8DAA8D;IAC9D,aAAa,EAAE,kBAAkB,CAAC;IAClC,kFAAkF;IAClF,cAAc,EAAE,0BAA0B,CAAC;IAC3C;;;OAGG;IACH,uBAAuB,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAChE,wFAAwF;IACxF,oBAAoB,EAAE,OAAO,CAAC;IAC9B,iFAAiF;IACjF,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC1C,qDAAqD;IACrD,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9C,mDAAmD;IACnD,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAExC,mFAAmF;IACnF,MAAM,EAAE,CAAC,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/F,6FAA6F;IAC7F,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEjE;;;;OAIG;IACH,eAAe,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACxD;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAC3E;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,iEAAiE;IACjE,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;OAGG;IACH,eAAe,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAEtC,oFAAoF;IACpF,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC;IAC1D,6DAA6D;IAC7D,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,8FAA8F;IAC9F,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,6DAA6D;IAC7D,KAAK,EAAE,iBAAiB,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACpC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,YAAY,GAAE,uBAA4B,GAC3C,WAAW,CA4Xb"}
+{"version":3,"file":"useAccessList.d.ts","sourceRoot":"","sources":["../../src/share/useAccessList.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,wBAAwB,EAAiC,MAAM,2BAA2B,CAAC;AACzG,OAAO,EAEH,KAAK,sBAAsB,EAK9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACH,KAAK,gBAAgB,EAKxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,sBAAsB,EAAmB,MAAM,sBAAsB,CAAC;AAqB7G,OAAO,KAAK,EAER,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,SAAS,EACT,aAAa,EACb,0BAA0B,EAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,6EAA6E;IAC7E,YAAY,EAAE,aAAa,GAAG,SAAS,CAAC;IACxC;;;;;;;;;OASG;IACH,kBAAkB,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7C;;;;OAIG;IACH,WAAW,EAAE,0BAA0B,GAAG,SAAS,CAAC;IACpD;;;OAGG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B,8DAA8D;IAC9D,aAAa,EAAE,kBAAkB,CAAC;IAClC,kFAAkF;IAClF,cAAc,EAAE,0BAA0B,CAAC;IAC3C;;;OAGG;IACH,uBAAuB,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAChE,wFAAwF;IACxF,oBAAoB,EAAE,OAAO,CAAC;IAC9B,iFAAiF;IACjF,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC1C,qDAAqD;IACrD,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9C,mDAAmD;IACnD,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAExC,mFAAmF;IACnF,MAAM,EAAE,CAAC,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/F,6FAA6F;IAC7F,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEjE;;;;OAIG;IACH,eAAe,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACxD;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAC3E;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,iEAAiE;IACjE,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;OAGG;IACH,eAAe,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAEtC,oFAAoF;IACpF,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC;IAC1D,6DAA6D;IAC7D,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,8FAA8F;IAC9F,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,6DAA6D;IAC7D,KAAK,EAAE,iBAAiB,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACpC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,YAAY,GAAE,uBAA4B,GAC3C,WAAW,CA8Xb"}

package/esm/share/useAccessList.js

@@ -71,6 +71,7 @@ export function useAccessList(target, draftOptions = {}) {
         onError: () => { },
     }, [backend, workspace]);
     const isWorkspaceManager = workspacePermissions?.canManageProject;
+    const canManageVisualizations = workspacePermissions?.canManageVisualizations;
     // Re-read after every write, since a change to the caller's own row, a group or the rule
     // can change their level. The last answer stays in place while the next one loads, and is
     // dropped if that read fails, so the policies fall back to the caller's own row.
