@iblai/data-layer 1.12.107 → 1.13.1

package/dist/index.js

@@ -39144,6 +39144,12 @@ Config.axdUrl = 'https://base.manager.iblai.app';
 Config.mentorIframeUrl = 'https://mentor.iblai.tech';
 Config.studioUrl = 'https://studio.iblai.app';
 Config.httpErrorHandlers = {};
+/**
+ * Optional override for how expired auth tokens are re-minted after a 401.
+ * Resolve `true` once fresh tokens are in storage. Left unset, the data
+ * layer mints them itself from the edX session.
+ */
+Config.refreshAuthToken = undefined;
 
 class IblDataLayer {
 }
@@ -39198,6 +39204,133 @@ const iblFakeBaseQuery = react.retry(fakeBaseQueryWithLogging, {
     },
 });
 
+const AUTH_ENDPOINTS = {
+    GET_MFE_CONTEXT: {
+        service: exports.SERVICES.LMS,
+        path: () => `/api/mfe_context`,
+    },
+    APPLE_EXCHANGE_TOKEN: {
+        service: exports.SERVICES.LMS,
+        path: () => `/oauth2/exchange_access_token/apple-id/`,
+    },
+    GET_APP_TOKENS: {
+        service: exports.SERVICES.LMS,
+        path: () => '/api/ibl/manager/consolidated-token/proxy/',
+    },
+    REFRESH_JWT_TOKEN: {
+        service: exports.SERVICES.LEGACY_LMS,
+        path: () => '/ibl-auth/request-jwt/',
+    },
+};
+const AUTH_REDUCER_PATH = 'authApiSlice';
+
+/**
+ * Expiry keys are written alongside the tokens so `hasNonExpiredAuthToken()`
+ * and friends don't treat a freshly minted token as stale.
+ */
+const AXD_TOKEN_EXPIRES_KEY = 'axd_token_expires';
+const DM_TOKEN_EXPIRES_KEY = 'dm_token_expires';
+/** Reads the platform key the tokens should be minted for. */
+const readPlatformKey = async () => {
+    var _a;
+    const storage = IblDataLayer.storage;
+    if (!storage)
+        return null;
+    const raw = await storage.getItem(STORAGE_KEYS.CURRENT_TENANT);
+    if (raw) {
+        try {
+            const key = (_a = JSON.parse(raw)) === null || _a === void 0 ? void 0 : _a.key;
+            if (key)
+                return key;
+        }
+        catch (_b) {
+            // `current_tenant` is occasionally stored as a bare slug rather than the
+            // serialised tenant object; use it as-is.
+            if (raw.trim())
+                return raw;
+        }
+    }
+    return (await storage.getItem(STORAGE_KEYS.TENANT)) || null;
+};
+/**
+ * Mints a fresh set of app tokens from the edX session and writes them to
+ * storage. Deliberately uses `fetch` rather than the data layer's own base
+ * query: routing it through `iblFetchBaseQuery` would re-enter the 401
+ * handling this function exists to serve.
+ */
+const defaultRefreshAuthToken = async () => {
+    var _a, _b;
+    const storage = IblDataLayer.storage;
+    if (!storage)
+        return false;
+    const platformKey = await readPlatformKey();
+    if (!platformKey) {
+        console.warn('[token-refresh] No platform key in storage, cannot refresh');
+        return false;
+    }
+    // The consolidated-token endpoint authenticates with the edX JWT, not with
+    // the axd/dm tokens that just expired.
