@parallelworks/ui 0.55.0 → 0.57.0

package/dist/access/model.d.ts

@@ -1,44 +1,87 @@
-import type { AccessChange, AccessGrant, AccessGroup, AccessPermission, AccessRole } from './types.js';
+import type { AccessChange, AccessGrant, AccessInheritedGrant, AccessPermission, AccessPrincipal, AccessRole } from './types.js';
+/** A role someone has without holding it here themselves. */
+export interface Holding {
+    role: AccessRole;
+    /** The group, or everyone, it comes through; undefined when it is their own. */
+    through?: AccessPrincipal | undefined;
+    /** Where it was granted, when it was granted above the resource. */
+    from?: string | undefined;
+}
 /** The grants indexed for the questions the drawer asks of them. */
 export interface AccessModel {
     roles: readonly AccessRole[];
+    /** The roles that can be granted here, in the roles' order. */
+    grantable: readonly AccessRole[];
     roleById: ReadonlyMap<string, AccessRole>;
-    groupById: ReadonlyMap<string, AccessGroup>;
-    everyone: AccessGroup | undefined;
-    /** The roles each group holds itself, in the roles' order. */
+    principalById: ReadonlyMap<string, AccessPrincipal>;
+    everyone: AccessPrincipal | undefined;
+    /** Holds every permission and can't be removed. */
+    owner: AccessPrincipal | undefined;
+    /** The roles each principal holds itself, here, in the roles' order. */
     held: ReadonlyMap<string, readonly AccessRole[]>;
-    /** The groups holding each role, in the order the host gave the groups. */
-    holders: ReadonlyMap<string, readonly AccessGroup[]>;
+    /** The principals holding each role here, in the order the host gave the principals. */
+    holders: ReadonlyMap<string, readonly AccessPrincipal[]>;
+    /** The roles each principal holds through somewhere above the resource, in the roles' order. */
+    inherited: ReadonlyMap<string, readonly {
+        role: AccessRole;
+        from: string;
+    }[]>;
+    /** The principals holding each role through somewhere above the resource. */
+    inheritedHolders: ReadonlyMap<string, readonly {
+        principal: AccessPrincipal;
+        from: string;
+    }[]>;
     permissionLabel: (id: string) => string;
 }
-export declare function buildModel(roles: readonly AccessRole[], groups: readonly AccessGroup[], grants: readonly AccessGrant[], permissions?: readonly AccessPermission[]): AccessModel;
+export interface ModelInput {
+    roles: readonly AccessRole[];
+    principals: readonly AccessPrincipal[];
+    grants: readonly AccessGrant[];
+    permissions?: readonly AccessPermission[] | undefined;
+    inherited?: readonly AccessInheritedGrant[] | undefined;
+    owner?: string | undefined;
+}
+export declare function buildModel({ roles, principals, grants, permissions, inherited, owner, }: ModelInput): AccessModel;
 export declare const key: (grant: AccessGrant) => string;
 /** Whether `by` gives every permission `role` does. A role with no permissions covers nothing
  *  and is covered by nothing, so two empty placeholders never read as duplicates. */
 export declare function covers(by: AccessRole, role: AccessRole): boolean;
-/** The roles a group's members have through everyone, which it doesn't hold itself. */
-export declare function inheritedRoles(model: AccessModel, groupId: string): AccessRole[];
-/** Why a role a group holds is redundant: its other roles that already give everything this one
- *  does, and whether everyone has it already. */
+export declare const isOwner: (model: AccessModel, principalId: string) => boolean;
+/** Who has access in the order the list shows them: the owner, everyone, then the rest in the
+ *  host's order. */
+export declare function principalsWithAccess(model: AccessModel): AccessPrincipal[];
+/** The groups, and everyone, whose roles a principal has as well as its own. */
+export declare function sourcesOf(model: AccessModel, principalId: string): AccessPrincipal[];
+/** Every role a principal has besides those it holds here itself: its own granted above the