@@ -298,6 +299,7 @@ export function useAccessList(target, draftOptions = {}) {
         grantees,
         selfIdentity,
         isWorkspaceManager,
+        canManageVisualizations,
         callerLevel,
         selfIdentityResolved,
         generalAccess,

package/esm/share/useObjectShareController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useObjectShareController.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareController.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAkB1E,OAAO,EACH,KAAK,sBAAsB,EAI3B,KAAK,sBAAsB,EAE9B,MAAM,kCAAkC,CAAC;AAI1C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,sBAAsB,GACjC,sBAAsB,CA+yBxB"}
+{"version":3,"file":"useObjectShareController.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareController.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAkB1E,OAAO,EACH,KAAK,sBAAsB,EAI3B,KAAK,sBAAsB,EAG9B,MAAM,kCAAkC,CAAC;AA8B1C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,sBAAsB,GACjC,sBAAsB,CA40BxB"}

package/esm/share/useObjectShareController.js

@@ -6,6 +6,19 @@ import { objectShareMessages } from "./messages.js";
 import { EMPTY_IDS, NO_LABELS, changesEffectiveLevel, granularGranteeFor, levelsAbove, levelsBelow, mergeDisabledLevels, sortGrantees, toGranularGrantee, } from "./objectShareController.helpers.js";
 import { useAccessList } from "./useAccessList.js";
 import { useLabelScope } from "./useLabelScope.js";
+function resolveRoleAccess({ loaded, isWorkspaceManager, canManageVisualizations, kind, callerLevel, }) {
+    if (!loaded) {
+        return undefined;
+    }
+    if (isWorkspaceManager) {
+        return "workspaceManager";
+    }
+    // The backend's EDIT is required too: inherited visualizations stay view-only for a holder.
+    if (canManageVisualizations && kind === "insight" && callerLevel === "EDIT") {
+        return "visualizationManager";
+    }
+    return undefined;
+}
 /**
  * Manages the share-dialog state and backend I/O for ONE dialog session: the hook
  * is mounted while the dialog is open, for a single target that must not change
@@ -35,7 +48,15 @@ export function useObjectShareController(target, options) {
     const [subview, setSubview] = useState("main");
     const [pendingGrantees, setPendingGrantees] = useState([]);
     const [pendingGeneralAccess, setPendingGeneralAccess] = useState(undefined);
-    const { hasList, grantees, isWorkspaceManager, callerLevel, selfIdentityResolved, generalAccess, workspaceLevel, workspaceInheritedLevel, workspaceLevelSaving, summary, status, loadError, commit, loadOptions, applyGranteeAdd, applyGranteeLevel, applyGranteeLock, applyGranteeRemove, settleGranteeEdit, failGranteeEdit, applyRuleEdit, settleRuleEdit, failRuleEdit, draft: draftValue, } = useAccessList(target, { draft, initialDraft, initialDraftGeneralAccess });
+    const { hasList, grantees, isWorkspaceManager, canManageVisualizations, callerLevel, selfIdentityResolved, generalAccess, workspaceLevel, workspaceInheritedLevel, workspaceLevelSaving, summary, status, loadError, commit, loadOptions, applyGranteeAdd, applyGranteeLevel, applyGranteeLock, applyGranteeRemove, settleGranteeEdit, failGranteeEdit, applyRuleEdit, settleRuleEdit, failRuleEdit, draft: draftValue, } = useAccessList(target, { draft, initialDraft, initialDraftGeneralAccess });
+    const roleAccess = resolveRoleAccess({
+        loaded: !draft && status === "success",
+        isWorkspaceManager,
+        canManageVisualizations,
+        kind: target?.kind,
+        callerLevel,
+    });
+    const roleLockedGranteeId = roleAccess === "visualizationManager" ? grantees.find((g) => g.isSelf)?.id : undefined;
     // Grantee ids the label-scope probe resolves against — a removing row is excluded
     // so its scope is dropped, not re-seeded.
     const committedGranteeIds = useMemo(() => {
@@ -218,7 +239,11 @@ export function useObjectShareController(target, options) {
         // Also refused before the label scope resolves: the re-grade below would run
         // over the assumed-all fallback and mint grants the grantee never held. The
         // UI gates on the same fact (isMutable); the controller stays authoritative.
-        if (!grantee || grantee.pending || !labelsResolved || !changesEffectiveLevel(grantee, level)) {
+        if (!grantee ||
+            grantee.pending ||
+            !labelsResolved ||
+            granteeId === roleLockedGranteeId ||
+            !changesEffectiveLevel(grantee, level)) {
             return;
         }
         applyGranteeLevel(granteeId, level);
@@ -278,6 +303,7 @@ export function useObjectShareController(target, options) {
         applyGranteeLevel,
         settleGranteeEdit,
         failGranteeEdit,
+        roleLockedGranteeId,
     ]);
     const removeGrantee = useCallback(async (granteeId) => {
         const grantee = grantees.find((g) => g.id === granteeId);
@@ -288,7 +314,11 @@ export function useObjectShareController(target, options) {
         // this keeps the controller — not the UI — authoritative. Same for an
         // unresolved label scope: the revoke below would run over the assumed-all
         // fallback and revoke (then compensate with) grants that never existed.
