@gooddata/sdk-ui-pluggable-host 11.50.0 → 11.51.0-alpha.1

package/esm/components/useRedirectTarget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useRedirectTarget.d.ts","sourceRoot":"","sources":["../../src/components/useRedirectTarget.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAMlF,MAAM,MAAM,mBAAmB,GACzB;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,GACnB;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,GACtB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC;;GAEG;AACH,wBAAgB,iBAAiB,CAC7B,IAAI,EAAE,gCAAgC,EAAE,EACxC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GAChB,mBAAmB,CA4DrB"}
+{"version":3,"file":"useRedirectTarget.d.ts","sourceRoot":"","sources":["../../src/components/useRedirectTarget.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAOlF,MAAM,MAAM,mBAAmB,GACzB;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,GACnB;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,GACtB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC;;GAEG;AACH,wBAAgB,iBAAiB,CAC7B,IAAI,EAAE,gCAAgC,EAAE,EACxC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GAChB,mBAAmB,CA6DrB"}

package/esm/components/useRedirectTarget.js

@@ -3,6 +3,7 @@ import { useEffect, useState } from "react";
 import { debugLog } from "../debug.js";
 import { AppNotFoundError, resolveRedirectTarget } from "../loader/redirectLogic.js";
 import { getBackend } from "../platformContext/backend.js";
+import { getWorkspaceAccess } from "../platformContext/workspaceAccess.js";
 /**
  * Resolves the redirect target for the current URL and permission context.
  */
@@ -26,6 +27,7 @@ export function useRedirectTarget(apps, ctx, pathname, search) {
             pathname,
             search,
             fetchFirstWorkspaceId,
+            getWorkspaceAccess: (workspaceId) => getWorkspaceAccess(getBackend(), workspaceId),
         })
             .then((url) => {
             if (cancelled) {

package/esm/loader/lastVisitedWorkspace.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Who a remembered workspace belongs to.
+ *
+ * Both parts are needed because localStorage belongs to the *origin*, not to the session or
+ * the backend:
+ * - every account signing in from the same browser profile shares the key, so one user must
+ *   not be sent to another user's workspace just because both can access it;
+ * - one origin can be pointed at different backends — a local dev server switched between
+ *   environments — where the same login exists but its workspaces do not.
+ */
+export interface ILastVisitedWorkspaceOwner {
+    organizationId: string | undefined;
+    userId: string;
+}
+/**
+ * Returns the workspace the given owner visited last, or `undefined` when nothing usable is
+ * stored for them or the stored value cannot be read.
+ */
+export declare function getLastVisitedWorkspace(owner: ILastVisitedWorkspaceOwner): string | undefined;
+/**
+ * Persists the workspace the given owner is currently in, so that a later landing on a URL
+ * that carries no workspace ("/", "/workspace/", a bare legacy app path) can return to it
+ * instead of falling back to their first workspace.
+ * Silently swallows errors (e.g. storage full, private browsing).
+ */
+export declare function setLastVisitedWorkspace(owner: ILastVisitedWorkspaceOwner, workspaceId: string): void;
+/**
+ * Forgets the owner's stored workspace, but only while it is still `expectedWorkspaceId`,
+ * so the next landing does not keep retrying a workspace that turned out to be unusable
+ * (deleted, or access revoked).
+ *
+ * The compare matters because the decision to forget is made across an `await`: a newer
+ * navigation may have stored a different workspace in the meantime, and that one should
+ * survive. It narrows the window rather than closing it — another tab can still write between
+ * the read and the delete, and the cost of that rare interleaving is one lost preference,
+ * re-established on the next visit.
+ */
+export declare function clearLastVisitedWorkspace(owner: ILastVisitedWorkspaceOwner, expectedWorkspaceId: string): void;
+//# sourceMappingURL=lastVisitedWorkspace.d.ts.map

package/esm/loader/lastVisitedWorkspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lastVisitedWorkspace.d.ts","sourceRoot":"","sources":["../../src/loader/lastVisitedWorkspace.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AACH,MAAM,WAAW,0BAA0B;IACvC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;CAClB;AAiDD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,0BAA0B,GAAG,MAAM,GAAG,SAAS,CAM7F;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAQpG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACrC,KAAK,EAAE,0BAA0B,EACjC,mBAAmB,EAAE,MAAM,GAC5B,IAAI,CAYN"}