+    const authHeaders = await getHeaders(AUTH_ENDPOINTS.GET_APP_TOKENS.service);
+    if (!(authHeaders === null || authHeaders === void 0 ? void 0 : authHeaders.Authorization)) {
+        console.warn('[token-refresh] No edX token available, cannot refresh');
+        return false;
+    }
+    const formData = new FormData();
+    formData.append('platform_key', platformKey);
+    const url = `${getServiceUrl(AUTH_ENDPOINTS.GET_APP_TOKENS.service)}${AUTH_ENDPOINTS.GET_APP_TOKENS.path()}`;
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: { Authorization: authHeaders.Authorization },
+        body: formData,
+    });
+    if (!response.ok) {
+        console.warn(`[token-refresh] Mint failed with ${response.status}`);
+        return false;
+    }
+    const body = (await response.json());
+    const axdToken = (_a = body === null || body === void 0 ? void 0 : body.data) === null || _a === void 0 ? void 0 : _a.axd_token;
+    const dmToken = (_b = body === null || body === void 0 ? void 0 : body.data) === null || _b === void 0 ? void 0 : _b.dm_token;
+    if (!(axdToken === null || axdToken === void 0 ? void 0 : axdToken.token) || !(dmToken === null || dmToken === void 0 ? void 0 : dmToken.token)) {
+        console.warn('[token-refresh] Mint returned no tokens');
+        return false;
+    }
+    await storage.setItem(STORAGE_KEYS.AXD_TOKEN_KEY, axdToken.token);
+    await storage.setItem(STORAGE_KEYS.DM_TOKEN_KEY, dmToken.token);
+    if (axdToken.expires) {
+        await storage.setItem(AXD_TOKEN_EXPIRES_KEY, axdToken.expires);
+    }
+    if (dmToken.expires) {
+        await storage.setItem(DM_TOKEN_EXPIRES_KEY, dmToken.expires);
+    }
+    return true;
+};
+/** The refresh currently in flight, if any. */
+let refreshInFlight = null;
+/**
+ * Refreshes the auth tokens, collapsing concurrent callers onto one request.
+ * A page load that fires ten requests in parallel produces ten 401s; without
+ * this they would mint ten token sets and race each other into storage.
+ *
+ * Never rejects — a thrown refresh resolves `false`, which callers read as
+ * "give up and run the registered 401 handler" (i.e. log out).
+ */
+const refreshAuthTokenOnce = async () => {
+    var _a;
+    if (!refreshInFlight) {
+        const refresh = (_a = Config.refreshAuthToken) !== null && _a !== void 0 ? _a : defaultRefreshAuthToken;
+        refreshInFlight = Promise.resolve()
+            .then(() => refresh())
+            .catch((error) => {
+            console.error('[token-refresh] Refresh threw:', error);
+            return false;
+        })
+            .finally(() => {
+            refreshInFlight = null;
+        });
+    }
+    return refreshInFlight;
+};
+
 /**
  * Get the service URL based on the provided service type.
  */
@@ -39292,6 +39425,7 @@ const buildEndpointFromService = (service, serviceFn, options) => {
         async queryFn(args) {
             var _a;
             let lastError;
+            let refreshAttempted = false;
             for (let attempt = 0; attempt <= maxRetries; attempt++) {
                 try {
                     OpenAPI.BASE = getServiceUrl(service);
@@ -39303,6 +39437,17 @@ const buildEndpointFromService = (service, serviceFn, options) => {
                 catch (err) {
                     lastError = err;
                     const status = err === null || err === void 0 ? void 0 : err.status;
+                    // An expired token is recoverable: mint a new one and replay the
+                    // call (headers are rebuilt at the top of the loop) rather than
+                    // dropping straight to the 401 handler, which logs the user out.
+                    // One attempt per call, so a token the server keeps rejecting can't
+                    // loop.
+                    if (status === 401 && !refreshAttempted) {
+                        refreshAttempted = true;
+                        if (await refreshAuthTokenOnce()) {
+                            continue;
+                        }
+                    }
                     // Don't retry auth errors, statuses the endpoint expects as an
                     // empty state, or a spend-cap block (fail fast — no retry storm).
                     if (QUERYFN_NON_RETRYABLE_STATUSES.includes(status) ||
@@ -39457,10 +39602,23 @@ const withNonRetryableErrors = (query$1) => async (args, api, extraOptions) => {
 const iblFetchBaseQuery = async (args, api, extraOptions) => {
     var _a, _b, _c;
     try {
+        const runQuery = () => {
+            var _a;
+            return query.retry(withNonRetryableErrors(baseQuery(args.service, (_a = args === null || args === void 0 ? void 0 : args.isJson) !== null && _a !== void 0 ? _a : true, args === null || args === void 0 ? void 0 : args.contentType, args === null || args === void 0 ? void 0 : args.skipAuth)), {
+                maxRetries: 3,
+            })(args, api, extraOptions);
+        };
         // Executing base query
-        const result = await query.retry(withNonRetryableErrors(baseQuery(args.service, (_a = args === null || args === void 0 ? void 0 : args.isJson) !== null && _a !== void 0 ? _a : true, args === null || args === void 0 ? void 0 : args.contentType, args === null || args === void 0 ? void 0 : args.skipAuth)), {
-            maxRetries: 3,
-        })(args, api, extraOptions);
+        let result = await runQuery();
+        // An expired token is recoverable: mint a new one and replay the request
+        // (`prepareHeaders` re-reads storage per call) rather than dropping
+        // straight to the 401 handler, which logs the user out. One attempt per
+        // request, so a token the server keeps rejecting can't loop.
