@robertraaijmakers/pptb-securityplugin 0.1.5 → 0.1.6

package/dist/app.js

@@ -14758,13 +14758,39 @@ ${logTarget.textContent}`;
     "delete",
     "append",
     "appendto",
-    "assign"
+    "assign",
+    "share"
   ];
+  var privilegeLabels = {
+    create: "Create",
+    read: "Read",
+    write: "Write",
+    delete: "Delete",
+    append: "Append",
+    appendto: "Append To",
+    assign: "Assign",
+    share: "Share"
+  };
   var levelOptions = [
     { level: "user", icon: "\u{1F464}", label: "User", className: "level-user" },
-    { level: "businessUnit", icon: "\u{1F3E2}", label: "Business Unit", className: "level-businessUnit" },
-    { level: "parentChild", icon: "\u{1F9E9}", label: "Parent: Child BU", className: "level-parentChild" },
-    { level: "organization", icon: "\u{1F310}", label: "Organization", className: "level-organization" },
+    {
+      level: "businessUnit",
+      icon: "\u{1F3E2}",
+      label: "Business Unit",
+      className: "level-businessUnit"
+    },
+    {
+      level: "parentChild",
+      icon: "\u{1F9E9}",
+      label: "Parent: Child BU",
+      className: "level-parentChild"
+    },
+    {
+      level: "organization",
+      icon: "\u{1F310}",
+      label: "Organization",
+      className: "level-organization"
+    },
     { level: "none", icon: "\u26D4", label: "None", className: "level-none" }
   ];
   var levelColorMap = {
@@ -14789,6 +14815,10 @@ ${logTarget.textContent}`;
     loadingDashboardRoleTeamCounts: "Loading teams per role",
     loadingDashboardFilters: "Preparing dashboard filters",
     tableTitlePrivileges: "Privileges",
+    bulkUpdateSelect: "Set visible...",
+    bulkUpdateApply: "Set",
+    bulkUpdateNoRights: "No visible rights in this column",
+    bulkUpdateNoSelection: "Select a level first",
     roleFilterAll: "All roles",
     statusAssigned: "Assigned",
     statusNotAssigned: "Not assigned",
@@ -14889,6 +14919,15 @@ ${logTarget.textContent}`;
   function formatCachedPrivileges(privilegeCount, rolePrivilegeCount, roleCount) {
     return `Cached ${privilegeCount} privileges and ${rolePrivilegeCount} role privilege rows for ${roleCount} roles.`;
   }
+  function formatBulkUpdatedVisible(privilegeLabel, levelLabel, updatedCount, skippedCount) {
+    if (skippedCount > 0) {
+      return `Bulk set ${privilegeLabel} to ${levelLabel} for ${updatedCount} visible rows (${skippedCount} skipped).`;
+    }
+    return `Bulk set ${privilegeLabel} to ${levelLabel} for ${updatedCount} visible rows.`;
+  }
+  function formatBulkUpdateNoRows(privilegeLabel) {
+    return `No visible rows with editable ${privilegeLabel} rights.`;
+  }
   function formatRoleAssignmentLogUsers(action, roleName, userNames) {
     const verb = action === "add" ? "Added" : "Removed";
     const prep = action === "add" ? "to" : "from";
@@ -14979,6 +15018,7 @@ ${logTarget.textContent}`;
     },
     assignmentFilter: "",
     assignmentSearch: "",
+    privilegeSearch: "",
     sort: {
       column: "label",
       direction: "asc"
@@ -14990,7 +15030,8 @@ ${logTarget.textContent}`;
       delete: "",
       append: "",
       appendto: "",
-      assign: ""
+      assign: "",
+      share: ""
     },
     eventsHooked: false,
     readyToastShown: false,
@@ -15002,56 +15043,133 @@ ${logTarget.textContent}`;
     }
   };
   var elements2 = {
-    connectionBadge: document.getElementById("connection-badge"),
+    connectionBadge: document.getElementById(
+      "connection-badge"
+    ),
     filterMode: document.getElementById("filter-mode"),
     roleSelect: document.getElementById("role-select"),
     entitySelect: document.getElementById("entity-select"),
-    roleSelectControl: document.getElementById("role-select-control"),
-    entitySelectControl: document.getElementById("entity-select-control"),
+    roleSelectControl: document.getElementById(
+      "role-select-control"
+    ),
+    entitySelectControl: document.getElementById(
+      "entity-select-control"
+    ),
     rightsFilter: document.getElementById("rights-filter"),
-    roleFilterControl: document.getElementById("role-filter-control"),
-    roleFilterButton: document.getElementById("role-filter-button"),
+    roleFilterControl: document.getElementById(
+      "role-filter-control"
+    ),
+    roleFilterButton: document.getElementById(
+      "role-filter-button"
+    ),
     roleFilterMenu: document.getElementById("role-filter-menu"),
     roleFilterList: document.getElementById("role-filter-list"),
-    roleFilterAll: document.getElementById("role-filter-all"),
-    roleFilterNone: document.getElementById("role-filter-none"),
-    rolesCustomOnlyGlobal: document.getElementById("roles-custom-only-global"),
-    tabButtons: Array.from(document.querySelectorAll(".tab-button")),
+    roleFilterAll: document.getElementById(
+      "role-filter-all"
+    ),
+    roleFilterNone: document.getElementById(
+      "role-filter-none"
+    ),
+    rolesCustomOnlyGlobal: document.getElementById(
+      "roles-custom-only-global"
+    ),
+    tabButtons: Array.from(
+      document.querySelectorAll(".tab-button")
+    ),
     tabPrivileges: document.getElementById("tab-privileges"),
     tabAssignments: document.getElementById("tab-assignments"),
     tabDashboard: document.getElementById("tab-dashboard"),
-    assignmentMode: document.getElementById("assignment-mode"),
-    assignmentRoleSelect: document.getElementById("assignment-role-select"),
-    assignmentUserSelect: document.getElementById("assignment-user-select"),
-    assignmentTeamSelect: document.getElementById("assignment-team-select"),
-    assignmentRoleControl: document.getElementById("assignment-role-control"),
-    assignmentUserControl: document.getElementById("assignment-user-control"),
-    assignmentTeamControl: document.getElementById("assignment-team-control"),
-    assignmentTitle: document.getElementById("assignment-title"),
+    assignmentMode: document.getElementById(
+      "assignment-mode"
+    ),
+    assignmentRoleSelect: document.getElementById(
+      "assignment-role-select"
+    ),
+    assignmentUserSelect: document.getElementById(
+      "assignment-user-select"
+    ),
+    assignmentTeamSelect: document.getElementById(
+      "assignment-team-select"
+    ),
+    assignmentRoleControl: document.getElementById(
+      "assignment-role-control"
+    ),
+    assignmentUserControl: document.getElementById(
+      "assignment-user-control"
+    ),
+    assignmentTeamControl: document.getElementById(
+      "assignment-team-control"
+    ),
+    assignmentTitle: document.getElementById(
+      "assignment-title"
+    ),
     assignmentAdd: document.getElementById("assignment-add"),