-        if (!grantee || grantee.pending || !labelsResolved || grantee.directLevel === undefined) {
+        if (!grantee ||
+            grantee.pending ||
+            !labelsResolved ||
+            grantee.directLevel === undefined ||
+            granteeId === roleLockedGranteeId) {
             return;
         }
         // Mark the row removed but keep it visible (muted) until the write lands.
@@ -375,6 +405,7 @@ export function useObjectShareController(target, options) {
         settleGranteeEdit,
         failGranteeEdit,
         setSelectedLabelIdsByGrantee,
+        roleLockedGranteeId,
     ]);
     const changeGranteeLabels = useCallback(async (granteeId, requested) => {
         const grantee = grantees.find((g) => g.id === granteeId);
@@ -607,7 +638,7 @@ export function useObjectShareController(target, options) {
     // Sorted for display only; the overlay stays in write-through order, so
     // add/rollback logic is unaffected. Memoized apart from the state assembly so
     // the array identity changes only when the rows do, not on every state change.
-    const sortedGrantees = useMemo(() => sortGrantees(grantees), [grantees]);
+    const sortedGrantees = useMemo(() => sortGrantees(grantees).map((g) => g.id === roleLockedGranteeId ? { ...g, level: "EDIT", effectivePermission: undefined } : g), [grantees, roleLockedGranteeId]);
     const state = useMemo(() => {
         // Row policy is classified here, not in the dialog, so a consumer
         // injecting this controller into its own UI gets the same classification.
@@ -615,7 +646,7 @@ export function useObjectShareController(target, options) {
         // it special is that the access is THEIRS. A manager is exempt, their access
         // comes from the role, so there is no ceiling to cap and no lockout to warn of.
         const ownRow = grantees.find((g) => g.isSelf);
-        const selfRow = isWorkspaceManager ? undefined : ownRow;
+        const selfRow = isWorkspaceManager || roleLockedGranteeId ? undefined : ownRow;
         const selfManagedGranteeId = selfRow?.id;
         // The caller cannot grant above what they hold, and the server refuses such a write.
         // The backend's own answer covers groups, parent workspaces and workspace permissions.
@@ -627,10 +658,6 @@ export function useObjectShareController(target, options) {
                 : undefined
             : levelsAbove(callerLevel);
         const granteeControlsLocked = !selfIdentityResolved && !isWorkspaceManager && grantees.some((g) => g.kind === "user");
-        // Policy in `IObjectShareControllerState.showAdminAccessNote`: role-based access is
-        // explained by a note, not a grantee row, so it does not depend on the caller having
-        // (or lacking) a row of their own.
