@iblai/data-layer 1.34.0 → 1.36.0

package/dist/index.js

@@ -39049,10 +39049,26 @@ const TENANT_IDENTIFIERS = {
 exports.SERVICES = void 0;
 (function (SERVICES) {
     SERVICES["LEGACY_LMS"] = "LEGACY_LMS";
+    /**
+     * The Open edX LMS. With `Config.edxProxyEnabled` the call goes through DM's
+     * `/v1/lms/{edx_path}` proxy with the DM token (DM mints the edX JWT
+     * server-side); otherwise it goes to the LMS host with the edX JWT. The
+     * proxy admits stock edX paths only: the `/api/ibl/...` family is refused,
+     * and any course or org a path names must belong to the token's platform.
+     */
     SERVICES["LMS"] = "LMS";
     SERVICES["DM"] = "DM";
     SERVICES["AXD"] = "AXD";
+    /** Open edX Studio (CMS); proxied through `/v1/studio/{edx_path}` like `LMS`. */
     SERVICES["STUDIO"] = "STUDIO";
+    /**
+     * The LMS host with the edX JWT, whatever `Config.edxProxyEnabled` says. Only
+     * for calls the proxy cannot serve: the login/token bootstrap and the
+     * `/api/ibl/...` paths DM has no replacement for yet.
+     */
+    SERVICES["LMS_DIRECT"] = "LMS_DIRECT";
+    /** The Studio host with its session cookie, CSRF token and edX JWT; see `LMS_DIRECT`. */
+    SERVICES["STUDIO_DIRECT"] = "STUDIO_DIRECT";
 })(exports.SERVICES || (exports.SERVICES = {}));
 /**
  * Client errors a retry cannot fix.
@@ -39157,6 +39173,14 @@ Config.axdUrl = 'https://base.manager.iblai.app';
 Config.mentorIframeUrl = 'https://mentor.iblai.tech';
 Config.studioUrl = 'https://studio.iblai.app';
 Config.httpErrorHandlers = {};
+/**
+ * Route `SERVICES.LMS` / `SERVICES.STUDIO` through DM's edX proxy
+ * (`{dmUrl}/v1/lms`, `{dmUrl}/v1/studio`) with the DM token instead of
+ * calling the edX hosts with the edX JWT. Needs DM 4.444.0+ with its proxy
+ * rules synced, so it is off by default and turned on per deployment via
+ * `initializeDataLayer(..., { edxProxy: true })`.
+ */
+Config.edxProxyEnabled = false;
 /**
  * Optional override for how expired auth tokens are re-minted after a 401.
  * Resolve `true` once fresh tokens are in storage. Left unset, the data
@@ -39217,17 +39241,19 @@ const iblFakeBaseQuery = react.retry(fakeBaseQueryWithLogging, {
     },
 });
 
+// The login / token bootstrap runs before the SPA holds a DM token (and mints
+// it), so these stay on the LMS host whatever `Config.edxProxyEnabled` says.
 const AUTH_ENDPOINTS = {
     GET_MFE_CONTEXT: {
-        service: exports.SERVICES.LMS,
+        service: exports.SERVICES.LMS_DIRECT,
         path: () => `/api/mfe_context`,
     },
     APPLE_EXCHANGE_TOKEN: {
-        service: exports.SERVICES.LMS,
+        service: exports.SERVICES.LMS_DIRECT,
         path: () => `/oauth2/exchange_access_token/apple-id/`,
     },
     GET_APP_TOKENS: {
-        service: exports.SERVICES.LMS,
+        service: exports.SERVICES.LMS_DIRECT,
         path: () => '/api/ibl/manager/consolidated-token/proxy/',
     },
     REFRESH_JWT_TOKEN: {
@@ -39344,6 +39370,15 @@ const refreshAuthTokenOnce = async () => {
     return refreshInFlight;
 };
 