-    assignmentRemove: document.getElementById("assignment-remove"),
-    assignmentCount: document.getElementById("assignment-count"),
-    assignmentSelectAll: document.getElementById("assignment-select-all"),
-    assignmentClear: document.getElementById("assignment-clear"),
-    assignmentStatus: document.getElementById("assignment-status"),
-    assignmentTableBody: document.getElementById("assignment-table-body"),
+    assignmentRemove: document.getElementById(
+      "assignment-remove"
+    ),
+    assignmentCount: document.getElementById(
+      "assignment-count"
+    ),
+    assignmentSelectAll: document.getElementById(
+      "assignment-select-all"
+    ),
+    assignmentClear: document.getElementById(
+      "assignment-clear"
+    ),
+    assignmentStatus: document.getElementById(
+      "assignment-status"
+    ),
+    assignmentTableBody: document.getElementById(
+      "assignment-table-body"
+    ),
     assignmentSortButtons: Array.from(
       document.querySelectorAll("[data-assign-sort]")
     ),
-    assignmentFilterAssigned: document.getElementById("assignment-filter-assigned"),
-    assignmentSearch: document.getElementById("assignment-search"),
-    controlsPrivileges: document.getElementById("controls-privileges"),
-    controlsAssignments: document.getElementById("controls-assignments"),
-    controlsDashboard: document.getElementById("controls-dashboard"),
-    dashboardUserStatus: document.getElementById("dashboard-user-status"),
-    dashboardUserType: document.getElementById("dashboard-user-type"),
-    dashboardBusinessUnitSelect: document.getElementById("dashboard-bu-select"),
-    dashboardRoleSelect: document.getElementById("dashboard-role-select"),
-    dashboardTeamSelect: document.getElementById("dashboard-team-select"),
-    dashboardExport: document.getElementById("dashboard-export"),
-    dashboardLoading: document.getElementById("dashboard-loading"),
-    dashboardLoadingBar: document.getElementById("dashboard-loading-bar"),
-    dashboardLoadingText: document.getElementById("dashboard-loading-text"),
+    assignmentFilterAssigned: document.getElementById(
+      "assignment-filter-assigned"
+    ),
+    assignmentSearch: document.getElementById(
+      "assignment-search"
+    ),
+    privilegeSearch: document.getElementById(
+      "privilege-search"
+    ),
+    controlsPrivileges: document.getElementById(
+      "controls-privileges"
+    ),
+    controlsAssignments: document.getElementById(
+      "controls-assignments"
+    ),
+    controlsDashboard: document.getElementById(
+      "controls-dashboard"
+    ),
+    dashboardUserStatus: document.getElementById(
+      "dashboard-user-status"
+    ),
+    dashboardUserType: document.getElementById(
+      "dashboard-user-type"
+    ),
+    dashboardBusinessUnitSelect: document.getElementById(
+      "dashboard-bu-select"
+    ),
+    dashboardRoleSelect: document.getElementById(
+      "dashboard-role-select"
+    ),
+    dashboardTeamSelect: document.getElementById(
+      "dashboard-team-select"
+    ),
+    dashboardExport: document.getElementById(
+      "dashboard-export"
+    ),
+    dashboardLoading: document.getElementById(
+      "dashboard-loading"
+    ),
+    dashboardLoadingBar: document.getElementById(
+      "dashboard-loading-bar"
+    ),
+    dashboardLoadingText: document.getElementById(
+      "dashboard-loading-text"
+    ),
     dashboardChartCards: Array.from(
       document.querySelectorAll("[data-dashboard-chart]")
     ),
@@ -15059,38 +15177,84 @@ ${logTarget.textContent}`;
       document.querySelectorAll(".chart-expand")
     ),
     chartModal: document.getElementById("chart-modal"),
-    chartModalTitle: document.getElementById("chart-modal-title"),
-    chartModalCanvas: document.getElementById("chart-modal-canvas"),
-    chartModalClose: document.getElementById("chart-modal-close"),
-    chartModalBackdrop: document.querySelector("[data-modal-close='true']"),
+    chartModalTitle: document.getElementById(
+      "chart-modal-title"
+    ),
+    chartModalCanvas: document.getElementById(
+      "chart-modal-canvas"
+    ),
+    chartModalClose: document.getElementById(
+      "chart-modal-close"
+    ),
+    chartModalBackdrop: document.querySelector(
+      "[data-modal-close='true']"
+    ),
     chartModalBody: document.querySelector(".modal-body"),
-    metricHumanActive: document.getElementById("metric-human-active"),
-    metricHumanInactive: document.getElementById("metric-human-inactive"),
-    metricAppActive: document.getElementById("metric-app-active"),
-    metricAppInactive: document.getElementById("metric-app-inactive"),
-    metricCustomRoles: document.getElementById("metric-custom-roles"),
-    metricManagedRoles: document.getElementById("metric-managed-roles"),
-    metricRolesWithoutUsers: document.getElementById("metric-roles-without-users"),
-    metricTotalTeams: document.getElementById("metric-total-teams"),
-    chartUsersByRole: document.getElementById("chart-users-by-role"),
-    chartTeamsByRole: document.getElementById("chart-teams-by-role"),
-    chartUsersByBusinessUnit: document.getElementById("chart-users-by-bu"),
-    chartUsersByTeam: document.getElementById("chart-users-by-team"),
+    metricHumanActive: document.getElementById(
+      "metric-human-active"
+    ),
+    metricHumanInactive: document.getElementById(
+      "metric-human-inactive"
+    ),
+    metricAppActive: document.getElementById(
+      "metric-app-active"
+    ),
+    metricAppInactive: document.getElementById(
+      "metric-app-inactive"
+    ),
+    metricCustomRoles: document.getElementById(
+      "metric-custom-roles"
+    ),
+    metricManagedRoles: document.getElementById(
+      "metric-managed-roles"
+    ),
+    metricRolesWithoutUsers: document.getElementById(
+      "metric-roles-without-users"
+    ),
+    metricTotalTeams: document.getElementById(
+      "metric-total-teams"
+    ),
+    chartUsersByRole: document.getElementById(
+      "chart-users-by-role"
+    ),
+    chartTeamsByRole: document.getElementById(
+      "chart-teams-by-role"
+    ),
+    chartUsersByBusinessUnit: document.getElementById(
+      "chart-users-by-bu"
+    ),
+    chartUsersByTeam: document.getElementById(
+      "chart-users-by-team"
+    ),
     applyBtn: document.getElementById("apply-btn"),
     undoBtn: document.getElementById("undo-btn"),
     refreshBtn: document.getElementById("refresh-btn"),
     pendingCount: document.getElementById("pending-count"),
     tableTitle: document.getElementById("table-title"),
-    privilegesTable: document.querySelector("#privileges-table tbody"),
-    privilegesTableRoot: document.getElementById("privileges-table"),