package/esm/loader/lastVisitedWorkspace.js

@@ -0,0 +1,91 @@
+// (C) 2026 GoodData Corporation
+const STORAGE_KEY = "gdc-host-lastVisitedWorkspace";
+function ownerKey({ organizationId, userId }) {
+    return `${organizationId ?? "-"}|${userId}`;
+}
+/**
+ * Parses the stored JSON into a record that is safe to read and to write through, discarding
+ * missing, corrupt or unexpectedly shaped values.
+ *
+ * Two properties are established here so every caller can rely on them:
+ * - the record has a **null prototype**, so an owner key ending in `__proto__` becomes an
+ *   ordinary own key (on a plain object that assignment hits the legacy prototype setter and
+ *   the entry is silently dropped by `JSON.stringify`) and keys like `constructor` or
+ *   `toString` cannot pick up a function from `Object.prototype`;
+ * - every retained value is a **non-empty string**, so a hand-edited `{"user": 42}` can never
+ *   reach `backend.workspace()` as a bogus id.
+ */
+function safeParse(raw) {
+    const record = Object.create(null);
+    if (!raw) {
+        return record;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            return record;
+        }
+        for (const [key, value] of Object.entries(parsed)) {
+            if (typeof value === "string" && value) {
+                record[key] = value;
+            }
+        }
+    }
+    catch {
+        // Intentionally ignored — a corrupt value is treated as "nothing remembered"
+    }
+    return record;
+}
+/**
+ * Returns the workspace the given owner visited last, or `undefined` when nothing usable is
+ * stored for them or the stored value cannot be read.
+ */
+export function getLastVisitedWorkspace(owner) {
+    try {
+        return safeParse(localStorage.getItem(STORAGE_KEY))[ownerKey(owner)];
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Persists the workspace the given owner is currently in, so that a later landing on a URL
+ * that carries no workspace ("/", "/workspace/", a bare legacy app path) can return to it
+ * instead of falling back to their first workspace.
+ * Silently swallows errors (e.g. storage full, private browsing).
+ */
+export function setLastVisitedWorkspace(owner, workspaceId) {
+    try {
+        const record = safeParse(localStorage.getItem(STORAGE_KEY));
+        record[ownerKey(owner)] = workspaceId;
+        localStorage.setItem(STORAGE_KEY, JSON.stringify(record));
+    }
+    catch {
+        // Intentionally ignored — localStorage may be unavailable or full
+    }
+}
+/**
+ * Forgets the owner's stored workspace, but only while it is still `expectedWorkspaceId`,
+ * so the next landing does not keep retrying a workspace that turned out to be unusable
+ * (deleted, or access revoked).
+ *
+ * The compare matters because the decision to forget is made across an `await`: a newer
+ * navigation may have stored a different workspace in the meantime, and that one should
+ * survive. It narrows the window rather than closing it — another tab can still write between
+ * the read and the delete, and the cost of that rare interleaving is one lost preference,
+ * re-established on the next visit.
+ */
+export function clearLastVisitedWorkspace(owner, expectedWorkspaceId) {
+    try {
+        const record = safeParse(localStorage.getItem(STORAGE_KEY));
+        const key = ownerKey(owner);
+        if (record[key] !== expectedWorkspaceId) {
+            return;
+        }
+        delete record[key];
+        localStorage.setItem(STORAGE_KEY, JSON.stringify(record));
+    }
+    catch {
+        // Intentionally ignored — localStorage may be unavailable
+    }
+}