+/**
+ * True when `service` is `LMS` or `STUDIO` and `Config.edxProxyEnabled` sends
+ * it through DM's edX proxy with the DM token.
+ */
+const isEdxProxied = (service) => Config.edxProxyEnabled && (service === exports.SERVICES.LMS || service === exports.SERVICES.STUDIO);
+/** The LMS host on its own origin, authenticated with the edX JWT. */
+const isDirectLms = (service) => service === exports.SERVICES.LMS_DIRECT || (service === exports.SERVICES.LMS && !Config.edxProxyEnabled);
+/** The Studio host on its own origin: session cookie + CSRF token + edX JWT. */
+const isDirectStudio = (service) => service === exports.SERVICES.STUDIO_DIRECT || (service === exports.SERVICES.STUDIO && !Config.edxProxyEnabled);
 /**
  * Get the service URL based on the provided service type.
  */
@@ -39352,15 +39387,44 @@ const getServiceUrl = (service) => {
         case exports.SERVICES.LEGACY_LMS:
             return Config.legacyLmsUrl;
         case exports.SERVICES.LMS:
+            return Config.edxProxyEnabled ? `${Config.dmUrl}/v1/lms` : Config.lmsUrl;
+        case exports.SERVICES.LMS_DIRECT:
             return Config.lmsUrl;
         case exports.SERVICES.DM:
             return Config.dmUrl;
         case exports.SERVICES.STUDIO:
+            return Config.edxProxyEnabled ? `${Config.dmUrl}/v1/studio` : Config.studioUrl;
+        case exports.SERVICES.STUDIO_DIRECT:
             return Config.studioUrl;
         default:
             return Config.dmUrl;
     }
 };
+/**
+ * The signed-in user's username from storage (`userData.user_nicename`), or
+ * null. DM's user endpoints take `username=<self>` explicitly where the edX
+ * ones inferred the caller from the JWT, so the endpoints that moved to DM
+ * read it from here when the caller does not pass one.
+ */
+const getStoredUsername = async () => {
+    var _a;
+    const storage = IblDataLayer.storage;
+    if (!storage) {
+        return null;
+    }
+    const raw = await storage.getItem(STORAGE_KEYS.USER_DATA);
+    if (!raw) {
+        return null;
+    }
+    try {
+        const data = (typeof raw === 'string' ? JSON.parse(raw) : raw);
+        const username = (_a = data === null || data === void 0 ? void 0 : data.user_nicename) !== null && _a !== void 0 ? _a : data === null || data === void 0 ? void 0 : data.username;
+        return typeof username === 'string' && username ? username : null;
+    }
+    catch (_b) {
+        return null;
+    }
+};
 /**
  * Read a cookie value by name. Returns null outside the browser or when the
  * cookie is absent. Used for Studio's CSRF token (`csrftoken`).
@@ -39381,22 +39445,26 @@ const getHeaders = async (service) => {
         throw new Error('Storage not initialized. Please ensure the data layer is properly initialized before making API calls.');
     }
     let token = null;
-    switch (service) {
-        case exports.SERVICES.DM:
-            token = await IblDataLayer.storage.getItem(STORAGE_KEYS.DM_TOKEN_KEY);
-            break;
-        case exports.SERVICES.AXD:
-            token = await IblDataLayer.storage.getItem(STORAGE_KEYS.AXD_TOKEN_KEY);
-            break;
-        default:
-            token = await IblDataLayer.storage.getItem(STORAGE_KEYS.EDX_TOKEN_KEY);
+    if (service === exports.SERVICES.DM || isEdxProxied(service)) {
+        token = await IblDataLayer.storage.getItem(STORAGE_KEYS.DM_TOKEN_KEY);
+    }
+    else if (service === exports.SERVICES.AXD) {
+        token = await IblDataLayer.storage.getItem(STORAGE_KEYS.AXD_TOKEN_KEY);
+    }
+    else {
+        token = await IblDataLayer.storage.getItem(STORAGE_KEYS.EDX_TOKEN_KEY);
     }
     if (!token || token.trim() === '') {
         return; // No Authorization header when no valid token
     }
+    // A storage that JSON-encodes strings on write hands the token back as
+    // `"token"`; send it bare, or DM refuses it as invalid.
+    if (token.startsWith('"') && token.endsWith('"')) {
+        token = token.slice(1, -1);
+    }
     let prefix;
     // Studio (Open edX CMS) accepts the same edX token as the LMS.
-    if (service === exports.SERVICES.LMS || service === exports.SERVICES.STUDIO) {
+    if (isDirectLms(service) || isDirectStudio(service)) {
         if (token.length > 30) {
             prefix = 'JWT';
         }
@@ -39407,7 +39475,7 @@ const getHeaders = async (service) => {
     else {
         prefix = 'Token';
     }
-    return token ? { Authorization: `${prefix} ${token}` } : undefined;
+    return { Authorization: `${prefix} ${token}` };
 };
 /**
  * Status codes that should not be retried for queryFn endpoints.
@@ -39542,7 +39610,7 @@ const isErrorObject = (data) => {
 const baseQuery = (service, jsonContentType = true, contentType, skipAuth = false) => query.fetchBaseQuery({
     baseUrl: getServiceUrl(service),
     timeout: 30000, // 30 second timeout
-    credentials: service === exports.SERVICES.LEGACY_LMS || service === exports.SERVICES.STUDIO ? 'include' : 'omit',
+    credentials: service === exports.SERVICES.LEGACY_LMS || isDirectStudio(service) ? 'include' : 'omit',
     prepareHeaders: async (headers) => {
         // Only add auth headers if skipAuth is false
         if (!skipAuth) {
@@ -39561,8 +39629,9 @@ const baseQuery = (service, jsonContentType = true, contentType, skipAuth = fals
             headers.set('Content-Type', contentType);
         }
         // Studio (Open edX CMS) endpoints require the Django CSRF token and only
-        // return JSON when asked for it explicitly.
-        if (service === exports.SERVICES.STUDIO) {
+        // return JSON when asked for it explicitly. Through DM's proxy neither
+        // applies: no cookies travel and DM mints the edX JWT.
+        if (isDirectStudio(service)) {
             const csrfToken = getCookieValue('csrftoken');
             if (csrfToken) {
                 headers.set('X-CSRFToken', csrfToken);
@@ -39573,7 +39642,7 @@ const baseQuery = (service, jsonContentType = true, contentType, skipAuth = fals
             headers.set('X-Requested-With', 'XMLHttpRequest');
         }
         // Add CSRF protection headers for LMS service
-        if (service === exports.SERVICES.LMS) {
+        if (isDirectLms(service)) {
             // Use mentorIframeUrl for both origin and referer
             // This matches the pattern used in loginCompleteApi.ts
             headers.set('Referer', Config.mentorIframeUrl);
@@ -40098,6 +40167,9 @@ const chatFilesApiSlice = react.createApi({
                 method: 'POST',
                 body: requestBody,
                 service: exports.SERVICES.DM,
+                // A thrown error reaches the caller as `{}`; the chat needs the 400
+                // body to tell an agent's file-type refusal from other failures.
+                returnErrorStatuses: [400],
             }),
         }),
     }),
@@ -40548,13 +40620,15 @@ const authApiSlice = react.createApi({
 const { useGetMfeContextQuery, useExchangeAppleTokenMutation, useGetAppTokensMutation, useLazyRefreshJwtTokenQuery, } = authApiSlice;
 