+    privilegesTable: document.querySelector(
+      "#privileges-table tbody"
+    ),
+    privilegesTableRoot: document.getElementById(
+      "privileges-table"
+    ),
     tableLoading: document.getElementById("table-loading"),
     tableEmpty: document.getElementById("table-empty"),
     loadingBar: document.getElementById("loading-bar"),
     loadingText: document.getElementById("loading-text"),
     log: document.getElementById("log"),
     themeToggle: document.getElementById("theme-toggle"),
-    sortButtons: Array.from(document.querySelectorAll(".sort-button")),
-    filterSelects: Array.from(document.querySelectorAll(".filter-select"))
+    sortButtons: Array.from(
+      document.querySelectorAll(".sort-button")
+    ),
+    bulkSelects: Array.from(
+      document.querySelectorAll("[data-bulk-select]")
+    ),
+    bulkApplyButtons: Array.from(
+      document.querySelectorAll("[data-bulk-apply]")
+    ),
+    filterSelects: Array.from(
+      document.querySelectorAll(".filter-select")
+    )
   };
   initLogger(elements2.log);
   function setTableTitle(text) {
@@ -15327,14 +15491,18 @@ ${logTarget.textContent}`;
   }
   function setLoading(active, message) {
     state.loading.active = active;
+    const hasLoadedData = state.cacheLoaded;
     if (elements2.tableLoading) {
       elements2.tableLoading.classList.toggle("hidden", !active);
     }
     if (elements2.privilegesTableRoot) {
-      elements2.privilegesTableRoot.classList.toggle("hidden", active);
+      elements2.privilegesTableRoot.classList.toggle(
+        "hidden",
+        active || !hasLoadedData
+      );
     }
     if (elements2.tableEmpty) {
-      elements2.tableEmpty.classList.toggle("hidden", active || state.cacheLoaded);
+      elements2.tableEmpty.classList.toggle("hidden", active || hasLoadedData);
     }
     if (message && elements2.loadingText) {
       elements2.loadingText.textContent = message;
@@ -15400,10 +15568,16 @@ ${logTarget.textContent}`;
       elements2.tabDashboard.classList.toggle("hidden", tab !== "dashboard");
     }
     if (elements2.controlsPrivileges) {
-      elements2.controlsPrivileges.classList.toggle("hidden", tab !== "privileges");
+      elements2.controlsPrivileges.classList.toggle(
+        "hidden",
+        tab !== "privileges"
+      );
     }
     if (elements2.controlsAssignments) {
-      elements2.controlsAssignments.classList.toggle("hidden", tab !== "assignments");
+      elements2.controlsAssignments.classList.toggle(
+        "hidden",
+        tab !== "assignments"
+      );
     }
     if (elements2.controlsDashboard) {
       elements2.controlsDashboard.classList.toggle("hidden", tab !== "dashboard");
@@ -15475,7 +15649,9 @@ ${logTarget.textContent}`;
     });
     return [...filtered].sort((a, b) => {
       if (state.assignmentSort.column === "label") {
-        const cmp = a.label.localeCompare(b.label, void 0, { sensitivity: "base" });
+        const cmp = a.label.localeCompare(b.label, void 0, {
+          sensitivity: "base"
+        });
         return state.assignmentSort.direction === "asc" ? cmp : -cmp;
       }
       const aRank = a.assigned ? 1 : 2;
@@ -15620,12 +15796,146 @@ ${logTarget.textContent}`;
     for (const button of elements2.sortButtons) {
       button.classList.remove("sort-asc", "sort-desc");
       if (button.dataset.sort === state.sort.column) {
-        button.classList.add(state.sort.direction === "asc" ? "sort-asc" : "sort-desc");
+        button.classList.add(
+          state.sort.direction === "asc" ? "sort-asc" : "sort-desc"
+        );
       }
     }
   }
   function isPrivilegeAvailable(row, privilege) {
-    return Boolean(state.privilegeIdByKey.get(`${row.entityLogicalName}:${privilege}`));
+    return Boolean(
+      state.privilegeIdByKey.get(`${row.entityLogicalName}:${privilege}`)
+    );
+  }
+  function getAllowedLevelsForPrivilege(row, privilege) {
+    const privilegeId = state.privilegeIdByKey.get(
+      `${row.entityLogicalName}:${privilege}`
+    );
+    if (!privilegeId) {
+      return [];
+    }
+    const info = state.privilegeInfoById.get(privilegeId);
+    const allowedLevels = ["none"];
+    if (info?.canBeBasic) {
+      allowedLevels.push("user");
+    }
+    if (info?.canBeLocal) {
+      allowedLevels.push("businessUnit");
+    }
+    if (info?.canBeDeep) {
+      allowedLevels.push("parentChild");
+    }
+    if (info?.canBeGlobal) {
+      allowedLevels.push("organization");
+    }
+    return allowedLevels;
+  }
+  function getRoleIdForVisibleRow(row, isRoleMode) {
+    if (isRoleMode) {
+      return elements2.roleSelect.value || void 0;
+    }
+    return row.roleId;
+  }
+  function renderBulkControls(rows, isRoleMode) {
+    const selectByPrivilege = /* @__PURE__ */ new Map();
+    for (const select of elements2.bulkSelects) {
+      const privilege = select.dataset.bulkSelect;
+      if (!privilege) {
+        continue;
+      }
+      selectByPrivilege.set(privilege, select);
+    }
+    const buttonByPrivilege = /* @__PURE__ */ new Map();
+    for (const button of elements2.bulkApplyButtons) {
+      const privilege = button.dataset.bulkApply;
+      if (!privilege) {
+        continue;
+      }
+      buttonByPrivilege.set(privilege, button);
+    }
+    for (const privilege of accessRights) {
+      const select = selectByPrivilege.get(privilege);
+      const button = buttonByPrivilege.get(privilege);
+      if (!select || !button) {
+        continue;
+      }
+      const allowedLevels = /* @__PURE__ */ new Set();
+      let hasEditableVisibleRows = false;
+      for (const row of rows) {
+        const roleId = getRoleIdForVisibleRow(row, isRoleMode);
+        if (!roleId) {
+          continue;
+        }
+        const rowAllowedLevels = getAllowedLevelsForPrivilege(row, privilege);
+        if (rowAllowedLevels.length === 0) {
+          continue;
+        }
+        hasEditableVisibleRows = true;
+        for (const level of rowAllowedLevels) {
+          allowedLevels.add(level);
+        }
+      }
+      select.innerHTML = "";
+      const placeholder = document.createElement("option");
+      placeholder.value = "";
+      placeholder.textContent = UI_TEXT.bulkUpdateSelect;
+      select.appendChild(placeholder);
+      for (const optionMeta of levelOptions) {
+        if (!allowedLevels.has(optionMeta.level)) {
+          continue;
+        }
+        const option = document.createElement("option");
+        option.value = optionMeta.level;
+        option.textContent = `${optionMeta.icon} ${optionMeta.label}`;
+        select.appendChild(option);
+      }
+      select.disabled = !hasEditableVisibleRows;