-        const showAdminAccessNote = !draft && status === "success" && isWorkspaceManager === true;
         return {
             subview,
             status,
@@ -645,7 +672,8 @@ export function useObjectShareController(target, options) {
             grantableDisabledLevels,
             callerLevel,
             granteeControlsLocked,
-            showAdminAccessNote,
+            roleAccess,
+            roleLockedGranteeId,
             ...effectiveWorkspace,
             workspaceInheritedLevel: workspaceInheritedLevel,
             workspaceLevelLocked: generalAccess !== "WORKSPACE" || workspaceInheritedLevel === "EDIT",
@@ -665,8 +693,9 @@ export function useObjectShareController(target, options) {
         summary,
         selfIdentityResolved,
         isWorkspaceManager,
+        roleAccess,
+        roleLockedGranteeId,
         callerLevel,
-        draft,
         grantees,
         sortedGrantees,
         effectiveWorkspace,

package/esm/share/useObjectShareDialog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useObjectShareDialog.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareDialog.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAU/D,OAAO,KAAK,EACR,6BAA6B,EAC7B,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAsB1E;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IACxC,yFAAyF;IACzF,KAAK,EAAE,2BAA2B,CAAC;IACnC,yEAAyE;IACzE,OAAO,EAAE,6BAA6B,CAAC;IAEvC,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,0BAA0B,EAAE,OAAO,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,EAAE,OAAO,CAAC;IAEnC;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB,kGAAkG;IAClG,uBAAuB,EAAE,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAClE;;;OAGG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAC9F,2EAA2E;IAC3E,wBAAwB,EAAE,CACtB,OAAO,EAAE,mBAAmB,KAC3B,OAAO,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACrE,wFAAwF;IACxF,uBAAuB,EAAE,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAClE,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAC/D,oEAAoE;IACpE,wBAAwB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,MAAM,CAAC;IACnE,gGAAgG;IAChG,gBAAgB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAC5D,oFAAoF;IACpF,mBAAmB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAE/D,iGAAiG;IACjG,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB;;;OAGG;IACH,qBAAqB,EAAE,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACjG,qGAAqG;IACrG,WAAW,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACpD,qFAAqF;IACrF,oBAAoB,EAAE,MAAM,IAAI,CAAC;IACjC,6FAA6F;IAC7F,qBAAqB,EAAE,MAAM,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,UAAU,2BAA2B;IACjC,sFAAsF;IACtF,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC7C,oGAAoG;IACpG,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,mFAAmF;IACnF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC1D,2FAA2F;IAC3F,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iGAAiG;IACjG,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wFAAwF;IACxF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yEAAyE;IACzE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACnD,2DAA2D;IAC3D,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,iFAAiF;IACjF,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EACjC,MAAM,EACN,OAAO,EACP,eAAe,EACf,KAAK,EACL,aAAa,EACb,YAAY,EACZ,yBAAyB,EACzB,MAAM,EACN,aAAa,EACb,WAAW,GACd,EAAE,2BAA2B,GAAG,2BAA2B,CA2M3D"}
+{"version":3,"file":"useObjectShareDialog.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareDialog.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAU/D,OAAO,KAAK,EACR,6BAA6B,EAC7B,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAsB1E;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IACxC,yFAAyF;IACzF,KAAK,EAAE,2BAA2B,CAAC;IACnC,yEAAyE;IACzE,OAAO,EAAE,6BAA6B,CAAC;IAEvC,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,0BAA0B,EAAE,OAAO,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,EAAE,OAAO,CAAC;IAEnC;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB,kGAAkG;IAClG,uBAAuB,EAAE,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAClE;;;OAGG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAC9F,2EAA2E;IAC3E,wBAAwB,EAAE,CACtB,OAAO,EAAE,mBAAmB,KAC3B,OAAO,