package/esm/loader/redirectLogic.d.ts

@@ -1,5 +1,6 @@
 import { type PluggableApplicationRegistryItem } from "@gooddata/sdk-model";
 import { type IPlatformContext } from "@gooddata/sdk-pluggable-application-model";
+import { type WorkspaceAccess } from "../platformContext/workspaceAccess.js";
 /**
  * Thrown when the current URL does not correspond to any accessible application.
  */
@@ -18,6 +19,11 @@ export interface IResolveRedirectTargetOptions {
     search?: string;
     /** Fetches the first workspace ID for the current user. */
     fetchFirstWorkspaceId: () => Promise<string | undefined>;
+    /**
+     * Resolves whether the given workspace can still be opened by the current user.
+     * Used to validate the remembered workspace before redirecting into it.
+     */
+    getWorkspaceAccess: (workspaceId: string) => Promise<WorkspaceAccess>;
 }
 /**
  * Resolves where the shell app should navigate given the current URL and permission context.
@@ -29,5 +35,5 @@ export interface IResolveRedirectTargetOptions {
  * @throws {AppNotFoundError} The current path maps to no accessible application (show 404)
  * @throws {Error} Unexpected failure (show generic error screen)
  */
-export declare function resolveRedirectTarget({ apps, ctx, pathname, search, fetchFirstWorkspaceId }: IResolveRedirectTargetOptions): Promise<string | null>;
+export declare function resolveRedirectTarget({ apps, ctx, pathname, search, fetchFirstWorkspaceId, getWorkspaceAccess }: IResolveRedirectTargetOptions): Promise<string | null>;
 //# sourceMappingURL=redirectLogic.d.ts.map

package/esm/loader/redirectLogic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirectLogic.d.ts","sourceRoot":"","sources":["../../src/loader/redirectLogic.ts"],"names":[],"mappings":"AAEA,OAAO,EAAyB,KAAK,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAQlF;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACJ;AAED,MAAM,WAAW,6BAA6B;IAC1C;;;OAGG;IACH,IAAI,EAAE,gCAAgC,EAAE,CAAC;IACzC,GAAG,EAAE,gBAAgB,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,qBAAqB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC5D;AAqFD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,EACxC,IAAI,EACJ,GAAG,EACH,QAAQ,EACR,MAAM,EACN,qBAAqB,EACxB,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwFxD"}
+{"version":3,"file":"redirectLogic.d.ts","sourceRoot":"","sources":["../../src/loader/redirectLogic.ts"],"names":[],"mappings":"AAEA,OAAO,EAAyB,KAAK,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAGlF,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAY7E;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACJ;AAED,MAAM,WAAW,6BAA6B;IAC1C;;;OAGG;IACH,IAAI,EAAE,gCAAgC,EAAE,CAAC;IACzC,GAAG,EAAE,gBAAgB,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,qBAAqB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACzD;;;OAGG;IACH,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACzE;AAkJD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,EACxC,IAAI,EACJ,GAAG,EACH,QAAQ,EACR,MAAM,EACN,qBAAqB,EACrB,kBAAkB,EACrB,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsHxD"}