+      button.disabled = !hasEditableVisibleRows;
+      button.textContent = UI_TEXT.bulkUpdateApply;
+      button.title = hasEditableVisibleRows ? UI_TEXT.bulkUpdateApply : UI_TEXT.bulkUpdateNoRights;
+    }
+  }
+  function applyBulkUpdate(privilege, level) {
+    const isRoleMode = state.tableMode === "role";
+    const visibleRows = applySortAndFilters(state.privilegeRows);
+    let updatedCount = 0;
+    let skippedCount = 0;
+    for (const row of visibleRows) {
+      const roleId = getRoleIdForVisibleRow(row, isRoleMode);
+      if (!roleId) {
+        skippedCount++;
+        continue;
+      }
+      const allowedLevels = getAllowedLevelsForPrivilege(row, privilege);
+      if (allowedLevels.length === 0 || !allowedLevels.includes(level)) {
+        skippedCount++;
+        continue;
+      }
+      const changed = updatePendingChange(
+        roleId,
+        row.entityLogicalName,
+        privilege,
+        level
+      );
+      if (changed) {
+        updatedCount++;
+      }
+    }
+    const privilegeLabel = privilegeLabels[privilege] ?? privilege;
+    const levelLabel = levelOptions.find((option) => option.level === level)?.label ?? level;
+    if (updatedCount > 0) {
+      logMessage(
+        formatBulkUpdatedVisible(
+          privilegeLabel,
+          levelLabel,
+          updatedCount,
+          skippedCount
+        )
+      );
+    } else {
+      logMessage(formatBulkUpdateNoRows(privilegeLabel));
+    }
+    renderPrivilegeTable();
   }
   function hasAnyRights(row) {
     return accessRights.some((privilege) => {
@@ -15646,11 +15956,17 @@ ${logTarget.textContent}`;
     );
   }
   function updatePendingChange(roleId, entityLogicalName, privilege, level) {
-    const currentLevel = getCurrentPrivilegeLevel(roleId, entityLogicalName, privilege);
+    const currentLevel = getCurrentPrivilegeLevel(
+      roleId,
+      entityLogicalName,
+      privilege
+    );
     const existing = findPendingChange(roleId, entityLogicalName, privilege);
     if (level === currentLevel) {
       if (existing) {
-        state.pendingChanges = state.pendingChanges.filter((change) => change !== existing);
+        state.pendingChanges = state.pendingChanges.filter(
+          (change) => change !== existing
+        );
       }
       updatePendingUi();
       return false;
@@ -15693,6 +16009,14 @@ ${logTarget.textContent}`;
   }
   function applySortAndFilters(rows) {
     const filtered = rows.filter((row) => {
+      if (state.privilegeSearch) {
+        const term = state.privilegeSearch.toLowerCase();
+        const labelMatch = row.entityLabel.toLowerCase().includes(term);
+        const logicalNameMatch = row.entityLogicalName.toLowerCase().includes(term);
+        if (!labelMatch && !logicalNameMatch) {
+          return false;
+        }
+      }
       if (state.rightsFilter === "with" && !hasAnyRights(row)) {
         return false;
       }
@@ -15722,18 +16046,30 @@ ${logTarget.textContent}`;
     });
     const sorted = [...filtered].sort((a, b) => {
       if (state.sort.column === "label") {
-        const cmp = a.entityLabel.localeCompare(b.entityLabel, void 0, { sensitivity: "base" });
+        const cmp = a.entityLabel.localeCompare(b.entityLabel, void 0, {
+          sensitivity: "base"
+        });
         return state.sort.direction === "asc" ? cmp : -cmp;
       }
       const privilege = state.sort.column;
       const aAvailable = isPrivilegeAvailable(a, privilege);
       const bAvailable = isPrivilegeAvailable(b, privilege);
-      const aRank = getPrivilegeSortRank(a[privilege], aAvailable, state.sort.direction);
-      const bRank = getPrivilegeSortRank(b[privilege], bAvailable, state.sort.direction);
+      const aRank = getPrivilegeSortRank(
+        a[privilege],
+        aAvailable,
+        state.sort.direction
+      );
+      const bRank = getPrivilegeSortRank(
+        b[privilege],
+        bAvailable,
+        state.sort.direction
+      );
       if (aRank !== bRank) {
         return aRank - bRank;
       }
-      return a.entityLabel.localeCompare(b.entityLabel, void 0, { sensitivity: "base" });
+      return a.entityLabel.localeCompare(b.entityLabel, void 0, {
+        sensitivity: "base"
+      });
     });
     return sorted;
   }
@@ -15741,6 +16077,7 @@ ${logTarget.textContent}`;
     elements2.privilegesTable.innerHTML = "";
     const isRoleMode = state.tableMode === "role";
     const rows = applySortAndFilters(state.privilegeRows);
+    renderBulkControls(rows, isRoleMode);
     if (elements2.tableEmpty) {
       elements2.tableEmpty.classList.toggle("hidden", state.cacheLoaded);
     }
@@ -15764,26 +16101,15 @@ ${logTarget.textContent}`;
       tr.appendChild(ownershipCell);
       for (const privilege of accessRights) {
         const td = document.createElement("td");
-        const privilegeId = state.privilegeIdByKey.get(`${row.entityLogicalName}:${privilege}`);
+        const privilegeId = state.privilegeIdByKey.get(
+          `${row.entityLogicalName}:${privilege}`
+        );
         if (!privilegeId) {
           td.textContent = UI_TEXT.tableCellEmpty;
           tr.appendChild(td);
           continue;
         }
-        const info = state.privilegeInfoById.get(privilegeId);
-        const allowedLevels = ["none"];
-        if (info?.canBeBasic) {
-          allowedLevels.push("user");
-        }
-        if (info?.canBeLocal) {
-          allowedLevels.push("businessUnit");
-        }
-        if (info?.canBeDeep) {
-          allowedLevels.push("parentChild");
-        }
-        if (info?.canBeGlobal) {
-          allowedLevels.push("organization");
-        }
+        const allowedLevels = getAllowedLevelsForPrivilege(row, privilege);
         const select = document.createElement("select");
         select.className = "level-select";
         select.dataset.entityLogicalName = row.entityLogicalName;
@@ -15793,6 +16119,12 @@ ${logTarget.textContent}`;
         } else if (row.roleId) {
           select.dataset.roleId = row.roleId;
         }
+        const pending = select.dataset.roleId ? findPendingChange(
+          select.dataset.roleId,
+          row.entityLogicalName,
+          privilege
+        ) : void 0;
+        const effectiveLevel = pending?.level ?? row[privilege];
         for (const optionMeta of levelOptions) {
           if (!allowedLevels.includes(optionMeta.level)) {
             continue;
@@ -15802,7 +16134,7 @@ ${logTarget.textContent}`;
           option.textContent = `${optionMeta.icon} ${optionMeta.label}`;
           option.className = optionMeta.className;
           option.style.color = getLevelColor(optionMeta.level);
-          if (row[privilege] === optionMeta.level) {