+ *  resource, then its groups', then everyone's. */
+export declare function alsoHas(model: AccessModel, principalId: string): Holding[];
+/** The first holding of each role, so a role reached two ways is named once. */
+export declare function firstOfEach(holdings: readonly Holding[]): Holding[];
+/** Why a role a principal holds is redundant: it owns the resource, its other roles here give
+ *  everything this one does, or it has this one, or one that covers it, somewhere else. */
 export interface Overlap {
+    owner: boolean;
     coveredBy: AccessRole[];
-    everyone: boolean;
+    elsewhere: Holding[];
 }
-export declare function overlapOf(model: AccessModel, groupId: string, role: AccessRole): Overlap;
-/** What taking roles from a group does to its members. */
+export declare function overlapOf(model: AccessModel, principalId: string, role: AccessRole): Overlap;
+/** What taking roles from a principal does to whoever it stands for. */
 export interface Removal {
-    /** The permissions they no longer have from any role, in the order the roles list them. */
+    /** The permissions no longer given by any role they keep, in the order the roles list them. */
     lost: string[];
-    /** Roles still giving them some of what the removed roles gave: their own others, then
-     *  everyone's. */
+    /** Its own roles here still giving some of what the removed roles gave. */
     keep: AccessRole[];
-    keepThroughEveryone: AccessRole[];
+    /** Roles it has elsewhere still giving some of it: granted above, or through its groups or
+     *  everyone. */
+    keepElsewhere: Holding[];
+    /** The owner loses nothing, as owning gives every permission. */
+    owner: boolean;
 }
-/** What the group loses: the removed roles' permissions that no role it keeps, its own or
- *  everyone's, still gives. */
-export declare function removalOf(model: AccessModel, groupId: string, roleIds: readonly string[]): Removal;
-/** Granting each role to each group: the grants that add something, and the pairs held already. */
-export declare function grantPlan(model: AccessModel, groupIds: readonly string[], roleIds: readonly string[]): {
+/** What the principal loses: the removed roles' permissions that nothing it keeps still gives. */
+export declare function removalOf(model: AccessModel, principalId: string, roleIds: readonly string[]): Removal;
+/** Granting each role to each principal: the grants that add something, and the pairs held
+ *  already. The owner holds every role already. */
+export declare function grantPlan(model: AccessModel, principalIds: readonly string[], roleIds: readonly string[]): {
     grant: AccessGrant[];
     held: AccessGrant[];
 };
@@ -46,4 +89,4 @@ export declare function grantPlan(model: AccessModel, groupIds: readonly string[
 export declare function invert(change: AccessChange): AccessChange;
 /** Warns, in a development build, about props that would make the drawer wrong in a way that
  *  is easy to miss: a duplicate id shows one of two, and an unknown id shows nothing. */
-export declare function warnAboutMisuse(roles: readonly AccessRole[], groups: readonly AccessGroup[], grants: readonly AccessGrant[], permissions: readonly AccessPermission[] | undefined): void;
+export declare function warnAboutMisuse({ roles, principals, grants, permissions, inherited, owner, }: ModelInput): void;

package/dist/access/model.js

@@ -1,31 +1,52 @@
 import { isDev } from "../dev.js";
 //#region src/access/model.ts
-function buildModel(roles, groups, grants, permissions = []) {
+function buildModel({ roles, principals, grants, permissions = [], inherited = [], owner }) {
 	const roleById = new Map(roles.map((role) => [role.id, role]));
-	const groupById = new Map(groups.map((group) => [group.id, group]));
+	const principalById = new Map(principals.map((principal) => [principal.id, principal]));
 	const granted = new Set(grants.map(key));
+	const inheritedFrom = /* @__PURE__ */ new Map();
+	for (const grant of inherited) if (!inheritedFrom.has(key(grant))) inheritedFrom.set(key(grant), grant.from);