package/esm/loader/redirectLogic.js

@@ -1,6 +1,7 @@
 // (C) 2026 GoodData Corporation
 import { debugLog } from "../debug.js";
 import { getLastVisitedApp, setLastVisitedApp } from "./lastVisitedApp.js";
+import { clearLastVisitedWorkspace, getLastVisitedWorkspace, setLastVisitedWorkspace, } from "./lastVisitedWorkspace.js";
 import { mapBareLegacyPathToApp } from "./legacyRedirect.js";
 import { getActiveInternalApplication, getApplicationHref } from "./routing.js";
 /**
@@ -40,6 +41,50 @@ function isAtScopeRoot(pathname, scope, workspaceId) {
     const _ = scope;
     throw new Error(`[host-runtime/redirectLogic] Unhandled application scope: ${_}`);
 }
+/**
+ * Resolves the workspace to land in when the URL carries none: the workspace this user
+ * visited last, falling back to the first workspace they can see.
+ *
+ * The remembered workspace is validated before it is used — it may have been deleted or
+ * the user's access to it revoked since it was stored. Only a workspace the user provably
+ * cannot open is forgotten; a failed check ("unknown") keeps the memory, because losing the
+ * user's workspace over a network blip is worse than letting the workspace route retry the
+ * same request and report the real error.
+ */
+async function resolveLandingWorkspaceId(owner, { fetchFirstWorkspaceId, getWorkspaceAccess, }) {
+    const rememberedWorkspaceId = getLastVisitedWorkspace(owner);
+    if (rememberedWorkspaceId) {
+        const access = await getWorkspaceAccess(rememberedWorkspaceId);
+        if (access === "forbidden") {
+            debugLog(`[host-runtime/redirect] last visited workspace ${rememberedWorkspaceId} is not accessible — forgetting it`);
+            clearLastVisitedWorkspace(owner, rememberedWorkspaceId);
+        }
+        else {
+            debugLog(`[host-runtime/redirect] using last visited workspace → ${rememberedWorkspaceId} (access=${access})`);
+            return rememberedWorkspaceId;
+        }
+    }
+    debugLog("[host-runtime/redirect] fetching first workspace");
+    return fetchFirstWorkspaceId();
+}
+/**
+ * Remembers the workspace the user is in — reached by link, route change or the header
+ * workspace picker — so a later landing on a workspace-less URL returns here instead of the
+ * user's first workspace.
+ *
+ * Called only from the paths that resolved to an app the user may open, never from the
+ * not-found paths: a workspace whose URL maps to no app, or that grants the user no app at
+ * all, would otherwise stay remembered and send every later workspace-less landing back to
+ * the same 404 — which has no header, so there is no workspace picker to escape with.
+ *
+ * Also gated on loaded permissions: an inaccessible workspace reaches this point with
+ * `workspacePermissions` undefined (useWorkspacePermissions reports "forbidden" for 403/404).
+ */
+function rememberWorkspace(owner, workspaceId, ctx) {
+    if (workspaceId && ctx.workspacePermissions) {
+        setLastVisitedWorkspace(owner, workspaceId);
+    }
+}
 /**
  * Returns the last-visited app for the given scope if it is in the eligible list,
  * otherwise falls back to the first app.
@@ -90,9 +135,15 @@ function resolveOrgScopeTarget(apps, ctx, pathname) {
  * @throws {AppNotFoundError} The current path maps to no accessible application (show 404)
  * @throws {Error} Unexpected failure (show generic error screen)
  */
-export async function resolveRedirectTarget({ apps, ctx, pathname, search, fetchFirstWorkspaceId, }) {
+export async function resolveRedirectTarget({ apps, ctx, pathname, search, fetchFirstWorkspaceId, getWorkspaceAccess, }) {
     const scope = ctx.currentApplicationScope;
     const workspaceId = ctx.currentWorkspaceId;
+    // The user id is the same identifier the host uses elsewhere (e.g. for the workspace
+    // picker); the organization keeps entries apart when one origin serves several backends
+    const owner = {
+        organizationId: ctx.organization?.id,
+        userId: ctx.user.login,
+    };
     debugLog(`[host-runtime/redirect] resolveRedirectTarget: scope=${scope ?? "(none)"} workspaceId=${workspaceId ?? "(none)"} pathname=${pathname} apps=${apps.length}`);
     // Bare legacy app landing (/dashboards, /analyze, /metrics, /modeler — no workspace in the
     // hash; hash-bearing legacy URLs are rewritten synchronously before the host boots). The
@@ -101,8 +152,11 @@ export async function resolveRedirectTarget({ apps, ctx, pathname, search, fetch