+          if (effectiveLevel === optionMeta.level) {
             option.selected = true;
           }
           select.appendChild(option);
@@ -15813,7 +16145,12 @@ ${logTarget.textContent}`;
             return;
           }
           const level = select.value;
-          const isPending = updatePendingChange(roleId, row.entityLogicalName, privilege, level);
+          const isPending = updatePendingChange(
+            roleId,
+            row.entityLogicalName,
+            privilege,
+            level
+          );
           setPendingClass(select, isPending);
         });
         select.disabled = !isRoleMode && !row.roleId;
@@ -15821,12 +16158,7 @@ ${logTarget.textContent}`;
         select.addEventListener("change", () => {
           applyLevelClass(select, select.value);
         });
-        if (select.dataset.roleId) {
-          const pending = Boolean(
-            findPendingChange(select.dataset.roleId, row.entityLogicalName, privilege)
-          );
-          setPendingClass(select, pending);
-        }
+        setPendingClass(select, Boolean(pending));
         td.appendChild(select);
         tr.appendChild(td);
       }
@@ -16041,7 +16373,8 @@ ${logTarget.textContent}`;
       { prefix: "prvDelete", access: "delete" },
       { prefix: "prvAppendTo", access: "appendto" },
       { prefix: "prvAppend", access: "append" },
-      { prefix: "prvAssign", access: "assign" }
+      { prefix: "prvAssign", access: "assign" },
+      { prefix: "prvShare", access: "share" }
     ];
     for (const { prefix, access } of prefixes) {
       if (name.startsWith(prefix)) {
@@ -16066,7 +16399,8 @@ ${logTarget.textContent}`;
         delete: "none",
         append: "none",
         appendto: "none",
-        assign: "none"
+        assign: "none",
+        share: "none"
       });
     }
     return roleMap.get(entityLogicalName);
@@ -16125,7 +16459,11 @@ ${logTarget.textContent}`;
       elements2.assignmentRoleSelect,
       state.roles,
       (item) => item.id,
-      (item) => formatAssignmentSelectLabel(item.name, counts.get(item.id) ?? 0, unitLabel)
+      (item) => formatAssignmentSelectLabel(
+        item.name,
+        counts.get(item.id) ?? 0,
+        unitLabel
+      )
     );
   }
   function renderAssignmentUserOptionsWithCounts(unitLabel, counts) {
@@ -16133,7 +16471,11 @@ ${logTarget.textContent}`;
       elements2.assignmentUserSelect,
       state.users,
       (item) => item.id,
-      (item) => formatAssignmentSelectLabel(item.name, counts.get(item.id) ?? 0, unitLabel)
+      (item) => formatAssignmentSelectLabel(
+        item.name,
+        counts.get(item.id) ?? 0,
+        unitLabel
+      )
     );
   }
   function renderAssignmentTeamOptionsWithCounts(unitLabel, counts) {
@@ -16141,7 +16483,11 @@ ${logTarget.textContent}`;
       elements2.assignmentTeamSelect,
       state.teams,
       (item) => item.id,
-      (item) => formatAssignmentSelectLabel(item.name, counts.get(item.id) ?? 0, unitLabel)
+      (item) => formatAssignmentSelectLabel(
+        item.name,
+        counts.get(item.id) ?? 0,
+        unitLabel
+      )
     );
   }
   async function getAssignedUsersForRoleCached(roleId) {
@@ -16182,7 +16528,11 @@ ${logTarget.textContent}`;
           state.roles.length ? Promise.resolve() : loadRoles2(),
           state.teamsLoaded ? Promise.resolve() : loadTeams2()
         ]);
-        setDashboardLoadingProgress(++currentStep, totalSteps, UI_TEXT.loadingDashboardPeople);
+        setDashboardLoadingProgress(
+          ++currentStep,
+          totalSteps,
+          UI_TEXT.loadingDashboardPeople
+        );
         const [users, businessUnits, teamMemberships] = await Promise.all([
           loadUsersForDashboard(),
           loadBusinessUnits(),
@@ -16407,9 +16757,15 @@ ${logTarget.textContent}`;
         continue;
       }
       if (isApplicationUser(user)) {
-        appCounts.set(user.businessUnitId, (appCounts.get(user.businessUnitId) ?? 0) + 1);
+        appCounts.set(
+          user.businessUnitId,
+          (appCounts.get(user.businessUnitId) ?? 0) + 1
+        );
       } else {
-        humanCounts.set(user.businessUnitId, (humanCounts.get(user.businessUnitId) ?? 0) + 1);
+        humanCounts.set(
+          user.businessUnitId,
+          (humanCounts.get(user.businessUnitId) ?? 0) + 1
+        );
       }
     }
     const units = state.dashboardBusinessUnits.map((unit) => ({
@@ -16437,11 +16793,17 @@ ${logTarget.textContent}`;
     const appCounts = /* @__PURE__ */ new Map();
     for (const membership of state.dashboardTeamMemberships) {
       if (humanIds.has(membership.userId)) {
-        humanCounts.set(membership.teamId, (humanCounts.get(membership.teamId) ?? 0) + 1);
+        humanCounts.set(
+          membership.teamId,
+          (humanCounts.get(membership.teamId) ?? 0) + 1
+        );
         continue;
       }
       if (appIds.has(membership.userId)) {
-        appCounts.set(membership.teamId, (appCounts.get(membership.teamId) ?? 0) + 1);
+        appCounts.set(
+          membership.teamId,
+          (appCounts.get(membership.teamId) ?? 0) + 1
+        );
       }
     }
     const teamFilterId = elements2.dashboardTeamSelect?.value ?? "";
@@ -16564,7 +16926,9 @@ ${logTarget.textContent}`;
     if (!elements2.chartModalBody || !elements2.chartModalCanvas) {
       return;
     }
-    let empty = elements2.chartModalBody.querySelector(".chart-empty");
+    let empty = elements2.chartModalBody.querySelector(
+      ".chart-empty"
+    );
     if (!empty) {
       empty = document.createElement("div");
       empty.className = "chart-empty";
@@ -16592,13 +16956,27 @@ ${logTarget.textContent}`;
       elements2.chartUsersByRole,
       usersByRoleData.labels,
       [
-        { label: "Human users", data: usersByRoleData.human, backgroundColor: "#d35400" },
-        { label: "Application users", data: usersByRoleData.app, backgroundColor: "#f39c4a" }
+        {
+          label: "Human users",
+          data: usersByRoleData.human,
+          backgroundColor: "#d35400"
+        },
+        {
+          label: "Application users",
+          data: usersByRoleData.app,
+          backgroundColor: "#f39c4a"
+        }
       ],
       true
     );
-    setChartEmptyState(elements2.chartUsersByRole, usersByRoleData.labels.length === 0);
-    const teamsByRoleCounts = buildTeamsByRoleCounts(businessUnitId, teamFilterId);
+    setChartEmptyState(
+      elements2.chartUsersByRole,
+      usersByRoleData.labels.length === 0
+    );
+    const teamsByRoleCounts = buildTeamsByRoleCounts(
+      businessUnitId,
+      teamFilterId
+    );
     const teamsByRoleData = buildRoleTotalChartData(