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACrE,wFAAwF;IACxF,uBAAuB,EAAE,0BAA0B,EAAE,GAAG,SAAS,CAAC;IAClE,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAC/D,oEAAoE;IACpE,wBAAwB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,MAAM,CAAC;IACnE,gGAAgG;IAChG,gBAAgB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAC5D,oFAAoF;IACpF,mBAAmB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAE/D,iGAAiG;IACjG,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB;;;OAGG;IACH,qBAAqB,EAAE,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACjG,qGAAqG;IACrG,WAAW,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACpD,qFAAqF;IACrF,oBAAoB,EAAE,MAAM,IAAI,CAAC;IACjC,6FAA6F;IAC7F,qBAAqB,EAAE,MAAM,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,UAAU,2BAA2B;IACjC,sFAAsF;IACtF,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC7C,oGAAoG;IACpG,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,mFAAmF;IACnF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC1D,2FAA2F;IAC3F,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iGAAiG;IACjG,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wFAAwF;IACxF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yEAAyE;IACzE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACnD,2DAA2D;IAC3D,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,iFAAiF;IACjF,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EACjC,MAAM,EACN,OAAO,EACP,eAAe,EACf,KAAK,EACL,aAAa,EACb,YAAY,EACZ,yBAAyB,EACzB,MAAM,EACN,aAAa,EACb,WAAW,GACd,EAAE,2BAA2B,GAAG,2BAA2B,CA0N3D"}

package/esm/share/useObjectShareDialog.js

@@ -100,12 +100,29 @@ export function useObjectShareDialog({ target, onClose, onSummaryChange, draft,
     const isRowAboveCaller = useCallback((grantee) => state.callerLevel !== undefined &&
         grantee.directLevel !== undefined &&
         levelsAbove(state.callerLevel).includes(grantee.directLevel), [state.callerLevel]);
+    const coveredByWorkspacePermissionTooltip = intl.formatMessage(objectShareMessages.granteeCoveredByWorkspacePermission);
     const aboveCallerUserTooltip = intl.formatMessage(objectShareMessages.granteeAboveCallerUser);
     const aboveCallerGroupTooltip = intl.formatMessage(objectShareMessages.granteeAboveCallerGroup);
-    const aboveCallerTooltip = useCallback((grantee) => grantee.kind === "group" ? aboveCallerGroupTooltip : aboveCallerUserTooltip, [aboveCallerUserTooltip, aboveCallerGroupTooltip]);
-    const rowDisabledLevels = useCallback((grantee) => {
+    const rowLock = useCallback((grantee) => {
         if (isRowAboveCaller(grantee)) {
-            return [...ALL_LEVELS];
+            const tooltip = grantee.kind === "group" ? aboveCallerGroupTooltip : aboveCallerUserTooltip;
+            return { levels: [...ALL_LEVELS], tooltip };
+        }
+        if (state.roleLockedGranteeId === grantee.id) {
+            return { levels: levelsBelow("EDIT"), tooltip: coveredByWorkspacePermissionTooltip };
+        }
+        return undefined;
+    }, [
+        isRowAboveCaller,
+        state.roleLockedGranteeId,
+        aboveCallerUserTooltip,
+        aboveCallerGroupTooltip,
+        coveredByWorkspacePermissionTooltip,
+    ]);
+    const rowDisabledLevels = useCallback((grantee) => {
+        const lock = rowLock(grantee);
+        if (lock) {
+            return lock.levels;
         }
         const self = state.selfManagedGranteeId === grantee.id ? (state.selfManagedDisabledLevels ?? []) : [];
         // Self caps levels ABOVE the row and coverage disables those BELOW, so those
@@ -118,16 +135,11 @@ export function useObjectShareDialog({ target, onClose, onSummaryChange, draft,
             ]),
         ];
         return merged.length > 0 ? merged : undefined;
-    }, [
-        isRowAboveCaller,
-        state.selfManagedGranteeId,
-        state.selfManagedDisabledLevels,
-        state.grantableDisabledLevels,
-    ]);
+    }, [rowLock, state.selfManagedGranteeId, state.selfManagedDisabledLevels, state.grantableDisabledLevels]);
     const rowDisabledLevelTooltips = useCallback((grantee) => {
-        if (isRowAboveCaller(grantee)) {
-            const tooltip = aboveCallerTooltip(grantee);
-            return Object.fromEntries(ALL_LEVELS.map((level) => [level, tooltip]));