 const TENANTS_ENDPOINTS = {
+    // The DM view the edX `/api/ibl/users/manage/platform/` endpoint used to
+    // proxy; takes `username=<self>`.
     GET_USER_TENANTS: {
-        service: exports.SERVICES.LMS,
-        path: () => `/api/ibl/users/manage/platform/`,
+        service: exports.SERVICES.DM,
+        path: () => `/api/core/users/platforms/`,
     },
 };
 const TENANTS_QUERY_KEYS = {
-    GET_USER_TENANTS: () => ["USER_TENANTS"],
+    GET_USER_TENANTS: () => ['USER_TENANTS'],
 };
 
 const tenantApiSlice = react.createApi({
@@ -40570,11 +40644,18 @@ const tenantApiSlice = react.createApi({
             ...buildEndpointFromDmServiceLegacy(CoreService.coreOrgsMetadataUpdate),
             invalidatesTags: ['TenantMetadata'],
         }),
+        /** The platforms the signed-in user is linked to. `username` defaults to the stored user. */
         getUserTenants: builder.query({
-            queryFn: async () => {
+            queryFn: async (args) => {
+                var _a;
                 try {
-                    const authHeaders = await getHeaders(exports.SERVICES.LMS);
-                    const response = await fetch(`${Config.lmsUrl}${TENANTS_ENDPOINTS.GET_USER_TENANTS.path()}`, {
+                    const username = (_a = args === null || args === void 0 ? void 0 : args.username) !== null && _a !== void 0 ? _a : (await getStoredUsername());
+                    if (!username) {
+                        return { error: { status: 'CUSTOM_ERROR', data: 'No username available' } };
+                    }
+                    const { service, path } = TENANTS_ENDPOINTS.GET_USER_TENANTS;
+                    const authHeaders = await getHeaders(service);
+                    const response = await fetch(`${getServiceUrl(service)}${path()}?username=${encodeURIComponent(username)}`, {
                         headers: {
                             ...authHeaders,
                         },
@@ -41058,28 +41139,41 @@ const platformApiReducer = platformApiSlice.reducer;
 const { useUsersGradesPassedQuery, useLazyPlatformUsersQuery, useLazyPlatformUserGroupsQuery, usePlatformUserGroupsQuery, usePlatformInvitationsQuery, usePlatformUsersQuery, useInviteUserMutation, useUpdatePlatformUserRoleWithPoliciesMutation, useCreatePlatformUserGroupMutation, useUpdatePlatformUserGroupMutation, useDeletePlatformUserGroupMutation, useGetPlatformUserGroupDetailsQuery, useGetApplicationStatusQuery, useLazyGetApplicationStatusQuery, useGetApplicationFormQuery, useLazyGetApplicationFormQuery, useCreateApplicationDraftMutation, useUpdateApplicationMutation, useSubmitApplicationMutation, useUploadApplicationAttachmentMutation, useDeleteApplicationAttachmentMutation, useGetApplicationFormsQuery, useLazyGetApplicationFormsQuery, useGetApplicationFormDetailQuery, useLazyGetApplicationFormDetailQuery, useCreateApplicationFormMutation, useUpdateApplicationFormMutation, useGetApplicationsPipelineQuery, useLazyGetApplicationsPipelineQuery, useGetApplicationsPipelineStatsQuery, useListOwnApplicationsQuery, useLazyListOwnApplicationsQuery, useRenewApplicationMutation, useWithdrawApplicationMutation, useGetApplicationAdminDetailQuery, useLazyGetApplicationAdminDetailQuery, useTransitionApplicationMutation, useCreateApplicationWaiverMutation, useDeleteApplicationWaiverMutation, useSubmitApplicationOverrideMutation, useGetApplicationNotesQuery, useCreateApplicationNoteMutation, useUpdateApplicationNoteMutation, useDeleteApplicationNoteMutation, useLazyGetApplicationAttachmentFileQuery, useGetApplicationBlocksQuery, useDeleteApplicationBlockMutation, useGetApplicationPlacementsQuery, useCreateApplicationPlacementsMutation, useUpdateApplicationPlacementMutation, useGetApplicationCourseAssignmentsQuery, useCreateApplicationCourseAssignmentsMutation, useDeleteApplicationCourseAssignmentMutation, useInviteApplicationCandidateMutation, useLinkApplicationCandidateMutation, useUserPlatformsQuery, useLazyUserPlatformsQuery, } = platformApiSlice;
 