       teamsByRoleCounts,
       roleFilterId || null,
@@ -16610,34 +16988,63 @@ ${logTarget.textContent}`;
       elements2.chartTeamsByRole,
       teamsByRoleData.labels,
       [
-        { label: "Teams", data: teamsByRoleData.values, backgroundColor: "#1f7a8c" }
+        {
+          label: "Teams",
+          data: teamsByRoleData.values,
+          backgroundColor: "#1f7a8c"
+        }
       ]
     );
-    setChartEmptyState(elements2.chartTeamsByRole, teamsByRoleData.labels.length === 0);
+    setChartEmptyState(
+      elements2.chartTeamsByRole,
+      teamsByRoleData.labels.length === 0
+    );
     const usersByBuData = buildUsersByBusinessUnitData(filteredUsers, maxRoles);
     state.dashboardCharts.usersByBusinessUnit = renderOrUpdateBarChart(
       state.dashboardCharts.usersByBusinessUnit,
       elements2.chartUsersByBusinessUnit,
       usersByBuData.labels,
       [
-        { label: "Human users", data: usersByBuData.human, backgroundColor: "#d35400" },
-        { label: "Application users", data: usersByBuData.app, backgroundColor: "#f39c4a" }
+        {
+          label: "Human users",
+          data: usersByBuData.human,
+          backgroundColor: "#d35400"
+        },
+        {
+          label: "Application users",
+          data: usersByBuData.app,
+          backgroundColor: "#f39c4a"
+        }
       ],
       true
     );
-    setChartEmptyState(elements2.chartUsersByBusinessUnit, usersByBuData.labels.length === 0);
+    setChartEmptyState(
+      elements2.chartUsersByBusinessUnit,
+      usersByBuData.labels.length === 0
+    );
     const usersByTeamData = buildUsersByTeamData(filteredUsers, maxRoles);
     state.dashboardCharts.usersByTeam = renderOrUpdateBarChart(
       state.dashboardCharts.usersByTeam,
       elements2.chartUsersByTeam,
       usersByTeamData.labels,
       [
-        { label: "Human users", data: usersByTeamData.human, backgroundColor: "#d35400" },
-        { label: "Application users", data: usersByTeamData.app, backgroundColor: "#f39c4a" }
+        {
+          label: "Human users",
+          data: usersByTeamData.human,
+          backgroundColor: "#d35400"
+        },
+        {
+          label: "Application users",
+          data: usersByTeamData.app,
+          backgroundColor: "#f39c4a"
+        }
       ],
       true
     );
-    setChartEmptyState(elements2.chartUsersByTeam, usersByTeamData.labels.length === 0);
+    setChartEmptyState(
+      elements2.chartUsersByTeam,
+      usersByTeamData.labels.length === 0
+    );
   }
   function getDashboardChartData(kind, maxRoles) {
     const roleFilterId = elements2.dashboardRoleSelect?.value ?? "";
@@ -16658,13 +17065,24 @@ ${logTarget.textContent}`;
           labels: data.labels,
           stacked: true,
           datasets: [
-            { label: "Human users", data: data.human, backgroundColor: "#d35400" },
-            { label: "Application users", data: data.app, backgroundColor: "#f39c4a" }
+            {
+              label: "Human users",
+              data: data.human,
+              backgroundColor: "#d35400"
+            },
+            {
+              label: "Application users",
+              data: data.app,
+              backgroundColor: "#f39c4a"
+            }
           ]
         };
       }
       case "teamsByRole": {
-        const teamsByRoleCounts = buildTeamsByRoleCounts(businessUnitId, teamFilterId);
+        const teamsByRoleCounts = buildTeamsByRoleCounts(
+          businessUnitId,
+          teamFilterId
+        );
         const data = buildRoleTotalChartData(
           teamsByRoleCounts,
           roleFilterId || null,
@@ -16675,7 +17093,9 @@ ${logTarget.textContent}`;
           title: "Teams per role",
           labels: data.labels,
           stacked: false,
-          datasets: [{ label: "Teams", data: data.values, backgroundColor: "#1f7a8c" }]
+          datasets: [
+            { label: "Teams", data: data.values, backgroundColor: "#1f7a8c" }
+          ]
         };
       }
       case "usersByBusinessUnit": {
@@ -16685,8 +17105,16 @@ ${logTarget.textContent}`;
           labels: data.labels,
           stacked: true,
           datasets: [
-            { label: "Human users", data: data.human, backgroundColor: "#d35400" },
-            { label: "Application users", data: data.app, backgroundColor: "#f39c4a" }
+            {
+              label: "Human users",
+              data: data.human,
+              backgroundColor: "#d35400"
+            },
+            {
+              label: "Application users",
+              data: data.app,
+              backgroundColor: "#f39c4a"
+            }
           ]
         };
       }
@@ -16697,8 +17125,16 @@ ${logTarget.textContent}`;
           labels: data.labels,
           stacked: true,
           datasets: [
-            { label: "Human users", data: data.human, backgroundColor: "#d35400" },
-            { label: "Application users", data: data.app, backgroundColor: "#f39c4a" }
+            {
+              label: "Human users",
+              data: data.human,
+              backgroundColor: "#d35400"
+            },
+            {
+              label: "Application users",
+              data: data.app,
+              backgroundColor: "#f39c4a"
+            }
           ]
         };
       }
@@ -16764,11 +17200,15 @@ ${logTarget.textContent}`;
     return isActiveUser(user) ? "Active" : "Inactive";
   }
   function buildUserRoleExportRows() {
-    const roleNameById = new Map(state.allRoles.map((role) => [role.id, role.name]));
+    const roleNameById = new Map(
+      state.allRoles.map((role) => [role.id, role.name])
+    );
     const businessUnitById = new Map(
       state.dashboardBusinessUnits.map((unit) => [unit.id, unit.name])
     );
-    const usersById = new Map(state.dashboardUsers.map((user) => [user.id, user]));
+    const usersById = new Map(
+      state.dashboardUsers.map((user) => [user.id, user])
+    );
     const rows = [
       ["User", "Email", "Status", "Business Unit", "Security Role"]
     ];
@@ -16791,7 +17231,9 @@ ${logTarget.textContent}`;
   }
   function buildUserTeamExportRows() {
     const teamNameById = new Map(state.teams.map((team) => [team.id, team.name]));
-    const usersById = new Map(state.dashboardUsers.map((user) => [user.id, user]));
+    const usersById = new Map(
+      state.dashboardUsers.map((user) => [user.id, user])
+    );
     const rows = [["User", "Email", "Status", "Team"]];
     for (const membership of state.dashboardTeamMemberships) {
       const user = usersById.get(membership.userId);
@@ -16828,8 +17270,14 @@ ${logTarget.textContent}`;
       toolboxAPI2.fileSystem,