+        if (((_a = result.error) === null || _a === void 0 ? void 0 : _a.status) === 401 && !(args === null || args === void 0 ? void 0 : args.skipAuth)) {
+            if (await refreshAuthTokenOnce()) {
+                result = await runQuery();
+            }
+        }
         // Query completed
         if (result.error) {
             console.log('[MONETIZATION ERROR HANDLER]: ', { result });
@@ -39534,6 +39692,7 @@ const buildEndpointFromServiceLegacy = (service, serviceFn, options) => {
     return {
         async queryFn(args) {
             let lastError;
+            let refreshAttempted = false;
             for (let attempt = 0; attempt <= maxRetries; attempt++) {
                 try {
                     OpenAPI.BASE = getServiceUrl(service);
@@ -39545,6 +39704,14 @@ const buildEndpointFromServiceLegacy = (service, serviceFn, options) => {
                 catch (err) {
                     lastError = err;
                     const status = err === null || err === void 0 ? void 0 : err.status;
+                    // See the note in `buildEndpointFromService`: refresh once and
+                    // replay before letting a 401 reach the logout handler.
+                    if (status === 401 && !refreshAttempted) {
+                        refreshAttempted = true;
+                        if (await refreshAuthTokenOnce()) {
+                            continue;
+                        }
+                    }
                     if (QUERYFN_NON_RETRYABLE_STATUSES.includes(status) ||
                         expectedErrorStatuses.includes(status)) {
                         break;
@@ -40229,26 +40396,6 @@ const promptsApiSlice = react.createApi({
 });
 const { useGetPromptCategoriesQuery, useLazyGetPromptCategoriesQuery, useGetPromptsQuery, useLazyGetPromptsQuery, useGetPromptsSearchQuery, useLazyGetPromptsSearchQuery, useCreatePromptMutation, useUpdatePromptMutation, useDeletePromptMutation, useGetGuidedPromptsQuery, useLazyGetGuidedPromptsQuery, } = promptsApiSlice;
 
-const AUTH_ENDPOINTS = {
-    GET_MFE_CONTEXT: {
-        service: exports.SERVICES.LMS,
-        path: () => `/api/mfe_context`,
-    },
-    APPLE_EXCHANGE_TOKEN: {
-        service: exports.SERVICES.LMS,
-        path: () => `/oauth2/exchange_access_token/apple-id/`,
-    },
-    GET_APP_TOKENS: {
-        service: exports.SERVICES.LMS,
-        path: () => '/api/ibl/manager/consolidated-token/proxy/',
-    },
-    REFRESH_JWT_TOKEN: {
-        service: exports.SERVICES.LEGACY_LMS,
-        path: () => '/ibl-auth/request-jwt/',
-    },
-};
-const AUTH_REDUCER_PATH = 'authApiSlice';
-
 const authApiSlice = react.createApi({
     reducerPath: AUTH_REDUCER_PATH,
     baseQuery: iblFetchBaseQuery,
@@ -40799,6 +40946,17 @@ const USERS_ENDPOINTS = {
         service: exports.SERVICES.LMS,
         path: () => `/api/ibl/users/manage/roles/`,
     },
+    // All roles assigned to a user across every scope (global, org, course).
+    // The same path is served by the CMS/Studio host and, deprecated, by the LMS.
+    // Studio is the default because course-creation roles are only fully
+    // resolvable there; `lmsService` is the fallback for deployments without a
+    // reachable Studio host. Both hosts share one cache tag, so this stays a
+    // single endpoint rather than two.