 const USERS_ENDPOINTS = {
+    // The merged edX + DM profile, served by DM itself (the same payload the edX
+    // `/api/ibl/users/manage/metadata/` endpoint used to proxy).
     GET_USER_METADATA: {
-        service: exports.SERVICES.LMS,
+        service: exports.SERVICES.DM,
+        path: () => `/api/core/users/metadata/proxy/`,
+    },
+    // TODO(iblai-platform#2707 B1): the write still goes to the edX plugin. Its
+    // edX half could be a merge-patch on `/api/user/v1/accounts/<self>`, but the
+    // DM-only fields (title, about, public_metadata, tour/onboarding flags) have
+    // no self-write endpoint on DM yet, and splitting the call would drop them.
+    UPDATE_USER_METADATA: {
+        service: exports.SERVICES.LMS_DIRECT,
         path: () => `/api/ibl/users/manage/metadata/`,
     },
     RESET_PASSWORD: {
         service: exports.SERVICES.LEGACY_LMS,
         path: () => `/ibl/edx/account/api/reset-password-token`,
     },
+    // Platform-admin flag on a user's platform link; DM syncs the matching edX
+    // org role itself.
     UPDATE_USER_ROLES: {
-        service: exports.SERVICES.LMS,
+        service: exports.SERVICES.DM,
+        path: () => `/api/core/users/platforms/`,
+    },
+    /** @deprecated The edX role write behind the legacy `{ username, org, role, active }` shape. */
+    UPDATE_USER_ROLES_EDX: {
+        service: exports.SERVICES.LMS_DIRECT,
         path: () => `/api/ibl/users/manage/roles/`,
     },
-    // All roles assigned to a user across every scope (global, org, course).
-    // The same path is served by the CMS/Studio host and, deprecated, by the LMS.
-    // Studio is the default because course-creation roles are only fully
-    // resolvable there; `lmsService` is the fallback for deployments without a
-    // reachable Studio host. Both hosts share one cache tag, so this stays a
-    // single endpoint rather than two.
+    // The caller's course access roles from the edX enrollment API, mapped onto
+    // the keys the plugin listing used (`course-staff`, ...). Org-wide roles live
+    // on the DM side (`/api/core/users/platforms/` → is_admin / is_staff).
     GET_USER_ROLES: {
-        service: exports.SERVICES.STUDIO,
-        lmsService: exports.SERVICES.LMS,
-        path: () => `/api/ibl/users/manage/roles/`,
+        service: exports.SERVICES.LMS,
+        path: () => `/api/enrollment/v1/roles/`,
     },
     UPLOAD_PROFILE_IMAGE: {
         service: exports.SERVICES.LMS,
@@ -41113,11 +41207,13 @@ const USERS_ENDPOINTS = {
 };
 const USERS_QUERY_KEYS = {
     GET_USER_METADATA: () => ['USER_METADATA'],
+    UPDATE_USER_METADATA: () => ['USER_METADATA'],
     GET_USER_PLATFORM_METADATA: () => ['USER_PLATFORM_METADATA'],
     GET_USER_METADATA_EDX: () => ['USER_METADATA_EDX'],
     GET_USER_PROFILE_SUMMARY: () => ['USER_PROFILE_SUMMARY'],
     RESET_PASSWORD: () => ['RESET_PASSWORD'],
     UPDATE_USER_ROLES: () => ['UPDATE_USER_ROLES'],
+    UPDATE_USER_ROLES_EDX: () => ['UPDATE_USER_ROLES'],
     GET_USER_ROLES: () => ['USER_ROLES'],
     UPLOAD_PROFILE_IMAGE: () => ['UPLOAD_PROFILE_IMAGE'],
     EDX_UPDATE_USER_METADATA: () => ['EDX_UPDATE_USER_METADATA'],
@@ -41126,6 +41222,44 @@ const USERS_QUERY_KEYS = {
 };
 const USERS_REDUCER_PATH = 'userApiSlice';
 