 	const held = /* @__PURE__ */ new Map();
 	const holders = /* @__PURE__ */ new Map();
-	for (const group of groups) {
-		const own = roles.filter((role) => granted.has(key({
-			groupId: group.id,
+	const inheritedOf = /* @__PURE__ */ new Map();
+	const inheritedHolders = /* @__PURE__ */ new Map();
+	for (const principal of principals) for (const role of roles) {
+		const k = key({
+			principalId: principal.id,
 			roleId: role.id
-		})));
-		if (own.length > 0) held.set(group.id, own);
-		for (const role of own) holders.set(role.id, [...holders.get(role.id) ?? [], group]);
+		});
+		if (granted.has(k)) {
+			held.set(principal.id, [...held.get(principal.id) ?? [], role]);
+			holders.set(role.id, [...holders.get(role.id) ?? [], principal]);
+		}
+		const from = inheritedFrom.get(k);
+		if (from !== void 0) {
+			inheritedOf.set(principal.id, [...inheritedOf.get(principal.id) ?? [], {
+				role,
+				from
+			}]);
+			inheritedHolders.set(role.id, [...inheritedHolders.get(role.id) ?? [], {
+				principal,
+				from
+			}]);
+		}
 	}
 	const labels = new Map(permissions.map((p) => [p.id, p.label]));
 	return {
 		roles,
+		grantable: roles.filter((role) => role.grantable !== false),
 		roleById,
-		groupById,
-		everyone: groups.find((group) => group.kind === "everyone"),
+		principalById,
+		everyone: principals.find((principal) => principal.kind === "everyone"),
+		owner: owner === void 0 ? void 0 : principalById.get(owner),
 		held,
 		holders,
+		inherited: inheritedOf,
+		inheritedHolders,
 		permissionLabel: (id) => labels.get(id) ?? id
 	};
 }
-var key = (grant) => `${grant.groupId}\u0000${grant.roleId}`;
+var key = (grant) => `${grant.principalId}\u0000${grant.roleId}`;
 var permissionsOf = (roles) => new Set(roles.flatMap((role) => role.permissions));
 /** Whether `by` gives every permission `role` does. A role with no permissions covers nothing
 *  and is covered by nothing, so two empty placeholders never read as duplicates. */
@@ -34,32 +55,71 @@ function covers(by, role) {
 	const given = new Set(by.permissions);
 	return role.permissions.every((p) => given.has(p));
 }
-var isEveryone = (model, groupId) => model.everyone?.id === groupId;
-/** The roles a group's members have through everyone, which it doesn't hold itself. */
-function inheritedRoles(model, groupId) {
-	if (!model.everyone || isEveryone(model, groupId)) return [];
-	const own = new Set((model.held.get(groupId) ?? []).map((role) => role.id));
-	return (model.held.get(model.everyone.id) ?? []).filter((role) => !own.has(role.id));
+var isOwner = (model, principalId) => model.owner !== void 0 && model.owner.id === principalId;
+/** Who has access in the order the list shows them: the owner, everyone, then the rest in the
+*  host's order. */
+function principalsWithAccess(model) {
+	const rest = [...model.principalById.values()].filter((principal) => principal.id !== model.owner?.id && principal.id !== model.everyone?.id && (model.held.has(principal.id) || model.inherited.has(principal.id)));
+	const everyone = model.everyone && model.everyone.id !== model.owner?.id && (model.held.has(model.everyone.id) || model.inherited.has(model.everyone.id)) ? [model.everyone] : [];
+	return [
+		...model.owner ? [model.owner] : [],
+		...everyone,
+		...rest
+	];
+}
+/** The groups, and everyone, whose roles a principal has as well as its own. */
+function sourcesOf(model, principalId) {
+	const principal = model.principalById.get(principalId);
+	if (!principal || principal.kind === "everyone") return [];
+	const groups = principal.kind === "user" ? (principal.groupIds ?? []).map((id) => model.principalById.get(id)).filter((group) => group?.kind === "group") : [];
+	return model.everyone ? [...groups, model.everyone] : groups;
+}
+/** Every role a principal has besides those it holds here itself: its own granted above the
+*  resource, then its groups', then everyone's. */
+function alsoHas(model, principalId) {
+	const own = (model.inherited.get(principalId) ?? []).map(({ role, from }) => ({
+		role,
+		from
+	}));