     // (which would land on /organization or the preferred workspace app).
     const legacyAppRouteBase = mapBareLegacyPathToApp(pathname);
     if (legacyAppRouteBase) {
-        debugLog(`[host-runtime/redirect] bare legacy app path — fetching first workspace`);
-        const legacyWorkspaceId = await fetchFirstWorkspaceId();
+        debugLog(`[host-runtime/redirect] bare legacy app path — resolving landing workspace`);
+        const legacyWorkspaceId = await resolveLandingWorkspaceId(owner, {
+            fetchFirstWorkspaceId,
+            getWorkspaceAccess,
+        });
         if (!legacyWorkspaceId) {
             debugLog("[host-runtime/redirect] no workspace available for user — throwing not-found");
             throw new AppNotFoundError("No workspace is available for this user.");
@@ -121,10 +175,21 @@ export async function resolveRedirectTarget({ apps, ctx, pathname, search, fetch
         const active = getActiveInternalApplication(apps, ctx, pathname);
         if (!active) {
             debugLog(`[host-runtime/redirect] workspace scope: no app matched pathname → ${pathname} — throwing not-found`);
+            // This URL can be one the host built itself: a bare legacy landing (/analyze) is
+            // redirected into the remembered workspace's app path, and if that app is not
+            // permitted there it lands exactly here. Leaving the memory intact would send every
+            // later bare-legacy visit back to this same 404, which has no header and therefore no
+            // workspace picker to escape with. Forgetting costs one preference update — the next
+            // successful app navigation records it again — so it is the cheaper side to err on
+            // even for a merely mistyped path.
+            if (workspaceId) {
+                clearLastVisitedWorkspace(owner, workspaceId);
+            }
             throw new AppNotFoundError(`No application found at path: ${pathname}`);
         }
         debugLog(`[host-runtime/redirect] workspace scope: active app matched → ${active.id}`);
         setLastVisitedApp("workspace", active.id);
+        rememberWorkspace(owner, workspaceId, ctx);
         return null;
     }
     // At a workspace root (with or without workspace ID) or the top-level app root.
@@ -140,8 +205,11 @@ export async function resolveRedirectTarget({ apps, ctx, pathname, search, fetch
         }
         // Hop 1: resolve a workspace ID and redirect to its root so that the next render cycle
         // can load workspace permissions and filter apps accurately.
-        debugLog("[host-runtime/redirect] no workspace ID — fetching first workspace");
-        const resolvedWorkspaceId = await fetchFirstWorkspaceId();
+        debugLog("[host-runtime/redirect] no workspace ID — resolving landing workspace");
+        const resolvedWorkspaceId = await resolveLandingWorkspaceId(owner, {
+            fetchFirstWorkspaceId,
+            getWorkspaceAccess,
+        });
         if (!resolvedWorkspaceId) {
             debugLog("[host-runtime/redirect] no workspace available for user — throwing not-found");
             throw new AppNotFoundError("No workspace is available for this user.");
@@ -155,9 +223,16 @@ export async function resolveRedirectTarget({ apps, ctx, pathname, search, fetch
     const targetApp = preferLastVisitedApp(apps, "workspace");
     if (!targetApp) {
         debugLog("[host-runtime/redirect] no permitted workspace apps — throwing not-found");
+        // A workspace that grants this user no app at all must not stay remembered. It can have
+        // had apps when it was stored and lost them since (an app permission or feature flag
+        // changed), and the access check cannot see that: the permissions endpoint still
+        // succeeds. Without this, every later workspace-less landing would be sent straight back
+        // to this 404, which has no header and therefore no workspace picker to escape with.
+        clearLastVisitedWorkspace(owner, workspaceId);
         throw new AppNotFoundError("No workspace-scoped applications are available for this workspace.");
     }
     const href = getApplicationHref(targetApp, ctx, pathname);
     debugLog(`[host-runtime/redirect] redirecting to preferred workspace app → ${href} (app: ${targetApp.id})`);
+    rememberWorkspace(owner, workspaceId, ctx);
     return href;
 }