+        const lock = rowLock(grantee);
+        if (lock) {
+            return Object.fromEntries(lock.levels.map((level) => [level, lock.tooltip]));
         }
         const covered = inheritedCoveredLevels(grantee);
         if (covered.length === 0) {
@@ -138,10 +150,10 @@ export function useObjectShareDialog({ target, onClose, onSummaryChange, draft,
             map[level] = inheritedCoveredTooltip;
         }
         return map;
-    }, [isRowAboveCaller, aboveCallerTooltip, inheritedCoveredTooltip]);
-    const isRowRemoveDisabled = useCallback((grantee) => grantee.directLevel === undefined || isRowAboveCaller(grantee), [isRowAboveCaller]);
+    }, [rowLock, inheritedCoveredTooltip]);
+    const isRowRemoveDisabled = useCallback((grantee) => grantee.directLevel === undefined || rowLock(grantee) !== undefined, [rowLock]);
     const removeInheritedTooltip = intl.formatMessage(objectShareMessages.granteeRemoveInherited);
-    const rowRemoveDisabledTooltip = useCallback((grantee) => isRowAboveCaller(grantee) ? aboveCallerTooltip(grantee) : removeInheritedTooltip, [isRowAboveCaller, aboveCallerTooltip, removeInheritedTooltip]);
+    const rowRemoveDisabledTooltip = useCallback((grantee) => rowLock(grantee)?.tooltip ?? removeInheritedTooltip, [rowLock, removeInheritedTooltip]);
     const grantLimitTooltip = intl.formatMessage(objectShareMessages.toastEscalationRefused);
     // Only USER rows can be the caller's own, so a group row stays usable while the
     // profile is unresolved.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gooddata/sdk-ui-ext",
-  "version": "11.61.0-alpha.3",
+  "version": "11.61.0-alpha.5",
   "description": "GoodData.UI SDK - Extensions",
   "license": "LicenseRef-LICENSE",
   "author": "GoodData Corporation",
@@ -63,20 +63,20 @@
     "ts-invariant": "0.10.3",
     "tslib": "2.8.1",
     "uuid": "11.1.1",
-    "@gooddata/sdk-backend-base": "11.61.0-alpha.3",
-    "@gooddata/sdk-backend-spi": "11.61.0-alpha.3",
-    "@gooddata/sdk-embedding": "11.61.0-alpha.3",
-    "@gooddata/sdk-model": "11.61.0-alpha.3",
-    "@gooddata/sdk-ui": "11.61.0-alpha.3",
-    "@gooddata/sdk-ui-charts": "11.61.0-alpha.3",
-    "@gooddata/sdk-ui-geo": "11.61.0-alpha.3",
-    "@gooddata/sdk-ui-filters": "11.61.0-alpha.3",
-    "@gooddata/sdk-ui-kit": "11.61.0-alpha.3",
-    "@gooddata/sdk-ui-semantic-search": "11.61.0-alpha.3",
-    "@gooddata/sdk-ui-theme-provider": "11.61.0-alpha.3",
-    "@gooddata/sdk-ui-pivot": "11.61.0-alpha.3",
-    "@gooddata/util": "11.61.0-alpha.3",
-    "@gooddata/sdk-ui-vis-commons": "11.61.0-alpha.3"
+    "@gooddata/sdk-backend-base": "11.61.0-alpha.5",
+    "@gooddata/sdk-model": "11.61.0-alpha.5",
+    "@gooddata/sdk-backend-spi": "11.61.0-alpha.5",
+    "@gooddata/sdk-embedding": "11.61.0-alpha.5",
+    "@gooddata/sdk-ui": "11.61.0-alpha.5",
+    "@gooddata/sdk-ui-charts": "11.61.0-alpha.5",
+    "@gooddata/sdk-ui-filters": "11.61.0-alpha.5",
+    "@gooddata/sdk-ui-kit": "11.61.0-alpha.5",
+    "@gooddata/sdk-ui-geo": "11.61.0-alpha.5",
+    "@gooddata/sdk-ui-pivot": "11.61.0-alpha.5",
+    "@gooddata/sdk-ui-semantic-search": "11.61.0-alpha.5",
+    "@gooddata/sdk-ui-theme-provider": "11.61.0-alpha.5",
+    "@gooddata/sdk-ui-vis-commons": "11.61.0-alpha.5",
+    "@gooddata/util": "11.61.0-alpha.5"
   },
   "devDependencies": {
     "@microsoft/api-documenter": "7.30.16",
@@ -120,12 +120,12 @@
     "typescript": "7.0.2",
     "vitest": "4.1.11",
     "vitest-dom": "0.1.1",
-    "@gooddata/eslint-config": "11.61.0-alpha.3",
-    "@gooddata/i18n-toolkit": "11.61.0-alpha.3",
-    "@gooddata/oxlint-config": "11.61.0-alpha.3",
-    "@gooddata/reference-workspace": "11.61.0-alpha.3",
-    "@gooddata/sdk-backend-mockingbird": "11.61.0-alpha.3",
-    "@gooddata/stylelint-config": "11.61.0-alpha.3"
+    "@gooddata/i18n-toolkit": "11.61.0-alpha.5",
+    "@gooddata/eslint-config": "11.61.0-alpha.5",
+    "@gooddata/oxlint-config": "11.61.0-alpha.5",
+    "@gooddata/sdk-backend-mockingbird": "11.61.0-alpha.5",
+    "@gooddata/stylelint-config": "11.61.0-alpha.5",
+    "@gooddata/reference-workspace": "11.61.0-alpha.5"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",