+	const through = sourcesOf(model, principalId).flatMap((source) => [...(model.held.get(source.id) ?? []).map((role) => ({
+		role,
+		through: source
+	})), ...(model.inherited.get(source.id) ?? []).map(({ role, from }) => ({
+		role,
+		through: source,
+		from
+	}))]);
+	return [...own, ...through];
+}
+/** The first holding of each role, so a role reached two ways is named once. */
+function firstOfEach(holdings) {
+	const seen = /* @__PURE__ */ new Set();
+	return holdings.filter((holding) => {
+		if (seen.has(holding.role.id)) return false;
+		seen.add(holding.role.id);
+		return true;
+	});
 }
-function overlapOf(model, groupId, role) {
-	const own = (model.held.get(groupId) ?? []).filter((other) => other.id !== role.id);
-	const everyoneRoles = model.everyone && !isEveryone(model, groupId) ? model.held.get(model.everyone.id) ?? [] : [];
+function overlapOf(model, principalId, role) {
+	const own = (model.held.get(principalId) ?? []).filter((other) => other.id !== role.id);
 	return {
+		owner: isOwner(model, principalId),
 		coveredBy: own.filter((other) => covers(other, role)),
-		everyone: everyoneRoles.some((other) => other.id === role.id || covers(other, role))
+		elsewhere: alsoHas(model, principalId).filter((holding) => holding.role.id === role.id || covers(holding.role, role))
 	};
 }
-/** What the group loses: the removed roles' permissions that no role it keeps, its own or
-*  everyone's, still gives. */
-function removalOf(model, groupId, roleIds) {
+/** What the principal loses: the removed roles' permissions that nothing it keeps still gives. */
+function removalOf(model, principalId, roleIds) {
 	const removing = new Set(roleIds);
-	const removed = (model.held.get(groupId) ?? []).filter((role) => removing.has(role.id));
-	const keep = (model.held.get(groupId) ?? []).filter((role) => !removing.has(role.id));
-	const throughEveryone = inheritedRoles(model, groupId);
-	const still = permissionsOf([...keep, ...throughEveryone]);
+	const own = model.held.get(principalId) ?? [];
+	const removed = own.filter((role) => removing.has(role.id));
+	const keep = own.filter((role) => !removing.has(role.id));
+	const elsewhere = firstOfEach(alsoHas(model, principalId)).filter((holding) => !keep.some((role) => role.id === holding.role.id));
+	const owner = isOwner(model, principalId);
+	const still = permissionsOf([...keep, ...elsewhere.map((holding) => holding.role)]);
 	const taken = permissionsOf(removed);
-	const lost = [...taken].filter((p) => !still.has(p));
-	const share = new Map([...keep, ...throughEveryone].map((role) => [role.id, new Set(role.permissions.filter((p) => taken.has(p)))]));
+	const lost = owner ? [] : [...taken].filter((p) => !still.has(p));
+	const share = new Map([...keep, ...elsewhere.map((holding) => holding.role)].map((role) => [role.id, new Set(role.permissions.filter((p) => taken.has(p)))]));
 	const worth = (role) => {
 		const mine = share.get(role.id) ?? /* @__PURE__ */ new Set();
 		return mine.size > 0 && ![...share].some(([id, theirs]) => id !== role.id && [...mine].every((p) => theirs.has(p)) && (theirs.size > mine.size || id < role.id));
@@ -67,17 +127,20 @@ function removalOf(model, groupId, roleIds) {
 	return {
 		lost,
 		keep: keep.filter(worth),
-		keepThroughEveryone: throughEveryone.filter(worth)
+		keepElsewhere: elsewhere.filter((holding) => worth(holding.role)),
+		owner
 	};
 }
-/** Granting each role to each group: the grants that add something, and the pairs held already. */
-function grantPlan(model, groupIds, roleIds) {
+/** Granting each role to each principal: the grants that add something, and the pairs held
+*  already. The owner holds every role already. */
+function grantPlan(model, principalIds, roleIds) {
 	const grant = [];
 	const held = [];
-	for (const groupId of groupIds) {
-		const own = new Set((model.held.get(groupId) ?? []).map((role) => role.id));
-		for (const roleId of roleIds) (own.has(roleId) ? held : grant).push({
-			groupId,
+	for (const principalId of principalIds) {
+		const own = new Set((model.held.get(principalId) ?? []).map((role) => role.id));