package/esm/loader/test/failingStorage.d.ts

@@ -0,0 +1,13 @@
+type StorageMethod = "getItem" | "setItem" | "removeItem";
+/**
+ * Runs `run` against a `localStorage` whose `method` throws, and returns how many times that
+ * throwing method was actually reached — so a test can prove it exercised the failure path
+ * instead of passing vacuously.
+ *
+ * The global is swapped out rather than spied on: under happy-dom `localStorage` is a proxy
+ * whose methods do not come from `Storage.prototype` (a prototype spy is never called) and
+ * whose instance spies survive `vi.restoreAllMocks()`, leaking into later tests.
+ */
+export declare function withFailingStorage(method: StorageMethod, run: () => void, seed?: Record<string, string>): number;
+export {};
+//# sourceMappingURL=failingStorage.d.ts.map

package/esm/loader/test/failingStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failingStorage.d.ts","sourceRoot":"","sources":["../../../src/loader/test/failingStorage.ts"],"names":[],"mappings":"AAEA,KAAK,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;AAE1D;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAC9B,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,MAAM,IAAI,EACf,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,MAAM,CAiCR"}

package/esm/loader/test/failingStorage.js

@@ -0,0 +1,43 @@
+// (C) 2026 GoodData Corporation
+/**
+ * Runs `run` against a `localStorage` whose `method` throws, and returns how many times that
+ * throwing method was actually reached — so a test can prove it exercised the failure path
+ * instead of passing vacuously.
+ *
+ * The global is swapped out rather than spied on: under happy-dom `localStorage` is a proxy
+ * whose methods do not come from `Storage.prototype` (a prototype spy is never called) and
+ * whose instance spies survive `vi.restoreAllMocks()`, leaking into later tests.
+ */
+export function withFailingStorage(method, run, seed = {}) {
+    // Seeded directly, so a test can start from stored state even when `setItem` is the method
+    // that throws
+    const store = new Map(Object.entries(seed));
+    let failedCalls = 0;
+    const fake = {
+        getItem: (key) => store.get(key) ?? null,
+        setItem: (key, value) => {
+            store.set(key, value);
+        },
+        removeItem: (key) => {
+            store.delete(key);
+        },
+    };
+    fake[method] = () => {
+        failedCalls++;
+        throw new Error(`localStorage.${method} is unavailable`);
+    };
+    const original = Object.getOwnPropertyDescriptor(globalThis, "localStorage");
+    Object.defineProperty(globalThis, "localStorage", { value: fake, configurable: true });
+    try {
+        run();
+    }
+    finally {
+        if (original) {
+            Object.defineProperty(globalThis, "localStorage", original);
+        }
+        else {
+            Reflect.deleteProperty(globalThis, "localStorage");
+        }
+    }
+    return failedCalls;
+}

package/esm/platformContext/useWorkspacePermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useWorkspacePermissions.d.ts","sourceRoot":"","sources":["../../src/platformContext/useWorkspacePermissions.ts"],"names":[],"mappings":"AAIA,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,KAAK,yBAAyB,GACxB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACjB;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,qBAAqB,CAAA;CAAE,GACtD;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,GACtB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,WAAW,EAAE,MAAM,GAAG,SAAS,GAChC,yBAAyB,CA2C3B"}
+{"version":3,"file":"useWorkspacePermissions.d.ts","sourceRoot":"","sources":["../../src/platformContext/useWorkspacePermissions.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAIjE,KAAK,yBAAyB,GACxB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACjB;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,qBAAqB,CAAA;CAAE,GACtD;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,GACtB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAYxC;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,WAAW,EAAE,MAAM,GAAG,SAAS,GAChC,yBAAyB,CA6D3B"}