+    GET_USER_ROLES: {
+        service: exports.SERVICES.STUDIO,
+        lmsService: exports.SERVICES.LMS,
+        path: () => `/api/ibl/users/manage/roles/`,
+    },
     UPLOAD_PROFILE_IMAGE: {
         service: exports.SERVICES.LMS,
         path: (username) => `/api/user/v1/accounts/${username}/image`,
@@ -40828,6 +40986,7 @@ const USERS_QUERY_KEYS = {
     GET_USER_METADATA_EDX: () => ['USER_METADATA_EDX'],
     RESET_PASSWORD: () => ['RESET_PASSWORD'],
     UPDATE_USER_ROLES: () => ['UPDATE_USER_ROLES'],
+    GET_USER_ROLES: () => ['USER_ROLES'],
     UPLOAD_PROFILE_IMAGE: () => ['UPLOAD_PROFILE_IMAGE'],
     EDX_UPDATE_USER_METADATA: () => ['EDX_UPDATE_USER_METADATA'],
     EDX_GET_USER_METADATA: () => ['EDX_GET_USER_METADATA'],
@@ -40842,6 +41001,7 @@ const userApiSlice = react.createApi({
         ...USERS_QUERY_KEYS.GET_USER_METADATA(),
         ...USERS_QUERY_KEYS.GET_USER_METADATA_EDX(),
         ...USERS_QUERY_KEYS.GET_USER_PLATFORM_METADATA(),
+        ...USERS_QUERY_KEYS.GET_USER_ROLES(),
         featureTags.PLATFORM_USERS,
     ],
     endpoints: (builder) => ({
@@ -40902,7 +41062,39 @@ const userApiSlice = react.createApi({
                 body: args,
                 method: 'POST',
             }),
-            invalidatesTags: [featureTags.PLATFORM_USERS],
+            invalidatesTags: [featureTags.PLATFORM_USERS, ...USERS_QUERY_KEYS.GET_USER_ROLES()],
+        }),
+        /**
+         * Every role assigned to a user, across all scopes — global, organization
+         * and individual course. A user with no roles returns `[]`.
+         *
+         * At least one of `username`, `email` or `userId` is required (400
+         * otherwise). Non-staff users can only look up their own roles; asking for
+         * someone else's returns 404.
+         *
+         * Defaults to the CMS/Studio host, where course-creation roles are fully
+         * resolvable; pass `useLms` to fall back to the deprecated LMS host.
+         */
+        getUserRoles: builder.query({
+            query: ({ username, email, userId, useLms }) => {
+                const endpoint = USERS_ENDPOINTS.GET_USER_ROLES;
+                const params = {};
+                if (username) {
+                    params.username = username;
+                }
+                if (email) {
+                    params.email = email;
+                }
+                if (userId !== undefined) {
+                    params.user_id = userId;
+                }
+                return {
+                    url: endpoint.path(),
+                    service: useLms ? endpoint.lmsService : endpoint.service,
+                    params,
+                };
+            },
+            providesTags: USERS_QUERY_KEYS.GET_USER_ROLES(),
         }),
         getUserMetadataEdx: builder.query({
             query: (args) => ({
@@ -40971,7 +41163,27 @@ const userApiSlice = react.createApi({
         }),
     }),
 });
-const { useGetUserMetadataQuery, useLazyGetUserMetadataQuery, useUpdateUserMetadataMutation, useUpdateUserAccountMutation, useResetPasswordMutation, useUpdateUserRoleMutation, useUploadProfileImageMutation, useRemoveProfileImageMutation, useGetUserMetadataEdxQuery, useLazyGetUserMetadataEdxQuery, useUpdateUserMetadataEdxMutation, useGetUserPlatformMetadataQuery, useLazyGetUserPlatformMetadataQuery, useUpdateUserPlatformMetadataMutation, } = userApiSlice;
+const { useGetUserMetadataQuery, useLazyGetUserMetadataQuery, useUpdateUserMetadataMutation, useUpdateUserAccountMutation, useResetPasswordMutation, useUpdateUserRoleMutation, useGetUserRolesQuery, useLazyGetUserRolesQuery, useUploadProfileImageMutation, useRemoveProfileImageMutation, useGetUserMetadataEdxQuery, useLazyGetUserMetadataEdxQuery, useUpdateUserMetadataEdxMutation, useGetUserPlatformMetadataQuery, useLazyGetUserPlatformMetadataQuery, useUpdateUserPlatformMetadataMutation, } = userApiSlice;
+
+/**
+ * Scope a role row applies to, read off its `org`/`course` fields:
+ * both empty → global, `org` only → org, both set → course.