+/**
+ * Open edX `CourseAccessRole` names → the keys the edX plugin's role listing
+ * used, which the role filters and the apps' staff checks are written against.
+ */
+const EDX_ROLE_KEYS = {
+    staff: 'staff',
+    instructor: 'instructor',
+    limited_staff: 'limited-staff',
+    finance_admin: 'finance-admin',
+    sales_admin: 'sales-admin',
+    beta_testers: 'beta-tester',
+    library_user: 'library-user',
+    ccx_coach: 'ccx-coach',
+    data_researcher: 'data-researcher',
+    course_creator_group: 'course-creator',
+    support: 'support-staff',
+};
+const roleKey = (edxRole) => { var _a; return (_a = EDX_ROLE_KEYS[edxRole]) !== null && _a !== void 0 ? _a : edxRole.replace(/_/g, '-'); };
+/**
+ * Maps the edX enrollment roles API (`GET /api/enrollment/v1/roles/`) onto the
+ * `UserRole[]` shape the plugin listing returned: course rows become
+ * `course-<role>`, org rows `org-<role>`, and the global `is_staff` flag a
+ * `staff` row. The edX API only lists `CourseAccessRole` rows, so org-wide
+ * roles granted on the DM side (platform admin / staff) are not included.
+ */
+const mapEdxUserRoles = (response) => {
+    var _a;
+    const roles = ((_a = response === null || response === void 0 ? void 0 : response.roles) !== null && _a !== void 0 ? _a : []).map(({ role, org, course_id }) => {
+        const key = roleKey(role);
+        const scoped = course_id ? `course-${key}` : org ? `org-${key}` : key;
+        return { role: scoped, org: org !== null && org !== void 0 ? org : '', course: course_id !== null && course_id !== void 0 ? course_id : '' };
+    });
+    if (response === null || response === void 0 ? void 0 : response.is_staff) {
+        roles.unshift({ role: 'staff', org: '', course: '' });
+    }
+    return roles;
+};
+
 const userApiSlice = react.createApi({
     reducerPath: USERS_REDUCER_PATH,
     baseQuery: iblFetchBaseQuery,
@@ -41148,8 +41282,8 @@ const userApiSlice = react.createApi({
         }),
         updateUserMetadata: builder.mutation({
             query: (args) => ({
-                url: USERS_ENDPOINTS.GET_USER_METADATA.path(),
-                service: USERS_ENDPOINTS.GET_USER_METADATA.service,
+                url: USERS_ENDPOINTS.UPDATE_USER_METADATA.path(),
+                service: USERS_ENDPOINTS.UPDATE_USER_METADATA.service,
                 body: args,
                 method: 'POST',
                 params: { username: args.username },
@@ -41158,8 +41292,8 @@ const userApiSlice = react.createApi({
         }),
         updateUserAccount: builder.mutation({
             query: (args) => ({
-                url: USERS_ENDPOINTS.GET_USER_METADATA.path(),
-                service: USERS_ENDPOINTS.GET_USER_METADATA.service,
+                url: USERS_ENDPOINTS.UPDATE_USER_METADATA.path(),
+                service: USERS_ENDPOINTS.UPDATE_USER_METADATA.service,
                 body: args,
                 method: 'POST',
                 params: { username: args.username },
@@ -41188,45 +41322,45 @@ const userApiSlice = react.createApi({
                 };
             },
         }),
+        /**
+         * Make a user a platform admin, or demote them. Takes the DM platform-link
+         * shape (`user_id`, `platform_key`, `is_admin`); DM syncs the edX org role.
+         * The legacy `{ username, org, role, active }` shape still writes the edX
+         * role directly and is deprecated.
+         */
         updateUserRole: builder.mutation({
-            query: (args) => ({
-                url: USERS_ENDPOINTS.UPDATE_USER_ROLES.path(),
-                service: USERS_ENDPOINTS.UPDATE_USER_ROLES.service,
-                body: args,
-                method: 'POST',
-            }),
+            query: (args) => 'user_id' in args
+                ? {
+                    url: USERS_ENDPOINTS.UPDATE_USER_ROLES.path(),
+                    service: USERS_ENDPOINTS.UPDATE_USER_ROLES.service,
+                    body: {
+                        user_id: args.user_id,
+                        platform_key: args.platform_key,
+                        is_admin: args.is_admin,
+                    },
+                    method: 'POST',
+                }
+                : {
+                    url: USERS_ENDPOINTS.UPDATE_USER_ROLES_EDX.path(),
+                    service: USERS_ENDPOINTS.UPDATE_USER_ROLES_EDX.service,
+                    body: args,
+                    method: 'POST',
+                },
             invalidatesTags: [featureTags.PLATFORM_USERS, ...USERS_QUERY_KEYS.GET_USER_ROLES()],
         }),
         /**
-         * Every role assigned to a user, across all scopes — global, organization
-         * and individual course. A user with no roles returns `[]`.
-         *
-         * At least one of `username`, `email` or `userId` is required (400
-         * otherwise). Non-staff users can only look up their own roles; asking for
-         * someone else's returns 404.
-         *
-         * Defaults to the CMS/Studio host, where course-creation roles are fully
-         * resolvable; pass `useLms` to fall back to the deprecated LMS host.
+         * The signed-in user's course access roles (`course-staff`,
+         * `course-instructor`, ...) plus a global `staff` row when they are edX
+         * staff, from the edX enrollment roles API through DM's proxy. A user with
+         * no roles returns `[]`. Org-wide roles are not listed here: DM holds them
+         * on the user's platform link.
          */
         getUserRoles: builder.query({
-            query: ({ username, email, userId, useLms }) => {
-                const endpoint = USERS_ENDPOINTS.GET_USER_ROLES;
-                const params = {};
-                if (username) {
-                    params.username = username;
-                }
-                if (email) {
-                    params.email = email;
-                }
-                if (userId !== undefined) {
-                    params.user_id = userId;
-                }
-                return {
-                    url: endpoint.path(),
-                    service: useLms ? endpoint.lmsService : endpoint.service,
-                    params,
-                };
-            },
+            query: () => ({
+                url: USERS_ENDPOINTS.GET_USER_ROLES.path(),
+                service: USERS_ENDPOINTS.GET_USER_ROLES.service,
+            }),
+            transformResponse: mapEdxUserRoles,
             providesTags: USERS_QUERY_KEYS.GET_USER_ROLES(),
         }),
         getUserMetadataEdx: builder.query({
@@ -44158,30 +44292,61 @@ const coursesApiSlice = react.createApi({
 });
 const { useGetUserEnrolledCoursesQuery, useLazyGetUserEnrolledCoursesQuery, useGetUserAssignedCoursesQuery, useLazyGetUserAssignedCoursesQuery, useGetLearnerCourseOutlineQuery, useLazyGetLearnerCourseOutlineQuery, } = coursesApiSlice;
 
