The drawer stops making counsel guess

The one idea

What shipped

Why folder import is a gesture, not a button

The obvious feature is: pick a folder, we fetch its children. We cannot, and the reason is the scope we deliberately chose. PRAMAAN asks Google for drive.file — the narrowest scope that exists: it grants access to the individual files counsel hands us in our own picker, and nothing else. A folder’s children were never handed to us, so they are not reachable, by design.

The alternative is drive.readonly: a restricted scope that reads counsel’s entire Drive, gated behind Google’s CASA security assessment. For a litigation platform holding privileged material, asking a law firm for blanket read access to everything they own is the wrong trade at any price. So we keep the narrow grant and say the true thing out loud: open the folder in the picker, select all (⌘A). Multi-select was already enabled; the picker already navigates folders. Nothing to build — only something to say.

Why an outside click needs guards at all

A drawer that closes on an outside click is table stakes — until you notice what counts as “outside”. Google’s picker renders its own dialog into <body>, outside our Radix content. Every click counsel makes inside the picker — every file they select — is an outside click on the drawer behind it. Without a guard, choosing a file would close the very drawer waiting to receive it.

The second guard is about bytes, not pixels. Rows that are fetching, uploading or reading own live requests. Unmounting the drawer kills them. So the drawer vetoes its own dismissal while any row is in flight — and only while: the X still closes it at any time, because a deliberate close means “I trust the background”, exactly what the footer’s trust line promises.

The token: consent once, not once per pick

Before this Story every “Choose from Drive” minted a brand-new token, so Google’s consent popup appeared on every single pick — a firm importing eight bundles saw it eight times. The token was always good for an hour; we simply threw it away.

Now it is held in module memory with its expiry, reused until five minutes before it dies, and re-issued silently after that. And because a token can die ahead of its own clock (revoked, rotated), a Drive fetch that comes back 401 drops the cache, re-issues once with prompt: "", and repeats the call. One retry, then the row fails honestly. Counsel sees a popup once per page life — and a reload forgets everything, which is the point of module memory rather than storage.

Where it lives

How to see it

Storybook → Matters/Import/ImportIntoMatterSheetV2: Empty (the unarmed instruction; click the scrim — it closes), ArmedClient (the armed line), DrivePickerLoading and BusyOutsideClickNoClose (click the scrim — nothing happens; the X still works). Token reuse is live-only: pick from Drive twice in one page life and the second pick shows no Google popup.