       toolboxAPI2.utils,
       [
-        { filename: `security-roles-users-${timestamp}.csv`, content: userRolesCsv },
-        { filename: `security-roles-teams-${timestamp}.csv`, content: userTeamsCsv }
+        {
+          filename: `security-roles-users-${timestamp}.csv`,
+          content: userRolesCsv
+        },
+        {
+          filename: `security-roles-teams-${timestamp}.csv`,
+          content: userTeamsCsv
+        }
       ],
       `security-roles-users-${timestamp}.csv`
     );
@@ -16872,7 +17320,10 @@ ${logTarget.textContent}`;
         canBeGlobal: Boolean(privilege.canbeglobal)
       });
       privilegeMeta.set(privilege.privilegeid, parsed);
-      privilegeIdByKey.set(`${parsed.entityLogicalName}:${parsed.access}`, privilege.privilegeid);
+      privilegeIdByKey.set(
+        `${parsed.entityLogicalName}:${parsed.access}`,
+        privilege.privilegeid
+      );
     }
     const rolePrivilegesCache = /* @__PURE__ */ new Map();
     const rolesToCache = state.allRoles.length > 0 ? state.allRoles : state.roles;
@@ -16896,7 +17347,11 @@ ${logTarget.textContent}`;
         rolePrivilegeCount += roleEntries.length;
         loadedRoles += 1;
         if (state.loading.active) {
-          updateLoadingProgress(loadedRoles, rolesToCache.length, UI_TEXT.loadingRolePrivileges);
+          updateLoadingProgress(
+            loadedRoles,
+            rolesToCache.length,
+            UI_TEXT.loadingRolePrivileges
+          );
         }
         for (const entry of roleEntries) {
           const privilegeId = entry.PrivilegeId ?? entry.privilegeid ?? entry._privilegeid_value;
@@ -16909,7 +17364,10 @@ ${logTarget.textContent}`;
             continue;
           }
           const roleMap = rolePrivilegesCache.get(role.id);
-          const record = ensureRolePrivilegeRecord(roleMap, meta.entityLogicalName);
+          const record = ensureRolePrivilegeRecord(
+            roleMap,
+            meta.entityLogicalName
+          );
           record[meta.access] = mapPrivilegeLevelFromDepth(depth);
         }
       }
@@ -16919,7 +17377,11 @@ ${logTarget.textContent}`;
     state.rolePrivileges = rolePrivilegesCache;
     state.cacheLoaded = true;
     logMessage(
-      formatCachedPrivileges(privileges.length, rolePrivilegeCount, rolesToCache.length)
+      formatCachedPrivileges(
+        privileges.length,
+        rolePrivilegeCount,
+        rolesToCache.length
+      )
     );
     return true;
   }
@@ -16969,7 +17431,8 @@ ${logTarget.textContent}`;
         delete: "none",
         append: "none",
         appendto: "none",
-        assign: "none"
+        assign: "none",
+        share: "none"
       };
       return {
         entityLabel: entity.displayName,
@@ -16981,7 +17444,8 @@ ${logTarget.textContent}`;
         delete: record.delete,
         append: record.append,
         appendto: record.appendto,
-        assign: record.assign
+        assign: record.assign,
+        share: record.share
       };
     });
     renderPrivilegeTable();
@@ -16994,8 +17458,12 @@ ${logTarget.textContent}`;
       return;
     }
     state.tableMode = "entity";
-    const entityLabel = state.entities.find((entity) => entity.logicalName === entityLogicalName)?.displayName;
-    const visibleRoles = state.roles.filter((role) => state.selectedRoleIds.has(role.id));
+    const entityLabel = state.entities.find(
+      (entity) => entity.logicalName === entityLogicalName
+    )?.displayName;
+    const visibleRoles = state.roles.filter(
+      (role) => state.selectedRoleIds.has(role.id)
+    );
     state.privilegeRows = visibleRoles.map((role) => {
       const record = state.rolePrivileges.get(role.id)?.get(entityLogicalName) ?? {
         create: "none",
@@ -17004,7 +17472,8 @@ ${logTarget.textContent}`;
         delete: "none",
         append: "none",
         appendto: "none",
-        assign: "none"
+        assign: "none",
+        share: "none"
       };
       return {
         roleId: role.id,
@@ -17017,11 +17486,14 @@ ${logTarget.textContent}`;
         delete: record.delete,
         append: record.append,
         appendto: record.appendto,
-        assign: record.assign
+        assign: record.assign,
+        share: record.share
       };
     });
     renderPrivilegeTable();
-    setTableTitle(formatPrivilegesForTableTitle(entityLabel ?? entityLogicalName));
+    setTableTitle(
+      formatPrivilegesForTableTitle(entityLabel ?? entityLogicalName)
+    );
   }
   async function loadAssignmentView() {
     if (!state.allRoles.length) {
@@ -17039,7 +17511,10 @@ ${logTarget.textContent}`;
           activeUserIds
         );
       }
-      renderAssignmentRoleOptionsWithCounts(UI_TEXT.unitUsers, state.assignmentRoleUserCounts);
+      renderAssignmentRoleOptionsWithCounts(
+        UI_TEXT.unitUsers,
+        state.assignmentRoleUserCounts
+      );
       const roleId = elements2.assignmentRoleSelect.value;
       if (!roleId) {
         setAssignmentStatus(UI_TEXT.assignmentSelectRoleUsers);
@@ -17071,7 +17546,10 @@ ${logTarget.textContent}`;
       if (state.assignmentUserRoleCounts.size !== state.users.length) {
         state.assignmentUserRoleCounts = await loadUserAssignmentCounts();
       }
-      renderAssignmentUserOptionsWithCounts(UI_TEXT.unitRoles, state.assignmentUserRoleCounts);
+      renderAssignmentUserOptionsWithCounts(
+        UI_TEXT.unitRoles,
+        state.assignmentUserRoleCounts
+      );
       const userId = elements2.assignmentUserSelect.value;
       if (!userId) {
         setAssignmentStatus(UI_TEXT.assignmentSelectUserRoles);
@@ -17106,7 +17584,10 @@ ${logTarget.textContent}`;
           state.allRoles
         );
       }
-      renderAssignmentRoleOptionsWithCounts(UI_TEXT.unitTeams, state.assignmentRoleTeamCounts);
+      renderAssignmentRoleOptionsWithCounts(
+        UI_TEXT.unitTeams,
+        state.assignmentRoleTeamCounts
+      );
       const roleId = elements2.assignmentRoleSelect.value;
       if (!roleId) {
         setAssignmentStatus(UI_TEXT.assignmentSelectRoleTeams);
@@ -17138,7 +17619,10 @@ ${logTarget.textContent}`;
       if (state.assignmentTeamRoleCounts.size !== state.teams.length) {
         state.assignmentTeamRoleCounts = await loadTeamAssignmentCounts();
       }
-      renderAssignmentTeamOptionsWithCounts(UI_TEXT.unitRoles, state.assignmentTeamRoleCounts);
+      renderAssignmentTeamOptionsWithCounts(
+        UI_TEXT.unitRoles,
+        state.assignmentTeamRoleCounts
+      );
       const teamId = elements2.assignmentTeamSelect.value;
       if (!teamId) {
         setAssignmentStatus(UI_TEXT.assignmentSelectTeamRoles);
@@ -17191,7 +17675,9 @@ ${logTarget.textContent}`;