+		const owner = isOwner(model, principalId);
+		for (const roleId of roleIds) (owner || own.has(roleId) ? held : grant).push({
+			principalId,
 			roleId
 		});
 	}
@@ -95,21 +158,22 @@ function invert(change) {
 }
 /** Warns, in a development build, about props that would make the drawer wrong in a way that
 *  is easy to miss: a duplicate id shows one of two, and an unknown id shows nothing. */
-function warnAboutMisuse(roles, groups, grants, permissions) {
+function warnAboutMisuse({ roles, principals, grants, permissions, inherited = [], owner }) {
 	if (!isDev()) return;
 	const warn = (message) => console.warn(`AccessDrawer: ${message}`);
 	for (const id of duplicates(roles.map((role) => role.id))) warn(`two roles share the id "${id}"; ids must be unique.`);
-	for (const id of duplicates(groups.map((group) => group.id))) warn(`two groups share the id "${id}"; ids must be unique.`);
-	if (groups.filter((group) => group.kind === "everyone").length > 1) warn("more than one group is everyone; only the first counts.");
+	for (const id of duplicates(principals.map((principal) => principal.id))) warn(`two principals share the id "${id}"; ids must be unique.`);
+	if (principals.filter((principal) => principal.kind === "everyone").length > 1) warn("more than one principal is everyone; only the first counts.");
 	const roleIds = new Set(roles.map((role) => role.id));
-	const groupIds = new Set(groups.map((group) => group.id));
-	for (const grant of grants) {
-		if (!roleIds.has(grant.roleId)) warn(`a grant names the unknown role "${grant.roleId}"; it isn't shown.`);
-		if (!groupIds.has(grant.groupId)) warn(`a grant names the unknown group "${grant.groupId}"; pass every granted group.`);
+	const principalIds = new Set(principals.map((principal) => principal.id));
+	if (owner !== void 0 && !principalIds.has(owner)) warn(`the owner "${owner}" isn't among the principals; pass the owner too.`);
+	for (const [kind, list] of [["grant", grants], ["inherited grant", inherited]]) for (const grant of list) {
+		if (!roleIds.has(grant.roleId)) warn(`a ${kind} names the unknown role "${grant.roleId}"; it isn't shown.`);
+		if (!principalIds.has(grant.principalId)) warn(`a ${kind} names the unknown principal "${grant.principalId}"; pass everyone who holds a role.`);
 	}
 	for (const k of duplicates(grants.map(key))) {
-		const [groupId, roleId] = k.split("\0");
-		warn(`the grant of "${roleId}" to "${groupId}" is listed twice.`);
+		const [principalId, roleId] = k.split("\0");
+		warn(`the grant of "${roleId}" to "${principalId}" is listed twice.`);
 	}
 	if (permissions) {
 		const known = new Set(permissions.map((p) => p.id));
@@ -126,4 +190,4 @@ function duplicates(ids) {
 	return [...repeated];
 }
 //#endregion
-export { buildModel, covers, grantPlan, inheritedRoles, invert, key, overlapOf, removalOf, warnAboutMisuse };
+export { alsoHas, buildModel, covers, firstOfEach, grantPlan, invert, isOwner, key, overlapOf, principalsWithAccess, removalOf, sourcesOf, warnAboutMisuse };

package/dist/access/strings.d.ts

@@ -2,19 +2,20 @@ import { type ReactNode } from 'react';
 import { type UIStrings } from '../components/Provider.js';
 export declare const ACCESS_STRINGS: {
     title: string;
-    /** Under the title: the resource, and how many groups have a role on it. */
-    summary: (resource: string, groups: number, everyone: boolean) => string;
+    /** Under the title: the resource, and who has a role on it. */
+    summary: (resource: string, people: number, groups: number, everyone: boolean) => string;
     /** Names the switch between the two ways of listing who has access. */
     arrange: string;
     byRole: string;
-    byGroup: string;
+    byPrincipal: string;
     filter: string;
     grantAccess: string;
-    highImpact: string;
+    privileged: string;
     loading: string;
-    groups: (n: number) => string;
-    /** How many of a role's groups a filter left. */
-    groupsShown: (shown: number, total: number) => string;
+    /** Who holds a role: "1 person, 2 groups". */