+ */
+const getUserRoleScope = (role) => {
+    if (role.course) {
+        return 'course';
+    }
+    if (role.org) {
+        return 'org';
+    }
+    return 'global';
+};
+/** Roles that apply platform-wide (e.g. `staff`). */
+const filterGlobalUserRoles = (roles) => roles.filter((role) => getUserRoleScope(role) === 'global');
+/** Roles scoped to an organization, optionally narrowed to one org short name. */
+const filterOrgUserRoles = (roles, org) => roles.filter((role) => getUserRoleScope(role) === 'org' && (org === undefined || role.org === org));
+/** Roles scoped to a course run, optionally narrowed to one course ID. */
+const filterCourseUserRoles = (roles, course) => roles.filter((role) => getUserRoleScope(role) === 'course' && (course === undefined || role.course === course));
 
 /**
  * Shared fetch for the paginated LTI provider list endpoints. Sends
@@ -48143,7 +48355,7 @@ const skillsMiddleware = [
     userChatHistoryApiSlice.middleware,
 ];
 
-const initializeDataLayer = (dmUrl, lmsUrl, legacyLmsUrl, storageService, httpErrorHandler = {}, studioUrl) => {
+const initializeDataLayer = (dmUrl, lmsUrl, legacyLmsUrl, storageService, httpErrorHandler = {}, studioUrl, refreshAuthToken) => {
     IblDataLayer.storage = storageService;
     Config.dmUrl = dmUrl;
     Config.lmsUrl = lmsUrl;
@@ -48152,6 +48364,7 @@ const initializeDataLayer = (dmUrl, lmsUrl, legacyLmsUrl, storageService, httpEr
     if (studioUrl) {
         Config.studioUrl = studioUrl;
     }
+    Config.refreshAuthToken = refreshAuthToken;
 };
 
 exports.AGENT_SKILLS_ENDPOINTS = AGENT_SKILLS_ENDPOINTS;
@@ -48300,9 +48513,13 @@ exports.evalTotalPages = evalTotalPages;
 exports.evaluationsApiSlice = evaluationsApiSlice;
 exports.fakeBaseQueryWithLogging = fakeBaseQueryWithLogging;
 exports.featureTags = featureTags;
+exports.filterCourseUserRoles = filterCourseUserRoles;
+exports.filterGlobalUserRoles = filterGlobalUserRoles;
+exports.filterOrgUserRoles = filterOrgUserRoles;
 exports.filterSlashSkills = filterSlashSkills;
 exports.getNextRecentMessagesPageParam = getNextRecentMessagesPageParam;
 exports.getSpendCapExceededError = getSpendCapExceededError;
+exports.getUserRoleScope = getUserRoleScope;
 exports.gradingApiSlice = gradingApiSlice;
 exports.iblFakeBaseQuery = iblFakeBaseQuery;
 exports.initializeDataLayer = initializeDataLayer;
@@ -48764,6 +48981,7 @@ exports.useGetUserProjectDetailsQuery = useGetUserProjectDetailsQuery;
 exports.useGetUserProjectsQuery = useGetUserProjectsQuery;
 exports.useGetUserReportedSkillsQuery = useGetUserReportedSkillsQuery;
 exports.useGetUserResumeQuery = useGetUserResumeQuery;
+exports.useGetUserRolesQuery = useGetUserRolesQuery;
 exports.useGetUserSkillsPointsQuery = useGetUserSkillsPointsQuery;
 exports.useGetUserSpendCapQuery = useGetUserSpendCapQuery;
 exports.useGetUserTenantsQuery = useGetUserTenantsQuery;
@@ -48973,6 +49191,7 @@ exports.useLazyGetUserProjectDetailsQuery = useLazyGetUserProjectDetailsQuery;
 exports.useLazyGetUserProjectsQuery = useLazyGetUserProjectsQuery;
 exports.useLazyGetUserReportedSkillsQuery = useLazyGetUserReportedSkillsQuery;
 exports.useLazyGetUserResumeQuery = useLazyGetUserResumeQuery;
+exports.useLazyGetUserRolesQuery = useLazyGetUserRolesQuery;
 exports.useLazyGetUserSkillsPointsQuery = useLazyGetUserSkillsPointsQuery;
 exports.useLazyGetUserSpendCapQuery = useLazyGetUserSpendCapQuery;
 exports.useLazyGetUserTenantsQuery = useLazyGetUserTenantsQuery;