UX-WSF-002 — Share the selected resource with a canonical link
| Field | Value |
|---|---|
| Status | Open; source-verified |
| Severity | High |
| Components | sparqd/oqullus, sparqd/bff-api, sparqd/workspace-file-management-backend |
| Associated issues | Not opened |
Concrete observed case
The page-level Share action uses paginatedItems[0], not an explicitly selected
resource. The Share dialog copies /workspace/{publicId}, while application
routes use /admin/workspace/{folderId} for folders and
/admin/workspace/create/{fileId} for files. Member choices are limited to the
first 100 account members, and ACL-fetch failure is converted to an empty list.
Expected condition
Share begins from an explicit resource identity. A canonical typed deep link opens that exact resource after authorization. Permission-load failures remain visible and prevent misleading grant management.
Why it matters
The page action can grant access to the wrong row, while the copied URL leads to no matching application route. Large accounts also cannot select members beyond the first fetched page.
Existing controls and workarounds
Row-level sharing uses the clicked item, and backend ACL enforcement remains authoritative. Share from the row and open shared resources from the Workspace tree rather than the copied list-view link.
Alternatives considered
- Recommended: one resource route that resolves
{type, publicId}, then redirects to the appropriate authorized view. - Generate separate existing file and folder routes in the dialog.
- Continue inferring type client-side only — workable but easier to drift.
Component involvement
- Oqullus requires explicit selection, pages member search, handles ACL-load failure, and copies the canonical route.
- The backend resolves stable typed resource identity and enforces grants.
- BFF API preserves authentication, pagination, and denial responses.
Reproduction and verification
Follow WSF-S004.
Resolution conditions
Close when selection, member pagination/search, ACL failure, and deep-link tests pass for files and folders under each role.
Validation and blockers
The route and selection defects are source-confirmed. Two-user deployed role validation remains pending.