+    holders: (people: number, groups: number) => string;
+    /** How many of a role's holders a filter left. */
+    holdersShown: (shown: number, total: number) => string;
     members: (n: number) => string;
     people: (n: number) => string;
     /** Everyone, where it is short: a tag or a picker row. */
@@ -22,38 +23,55 @@ export declare const ACCESS_STRINGS: {
     /** Everyone, where it stands as a row of its own. */
     everyoneInOrganization: string;
     everyoneJoinLater: string;
-    /** Read with the badges a group row folds away: "+2". */
+    owner: string;
+    /** Under the owner section and row. */
+    ownerDescription: string;
+    /** Read with the badges a row folds away: "+2". */
     moreRoles: (n: number) => string;
     moreRolesLabel: (roles: readonly string[]) => string;
-    /** Beside a group whose other role gives everything this one does. */
+    /** Beside someone whose other role gives everything this one does. */
     coveredBy: (roles: readonly string[]) => string;
-    /** Beside a group that has this through everyone as well. */
+    /** Beside the owner, who has every role's permissions anyway. */
+    ownerHasAll: string;
+    /** Beside someone who has this through everyone as well. */
     everyoneHasThisToo: string;
-    /** A role a group holds that another of its roles already gives. */
+    /** Beside someone who has this through their groups, or an inherited role, as well. */
+    throughToo: (from: readonly string[]) => string;
+    /** A role someone holds that another of their roles already gives. */
     redundant: (roles: readonly string[]) => string;
-    /** A role a group has only because everyone does. */
+    redundantOwner: string;
+    /** A role someone has only because everyone does. */
     throughEveryone: string;
-    removeRole: (group: string, role: string) => string;
+    /** A role someone has through one of their groups, or an inherited role. */
+    through: (from: string) => string;
+    /** A role granted somewhere else, which can't be removed here. */
+    inheritedFrom: (from: string) => string;
+    removeRole: (principal: string, role: string) => string;
     grantMoreRoles: string;
     removeAllAccess: string;
-    removeTitle: (group: string, roles: readonly string[]) => string;
-    removeAllTitle: (group: string) => string;
-    /** Leads the list of what a group loses; `members` is undefined when the count isn't known. */
-    losesIntro: (members: number | undefined, everyone: boolean) => string;
-    /** After the list: why these are lost, and what they keep. */
-    keeps: (own: readonly string[], throughEveryone: readonly string[]) => string;
-    /** When the roles it keeps give everything the removed ones did. */
-    losesNothing: (own: readonly string[], throughEveryone: readonly string[]) => string;
+    removeTitle: (principal: string, roles: readonly string[]) => string;
+    removeAllTitle: (principal: string) => string;
+    /** Heads the list of what is lost; `members` is undefined when a group's size isn't known. */
+    losesIntro: (kind: 'user' | 'group' | 'everyone', members: number | undefined) => string;
+    /** After the list: what they keep, their own roles and those through their groups, inherited
+     *  roles or everyone. Empty when they keep nothing. */
+    keeps: (own: readonly string[], throughEveryone: readonly string[], through: readonly {
+        from: string;
+        roles: readonly string[];
+    }[]) => string;
+    /** When the roles they keep give everything the removed ones did. */
+    losesNothing: (roles: readonly string[]) => string;
+    ownerLosesNothing: string;
     confirmRemove: (roles: readonly string[]) => string;
-    removeFailed: (group: string, roles: readonly string[]) => string;
-    grantFailed: (groups: readonly string[], roles: readonly string[]) => string;
+    removeFailed: (principal: string, roles: readonly string[]) => string;
+    grantFailed: (principals: readonly string[], roles: readonly string[]) => string;
     undoFailed: string;