+/** One request through the base query, unwrapped to its payload. */
+const fetchData = async (args, api, extraOptions) => {
+    const result = await iblFetchBaseQuery(args, api, extraOptions);
+    if (result.error) {
+        throw result.error;
+    }
+    return result.data;
+};
+/**
+ * DM's catalog user endpoints take `username=<self>` where the edX plugin
+ * inferred the caller from the JWT; a caller that passes none gets the stored
+ * user.
+ */
+const fetchForUser = async (path, params, username, api, extraOptions) => {
+    const user = username !== null && username !== void 0 ? username : (await getStoredUsername());
+    if (!user) {
+        return { error: { status: 400, data: 'No username available' } };
+    }
+    const search = new URLSearchParams({ username: user, ...params });
+    const data = await fetchData({ url: `${path}?${search.toString()}`, service: exports.SERVICES.DM, method: 'GET' }, api, extraOptions);
+    return { data };
+};
 const courseMetadataApiSlice = react.createApi({
     reducerPath: 'courseMetadataApiSlice',
     baseQuery: iblFetchBaseQuery,
     endpoints: (builder) => ({
+        /**
+         * The edX plugin's `course_metadata` payload, served by DM (to signed-in
+         * and anonymous callers alike).
+         */
         getCourseMetaData: builder.query({
             query: ({ courseKey }) => ({
-                url: `/api/ibl/v1/course_metadata?course_key=${encodeURIComponent(courseKey)}`,
-                service: exports.SERVICES.LMS,
+                url: `/v1/courses/metadata?course_id=${encodeURIComponent(courseKey)}`,
+                service: exports.SERVICES.DM,
                 method: 'GET',
             }),
+            // DM leaves the price null where the plugin said "Free".
+            transformResponse: (course) => {
+                var _a;
+                return ({
+                    ...course,
+                    course_price: (_a = course.course_price) !== null && _a !== void 0 ? _a : 'Free',
+                });
+            },
         }),
+        /**
+         * The completion outline, from DM. DM answers 404 for a course the user is
+         * not enrolled in, where the edX plugin returned an empty outline.
+         */
         getCourseCompletionOutlines: builder.query({
-            query: ({ courseKey }) => ({
-                url: `/api/ibl/completion/course_outline/${courseKey}?course_id=${encodeURIComponent(courseKey)}`,
-                service: exports.SERVICES.LMS,
-                method: 'GET',
-            }),
+            queryFn: ({ courseKey, username }, api, extraOptions) => fetchForUser('/api/catalog/enrollment/courses/completion/', { course_id: courseKey, endpoint: 'outline' }, username, api, extraOptions),
         }),
+        /** Enrollment eligibility, from DM. Same fields as the edX plugin plus `is_eligible`. */
         getCourseEligibility: builder.query({
-            query: ({ courseKey }) => ({
-                url: `/api/ibl/enrollment/enroll_status?course_id=${encodeURIComponent(courseKey)}`,
-                service: exports.SERVICES.LMS,
-                method: 'GET',
-            }),
+            queryFn: ({ courseKey, username }, api, extraOptions) => fetchForUser('/api/catalog/eligibility/courses/check/', { course_id: courseKey }, username, api, extraOptions),
         }),
         createCourseEnrollment: builder.mutation({
             query: (body) => ({
@@ -44224,38 +44389,54 @@ const edxSsoApiSlice = react.createApi({
 });
 const { useGetEdxSSOTokenQuery, useLazyGetEdxSSOTokenQuery } = edxSsoApiSlice;
 