package/esm/platformContext/useWorkspacePermissions.js

@@ -1,6 +1,8 @@
 // (C) 2026 GoodData Corporation
 import { useEffect, useState } from "react";
-import { UnexpectedResponseError } from "@gooddata/sdk-backend-spi";
+import { classifyWorkspaceAccessError } from "./workspaceAccess.js";
+const IDLE = { state: "idle" };
+const LOADING = { state: "loading" };
 /**
  * Loads workspace permissions for the current user.
  *
@@ -11,42 +13,55 @@ import { UnexpectedResponseError } from "@gooddata/sdk-backend-spi";
  * @internal
  */
 export function useWorkspacePermissions(backend, workspaceId) {
-    const [permissionsState, setPermissionsState] = useState({
-        state: "idle",
+    const [snapshot, setSnapshot] = useState({
+        backend: undefined,
+        workspaceId: undefined,
+        state: IDLE,
     });
     useEffect(() => {
         if (!backend || !workspaceId) {
-            setPermissionsState((prev) => (prev.state === "idle" ? prev : { state: "idle" }));
+            setSnapshot((prev) => prev.state === IDLE && prev.backend === undefined && prev.workspaceId === undefined
+                ? prev
+                : { backend: undefined, workspaceId: undefined, state: IDLE });
             return;
         }
         let cancelled = false;
-        setPermissionsState({ state: "loading" });
+        setSnapshot({ backend, workspaceId, state: LOADING });
+        const update = (state) => {
+            if (!cancelled) {
+                setSnapshot({ backend, workspaceId, state });
+            }
+        };
         backend
             .workspace(workspaceId)
             .permissions()
             .getPermissionsForCurrentUser()
             .then((permissions) => {
-            if (!cancelled) {
-                setPermissionsState({ state: "ready", permissions });
-            }
+            update({ state: "ready", permissions });
         })
             .catch((e) => {
-            if (cancelled)
-                return;
-            // 403/404 on the workspace permissions endpoint means no access — Tiger uses
-            // 404 to avoid leaking workspace existence (same message as 403). Signal
-            // "forbidden" so the platform context reaches "ready" with undefined permissions
-            // and the mounted app can render its own access-denied UI.
-            if (e instanceof UnexpectedResponseError && (e.httpStatus === 403 || e.httpStatus === 404)) {
-                setPermissionsState({ state: "forbidden" });
+            // No access signals "forbidden" rather than an error, so the platform context
+            // reaches "ready" with undefined permissions and the mounted app can render its
+            // own access-denied UI. The 403/404 rule itself lives in workspaceAccess.ts,
+            // shared with the redirect resolver.
+            if (classifyWorkspaceAccessError(e) === "forbidden") {
+                update({ state: "forbidden" });
                 return;
             }
             const error = e instanceof Error ? e.message : "Unknown error loading workspace permissions.";
-            setPermissionsState({ state: "error", error });
+            update({ state: "error", error });
         });
         return () => {
             cancelled = true;
         };
     }, [backend, workspaceId]);
-    return permissionsState;
+    if (!backend || !workspaceId) {
+        return IDLE;
+    }
+    // A backend or workspaceId change is reported as "loading" from the very first render: the
+    // fetch effect runs a beat later, and until it does the stored state still describes the
+    // PREVIOUS backend/workspace. Callers gate on this state to decide what the current
+    // workspace allows, so handing them permissions from another workspace — or from a
+    // previous session's backend — even for one render is a correctness bug.
+    return snapshot.backend === backend && snapshot.workspaceId === workspaceId ? snapshot.state : LOADING;
 }

package/esm/platformContext/workspaceAccess.d.ts

@@ -0,0 +1,32 @@
+import { type IAnalyticalBackend } from "@gooddata/sdk-backend-spi";
+/**
+ * Outcome of checking whether a workspace can be opened by the current user.
+ *
+ * `unknown` is deliberately distinct from `forbidden`: the check itself failing (offline,
+ * 5xx) says nothing about the workspace, so it must not be treated as "you cannot open it".
+ *
+ * @internal
+ */
+export type WorkspaceAccess = "accessible" | "forbidden" | "unknown";
+/**
+ * Classifies a failed workspace-permissions request.
+ *
+ * 403 and 404 both mean no access — Tiger answers 404, with the same message as 403, to avoid
+ * leaking whether a workspace exists. Everything else is inconclusive.
+ *
+ * The single owner of this rule: both the platform context (which gates workspace routes on
+ * it) and the redirect resolver (which decides whether to keep a remembered workspace) must
+ * agree, or the host can gate on "forbidden" while the resolver keeps sending the user back.
+ *
+ * @internal
+ */
+export declare function classifyWorkspaceAccessError(e: unknown): "forbidden" | "unknown";
+/**
+ * Resolves whether the given workspace can be opened by the current user, using the very
+ * request the platform context gates workspace routes on — so a workspace the host redirects
+ * into is one it can actually load.
+ *
+ * @internal
+ */
+export declare function getWorkspaceAccess(backend: IAnalyticalBackend, workspaceId: string): Promise<WorkspaceAccess>;
+//# sourceMappingURL=workspaceAccess.d.ts.map

package/esm/platformContext/workspaceAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceAccess.d.ts","sourceRoot":"","sources":["../../src/platformContext/workspaceAccess.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE7F;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,WAAW,GAAG,SAAS,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAIhF;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAC9B,OAAO,EAAE,kBAAkB,EAC3B,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,eAAe,CAAC,CAM1B"}