     /** Under a failed save; `reason` is the host's error message, when it gave one. */
     nothingChanged: (reason: string | undefined) => string;
     /** The toast after a grant. */
-    granted: (groups: readonly string[], roles: readonly string[]) => string;
+    granted: (principals: readonly string[], roles: readonly string[]) => string;
     /** The toast after a removal. */
-    removed: (groups: readonly string[], roles: readonly string[]) => string;
+    removed: (principals: readonly string[], roles: readonly string[]) => string;
     undone: string;
     readOnly: string;
     /** After `readOnly` when the host gives no reason. */
@@ -63,30 +81,33 @@ export declare const ACCESS_STRINGS: {
     noMatches: string;
     clearFilter: string;
     back: string;
-    groupsLabel: string;
-    addGroup: string;
-    /** Under the groups field; `count` is undefined when the host doesn't say how many there are. */
-    groupsHint: (count: number | undefined, everyone: boolean) => string;
+    principalsLabel: string;
+    addPrincipal: string;
+    /** Under the people and groups field; a count is undefined when the host doesn't give it. */
+    pickerHint: (people: number | undefined, groups: number | undefined, everyone: boolean) => string;
     everyoneCoversGroups: string;
     organization: string;
     recent: string;
-    allGroups: string;
-    /** On a group's row in the picker: the roles it holds here. */
+    peopleSection: string;
+    groupsSection: string;
+    /** On a row in the picker: the roles it holds here. */
     hasRoles: (roles: readonly string[]) => string;
     /** Read with a group's row: its size, where it comes from and its roles here. */
     groupSummary: (members: number | undefined, everyone: boolean, source: 'synced' | 'manual' | undefined, roles: readonly string[]) => string;
+    /** Read with a person's row: what tells them apart, and their roles here. */
+    personSummary: (detail: string | undefined, owner: boolean, roles: readonly string[]) => string;
     rolesLabel: string;
     searchRoles: string;
     /** On a role's row in the picker. */
-    alreadyHave: (groups: readonly string[]) => string;
+    alreadyHave: (principals: readonly string[]) => string;
     alreadyCovered: (roles: readonly string[]) => string;
     everyoneHasIt: string;
     /** The footer's account of what pressing Grant does. */
-    grantSummary: (groups: readonly string[], roles: readonly string[]) => ReactNode;
-    /** Why Grant can't be pressed: every group has every role already. */
-    nothingToGrant: (groups: readonly string[], roles: readonly string[]) => string;
-    pickGroupsAndRoles: string;
-    pickGroups: string;
+    grantSummary: (principals: readonly string[], roles: readonly string[]) => ReactNode;
+    /** Why Grant can't be pressed: everyone picked has every role picked already. */
+    nothingToGrant: (principals: readonly string[], roles: readonly string[]) => string;
+    pickPrincipalsAndRoles: string;
+    pickPrincipals: string;
     pickRoles: string;
     grant: (roles: readonly string[]) => string;
     grantToEveryone: string;
@@ -98,12 +119,15 @@ export declare const ACCESS_STRINGS: {
     manual: string;
     wholeOrganization: string;
     joinLater: string;
+    /** Heads the groups a person is in that hold a role here. */
+    inGroups: string;
     /** The first few members by name, and how many more there are. */
     memberNames: (names: readonly string[], more: number) => string;
     moreMembers: (n: number) => string;
-    onResource: (resource: string) => string;
+    /** Heads the roles the highlighted one holds on this resource. */
+    currentRoles: string;
     noRolesHere: string;
-    /** When a role being granted gives everything one the group holds does. */
+    /** When a role being granted gives everything one already held does. */
     becomesRedundant: (granting: readonly string[], held: readonly string[]) => string;
     alreadyHas: (roles: readonly string[]) => string;
     everyoneReach: (roles: readonly string[], people: number | undefined) => string;