+// Endpoints DM's edX proxy admits use `SERVICES.STUDIO` (proxied when
+// `Config.edxProxyEnabled`). The rest are pinned to the Studio host: the
+// `api/ibl` manage endpoints the proxy refuses, and the session + CSRF views.
 const STUDIO_AUTHORING_ENDPOINTS = {
+    // Course-creator app endpoint, not under `api/ibl` so the proxy reaches it.
+    // Takes `{ org, display_name, number, run }`, answers `{ course_parent_locator }`.
     CREATE_COURSE: {
-        path: (contentType) => `/api/ibl/manage/${contentType}/`,
+        path: () => '/api/v1/ibl/course/create',
         service: exports.SERVICES.STUDIO,
     },
+    // Libraries still go through the plugin's manage endpoint.
+    CREATE_LIBRARY: {
+        path: (contentType) => `/api/ibl/manage/${contentType}/`,
+        service: exports.SERVICES.STUDIO_DIRECT,
+    },
+    // TODO(iblai-platform#2707 B5): no DM or proxy replacement for course delete.
     DELETE_COURSE: {
         path: () => '/api/ibl/manage/course/delete',
-        service: exports.SERVICES.STUDIO,
+        service: exports.SERVICES.STUDIO_DIRECT,
     },
+    // TODO(iblai-platform#2707 row 13 / B6): the edX half could become a
+    // `contentstore/v1/course_details` PUT through the proxy, but the DM catalog
+    // half (`/api/catalog/metadata/course/`) is DM-admin only, so the combined
+    // plugin endpoint stays until platform admins can write catalog metadata.
     COURSE_SETTINGS: {
         path: (contentType) => `/api/ibl/v1/${contentType}_settings/`,
-        service: exports.SERVICES.STUDIO,
+        service: exports.SERVICES.STUDIO_DIRECT,
     },
+    // Session + CSRF views, not JWT-capable: stay on the Studio host.
     CREATE_XBLOCK: {
         path: () => '/xblock/',
-        service: exports.SERVICES.STUDIO,
+        service: exports.SERVICES.STUDIO_DIRECT,
     },
     UPDATE_XBLOCK: {
         path: (locator) => `/xblock/${locator}`,
-        service: exports.SERVICES.STUDIO,
+        service: exports.SERVICES.STUDIO_DIRECT,
     },
     SCORM_SUBMIT: {
         path: (locator) => `/xblock/${locator}/handler/studio_submit`,
-        service: exports.SERVICES.STUDIO,
+        service: exports.SERVICES.STUDIO_DIRECT,
     },
     UPLOAD_ASSET: {
         path: (courseKey) => `/assets/${courseKey}/`,
-        service: exports.SERVICES.STUDIO,
+        service: exports.SERVICES.STUDIO_DIRECT,
     },
     ADVANCED_SETTINGS: {
         path: (courseKey) => `/settings/advanced/${courseKey}`,
-        service: exports.SERVICES.STUDIO,
+        service: exports.SERVICES.STUDIO_DIRECT,
     },
     VIDEO_UPLOAD: {
         path: (courseKey) => `/api/v1/ibl/course/${courseKey}/s3-upload`,
@@ -44263,23 +44444,88 @@ const STUDIO_AUTHORING_ENDPOINTS = {
     },
 };
 