         processedUsers.push(user.name);
       }
       if (processedUsers.length > 0) {
-        logMessage(formatRoleAssignmentLogUsers(action, roleName, processedUsers));
+        logMessage(
+          formatRoleAssignmentLogUsers(action, roleName, processedUsers)
+        );
       }
     } else if (state.assignmentMode === "user") {
       const userId = elements2.assignmentUserSelect.value;
@@ -17218,7 +17704,9 @@ ${logTarget.textContent}`;
         processedRoles.push(roleName);
       }
       if (processedRoles.length > 0) {
-        logMessage(formatRoleAssignmentLogRolesForUser(action, user.name, processedRoles));
+        logMessage(
+          formatRoleAssignmentLogRolesForUser(action, user.name, processedRoles)
+        );
       }
     } else if (state.assignmentMode === "role-team") {
       const roleRootId = elements2.assignmentRoleSelect.value;
@@ -17245,7 +17733,9 @@ ${logTarget.textContent}`;
         processedTeams.push(team.name);
       }
       if (processedTeams.length > 0) {
-        logMessage(formatRoleAssignmentLogTeams(action, roleName, processedTeams));
+        logMessage(
+          formatRoleAssignmentLogTeams(action, roleName, processedTeams)
+        );
       }
     } else {
       const teamId = elements2.assignmentTeamSelect.value;
@@ -17272,7 +17762,9 @@ ${logTarget.textContent}`;
         processedRoles.push(roleName);
       }
       if (processedRoles.length > 0) {
-        logMessage(formatRoleAssignmentLogRolesForTeam(action, team.name, processedRoles));
+        logMessage(
+          formatRoleAssignmentLogRolesForTeam(action, team.name, processedRoles)
+        );
       }
     }
     resetAssignmentCaches();
@@ -17296,17 +17788,25 @@ ${logTarget.textContent}`;
     const removesByRole = /* @__PURE__ */ new Map();
     const addsByRole = /* @__PURE__ */ new Map();
     for (const change of state.pendingChanges) {
-      const privilegeId = state.privilegeIdByKey.get(`${change.entityLogicalName}:${change.privilege}`);
+      const privilegeId = state.privilegeIdByKey.get(
+        `${change.entityLogicalName}:${change.privilege}`
+      );
       if (!privilegeId) {
-        logMessage(formatMissingPrivilegeId(change.entityLogicalName, change.privilege));
+        logMessage(
+          formatMissingPrivilegeId(change.entityLogicalName, change.privilege)
+        );
         continue;
       }
       const roleMap = state.rolePrivileges.get(change.roleId) ?? /* @__PURE__ */ new Map();
       const record = roleMap.get(change.entityLogicalName) ?? {
+        create: "none",
         read: "none",
         write: "none",
+        delete: "none",
         append: "none",
-        appendto: "none"
+        appendto: "none",
+        assign: "none",
+        share: "none"
       };
       const currentLevel = record[change.privilege];
       if (currentLevel === change.level) {
@@ -17343,20 +17843,31 @@ ${logTarget.textContent}`;
         for (const privilegeId of privilegeIds) {
           await removePrivilegesFromRole(roleId, privilegeId);
           completedCalls += 1;
-          updateLoadingProgress(completedCalls, totalCalls, UI_TEXT.loadingApplyingChanges);
+          updateLoadingProgress(
+            completedCalls,
+            totalCalls,
+            UI_TEXT.loadingApplyingChanges
+          );
         }
       }
       for (const [roleId, privileges] of addsByRole) {
         await addPrivilegesToRole(roleId, privileges);
         completedCalls += 1;
-        updateLoadingProgress(completedCalls, totalCalls, UI_TEXT.loadingApplyingChanges);
+        updateLoadingProgress(
+          completedCalls,
+          totalCalls,
+          UI_TEXT.loadingApplyingChanges
+        );
       }
       for (const change of state.pendingChanges) {
         if (!state.rolePrivileges.has(change.roleId)) {
           state.rolePrivileges.set(change.roleId, /* @__PURE__ */ new Map());
         }
         const roleMap = state.rolePrivileges.get(change.roleId);
-        const record = ensureRolePrivilegeRecord(roleMap, change.entityLogicalName);
+        const record = ensureRolePrivilegeRecord(
+          roleMap,
+          change.entityLogicalName
+        );
         record[change.privilege] = change.level;
       }
     } catch (error) {
@@ -17631,10 +18142,18 @@ ${logTarget.textContent}`;
         loadAssignmentView();
       }
     });
-    elements2.assignmentAdd.addEventListener("click", () => applyAssignmentChange("add"));
-    elements2.assignmentRemove.addEventListener("click", () => applyAssignmentChange("remove"));
+    elements2.assignmentAdd.addEventListener(
+      "click",
+      () => applyAssignmentChange("add")
+    );
+    elements2.assignmentRemove.addEventListener(
+      "click",
+      () => applyAssignmentChange("remove")
+    );
     elements2.assignmentSelectAll.addEventListener("click", () => {
-      state.selectedAssignmentIds = new Set(state.assignmentItems.map((item) => item.id));
+      state.selectedAssignmentIds = new Set(
+        state.assignmentItems.map((item) => item.id)
+      );
       renderAssignmentTable(state.assignmentItems);
       updateAssignmentSelectionUi();
     });
@@ -17668,6 +18187,19 @@ ${logTarget.textContent}`;
         renderAssignmentTable(state.assignmentItems);
       });
     }
+    if (elements2.privilegeSearch) {
+      elements2.privilegeSearch.addEventListener("input", async () => {
+        state.privilegeSearch = elements2.privilegeSearch.value.trim().toLowerCase();
+        if (!state.cacheLoaded) {
+          const loaded = await ensureSecurityCacheLoaded();
+          if (loaded) {
+            await refreshPrivilegeView();
+          }
+          return;
+        }
+        renderPrivilegeTable();
+      });
+    }
     for (const button of elements2.sortButtons) {
       button.addEventListener("click", () => {
         const column = button.dataset.sort || "label";
@@ -17681,6 +18213,22 @@ ${logTarget.textContent}`;
         renderPrivilegeTable();
       });
     }
+    for (const button of elements2.bulkApplyButtons) {
+      button.addEventListener("click", () => {
+        const privilege = button.dataset.bulkApply;
+        if (!privilege) {
+          return;
+        }
+        const select = elements2.bulkSelects.find(
+          (item) => item.dataset.bulkSelect === privilege
+        );
+        if (!select || !select.value) {
+          logMessage(UI_TEXT.bulkUpdateNoSelection);
+          return;
+        }
+        applyBulkUpdate(privilege, select.value);
+      });
+    }
     for (const select of elements2.filterSelects) {
       select.addEventListener("change", async () => {
         const privilege = select.dataset.filter;