package/esm/platformContext/workspaceAccess.js

@@ -0,0 +1,33 @@
+// (C) 2026 GoodData Corporation
+import { UnexpectedResponseError } from "@gooddata/sdk-backend-spi";
+/**
+ * Classifies a failed workspace-permissions request.
+ *
+ * 403 and 404 both mean no access — Tiger answers 404, with the same message as 403, to avoid
+ * leaking whether a workspace exists. Everything else is inconclusive.
+ *
+ * The single owner of this rule: both the platform context (which gates workspace routes on
+ * it) and the redirect resolver (which decides whether to keep a remembered workspace) must
+ * agree, or the host can gate on "forbidden" while the resolver keeps sending the user back.
+ *
+ * @internal
+ */
+export function classifyWorkspaceAccessError(e) {
+    return e instanceof UnexpectedResponseError && (e.httpStatus === 403 || e.httpStatus === 404)
+        ? "forbidden"
+        : "unknown";
+}
+/**
+ * Resolves whether the given workspace can be opened by the current user, using the very
+ * request the platform context gates workspace routes on — so a workspace the host redirects
+ * into is one it can actually load.
+ *
+ * @internal
+ */
+export function getWorkspaceAccess(backend, workspaceId) {
+    return backend
+        .workspace(workspaceId)
+        .permissions()
+        .getPermissionsForCurrentUser()
+        .then(() => "accessible", classifyWorkspaceAccessError);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gooddata/sdk-ui-pluggable-host",
-  "version": "11.50.0",
+  "version": "11.51.0-alpha.1",
   "description": "GoodData SDK runtime for hosting pluggable applications — registry, loader, routing, platform context, default UI chrome",
   "license": "MIT",
   "author": "GoodData Corporation",
@@ -29,20 +29,20 @@
   "dependencies": {
     "@module-federation/runtime": "2.6.0",
     "lodash-es": "^4.17.23",
-    "@gooddata/sdk-backend-base": "11.50.0",
-    "@gooddata/sdk-embedding": "11.50.0",
-    "@gooddata/sdk-model": "11.50.0",
-    "@gooddata/sdk-backend-tiger": "11.50.0",
-    "@gooddata/sdk-pluggable-application-model": "11.50.0",
-    "@gooddata/sdk-backend-spi": "11.50.0",
-    "@gooddata/sdk-ui": "11.50.0",
-    "@gooddata/sdk-ui-application-header": "11.50.0",
-    "@gooddata/sdk-ui-ext": "11.50.0",
-    "@gooddata/sdk-ui-kit": "11.50.0",
-    "@gooddata/sdk-ui-semantic-search": "11.50.0",
-    "@gooddata/sdk-ui-gen-ai": "11.50.0",
-    "@gooddata/sdk-ui-theme-provider": "11.50.0",
-    "@gooddata/util": "11.50.0"
+    "@gooddata/sdk-backend-base": "11.51.0-alpha.1",
+    "@gooddata/sdk-backend-spi": "11.51.0-alpha.1",
+    "@gooddata/sdk-backend-tiger": "11.51.0-alpha.1",
+    "@gooddata/sdk-embedding": "11.51.0-alpha.1",
+    "@gooddata/sdk-model": "11.51.0-alpha.1",
+    "@gooddata/sdk-pluggable-application-model": "11.51.0-alpha.1",
+    "@gooddata/sdk-ui": "11.51.0-alpha.1",
+    "@gooddata/sdk-ui-application-header": "11.51.0-alpha.1",
+    "@gooddata/sdk-ui-ext": "11.51.0-alpha.1",
+    "@gooddata/sdk-ui-gen-ai": "11.51.0-alpha.1",
+    "@gooddata/sdk-ui-semantic-search": "11.51.0-alpha.1",
+    "@gooddata/sdk-ui-kit": "11.51.0-alpha.1",
+    "@gooddata/sdk-ui-theme-provider": "11.51.0-alpha.1",
+    "@gooddata/util": "11.51.0-alpha.1"
   },
   "devDependencies": {
     "@microsoft/api-documenter": "^7.17.0",
@@ -85,8 +85,8 @@
     "vite": "8.0.16",
     "vitest": "4.1.8",
     "vitest-dom": "0.1.1",
-    "@gooddata/eslint-config": "11.50.0",
-    "@gooddata/oxlint-config": "11.50.0"
+    "@gooddata/eslint-config": "11.51.0-alpha.1",
+    "@gooddata/oxlint-config": "11.51.0-alpha.1"
   },
   "peerDependencies": {
     "react": ">=18.3.1",