+const RUN_SUFFIX_ALPHABET = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
 /**
- * Studio (Open edX CMS) course-authoring endpoints. These hit the Studio host
- * (`Config.studioUrl`) with cookie-session auth + CSRF token, mirroring how
- * Studio's own frontend talks to it.
+ * A course number derived from the display name: letters, digits and single
+ * hyphens, at most 30 characters, `COURSE` when nothing usable is left.
+ */
+const courseNumberFromDisplayName = (displayName) => {
+    const number = displayName
+        .trim()
+        .replace(/[^A-Za-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 30)
+        .replace(/-+$/, '');
+    return number || 'COURSE';
+};
+/** A run like `2026_a1B`: the year plus a short random suffix, as Studio's own generator makes them. */
+const generateCourseRun = (now = new Date()) => {
+    let suffix = '';
+    for (let index = 0; index < 3; index += 1) {
+        suffix += RUN_SUFFIX_ALPHABET[Math.floor(Math.random() * RUN_SUFFIX_ALPHABET.length)];
+    }
+    return `${now.getFullYear()}_${suffix}`;
+};
+/**
+ * The course-creator endpoint needs `number` and `run`, which the old plugin
+ * endpoint generated itself; fill them in when the caller only gave `org` and
+ * `display_name`.
+ */
+const withCourseNumberAndRun = (courseData) => {
+    var _a, _b;
+    return ({
+        ...courseData,
+        number: (_a = courseData.number) !== null && _a !== void 0 ? _a : courseNumberFromDisplayName(courseData.display_name),
+        run: (_b = courseData.run) !== null && _b !== void 0 ? _b : generateCourseRun(),
+    });
+};
+/** `block-v1:ORG+NUM+RUN+type@course+block@course` → `course-v1:ORG+NUM+RUN`. */
+const courseKeyFromLocator = (locator) => {
+    const match = /^block-v1:(.+)\+type@course\+block@course$/.exec(locator);
+    return match ? `course-v1:${match[1]}` : undefined;
+};
+
+/**
+ * Studio (Open edX CMS) course-authoring endpoints. Course creation and video
+ * upload reach Studio through DM's edX proxy when `Config.edxProxyEnabled`;
+ * the rest hit the Studio host (`Config.studioUrl`) with cookie-session auth +
+ * CSRF token, mirroring how Studio's own frontend talks to it.
  */
 const studioAuthoringApiSlice = react.createApi({
     reducerPath: 'studioAuthoringApiSlice',
     baseQuery: iblFetchBaseQuery,
     endpoints: (builder) => ({
-        /** Create the course (or library) shell. Returns `course_key`. */
+        /**
+         * Create the course (or library) shell. Returns `course_key`.
+         *
+         * A course goes to the course-creator endpoint, which needs `number` and
+         * `run` (generated from the display name when absent) and answers with the
+         * root block locator; `course_key` is derived from it. A library still uses
+         * the plugin's manage endpoint on the Studio host.
+         */
         createStudioCourse: builder.mutation({
-            query: ({ courseData, contentType = 'course' }) => ({
-                url: STUDIO_AUTHORING_ENDPOINTS.CREATE_COURSE.path(contentType),
-                service: STUDIO_AUTHORING_ENDPOINTS.CREATE_COURSE.service,
-                method: 'POST',
-                body: courseData,
-            }),
+            query: ({ courseData, contentType = 'course' }) => contentType === 'course'
+                ? {
+                    url: STUDIO_AUTHORING_ENDPOINTS.CREATE_COURSE.path(),
+                    service: STUDIO_AUTHORING_ENDPOINTS.CREATE_COURSE.service,
+                    method: 'POST',
+                    body: withCourseNumberAndRun(courseData),
+                }
+                : {
+                    url: STUDIO_AUTHORING_ENDPOINTS.CREATE_LIBRARY.path(contentType),
+                    service: STUDIO_AUTHORING_ENDPOINTS.CREATE_LIBRARY.service,
+                    method: 'POST',
+                    body: courseData,
+                },
+            transformResponse: (response) => {
+                var _a;
+                return ({
+                    ...response,
+                    course_key: (_a = response.course_key) !== null && _a !== void 0 ? _a : (typeof response.course_parent_locator === 'string'
+                        ? courseKeyFromLocator(response.course_parent_locator)
+                        : undefined),
+                });
+            },
         }),
         /** Delete a course — used as rollback when a later creation step fails. */
         deleteStudioCourse: builder.mutation({
@@ -47168,9 +47414,11 @@ const edxProctoringApiSlice = react.createApi({
 const { useGetExamInfoQuery, useLazyGetExamInfoQuery, useUpdateExamAttemptMutation, useStartExamMutation, } = edxProctoringApiSlice;
 
 const RETIREMENT_ENDPOINTS = {
+    // Retires the caller (no body). Answers 202: the retirement then runs
+    // asynchronously on DM and edX.
     SELF_RETIRE: {
-        service: exports.SERVICES.LMS,
-        path: () => `/api/ibl/retirements/self_retire/`,
+        service: exports.SERVICES.DM,
+        path: () => `/api/core/users/delete/`,
     },
 };
 
@@ -49950,7 +50198,8 @@ const skillsMiddleware = [
     userLlmUsageApiSlice.middleware,
 ];
 
-const initializeDataLayer = (dmUrl, lmsUrl, legacyLmsUrl, storageService, httpErrorHandler = {}, studioUrl, refreshAuthToken) => {
+const initializeDataLayer = (dmUrl, lmsUrl, legacyLmsUrl, storageService, httpErrorHandler = {}, studioUrl, refreshAuthToken, options) => {
+    var _a;
     IblDataLayer.storage = storageService;
     Config.dmUrl = dmUrl;
     Config.lmsUrl = lmsUrl;
@@ -49960,6 +50209,7 @@ const initializeDataLayer = (dmUrl, lmsUrl, legacyLmsUrl, storageService, httpEr
         Config.studioUrl = studioUrl;
     }
     Config.refreshAuthToken = refreshAuthToken;
+    Config.edxProxyEnabled = (_a = options === null || options === void 0 ? void 0 : options.edxProxy) !== null && _a !== void 0 ? _a : false;
 };
 
 exports.AGENT_SKILLS_ENDPOINTS = AGENT_SKILLS_ENDPOINTS;