The coach framework and the UI Toolkit are the same; the environment around the page changed:
- Host and paths: coaches are served through the Zen front door under a path prefix (/baw/<instance>/...). Any hard-coded absolute URL such as /rest/bpm/wle/v1/... or /teamworks/... now misses the prefix. Build URLs from the page: the robust way is to derive the base from window.location.pathname up to and including the instance segment, or to call services through the Service Call control (no URL at all).
- CSRF: every non-GET REST call from the browser (and every call to /bpm, /ops) needs the BPMCSRFToken header; direct XHR code without it gets CWTBG0651E. Get the token once per page with POST <base>/bpm/system/login.
- Cookies and iframes: Workplace renders coaches inside its shell; third-party cookie rules and the SameSite attribute of the Zen session cookie mean pop-ups or iframes to other hosts may lose the session - keep everything on the Cloud Pak origin.
- Content Security Policy: the Zen front door sets stricter headers; inline <script> tags in coach view HTML and eval-style libraries may be blocked - move code into the view's JavaScript sections and included managed assets.
- Portal APIs: code that relied on Process Portal globals (the collaboration stream, portal navigation objects) has no equivalent in Workplace.
- Browser support: no Internet Explorer; the coach framework on 21+ dropped IE-specific shims, and Dojo is still there but older dijit widgets from custom views may not render in Workplace's shell.
// base URL and CSRF token that work on traditional BAW and on CP4BA
var base = (function () { var p = window.location.pathname; var m = p.match(/^(.*?)\/(teamworks|ProcessPortal|workplace)\b/i); return m ? m[1] : ""; })(); // "" on traditional, "/baw/bawins1" on CP4BA
var csrf = null;
function withToken(cb) {
if (csrf) return cb(csrf);
var x = new XMLHttpRequest(); x.open("POST", base + "/bpm/system/login", true); x.setRequestHeader("Content-Type", "application/json");
x.onload = function () { csrf = JSON.parse(x.responseText).csrf_token; cb(csrf); };
x.send(JSON.stringify({ refresh_groups: false, requested_lifetime: 7200 }));
}
withToken(function (t) {
var x = new XMLHttpRequest(); x.open("PUT", base + "/rest/bpm/wle/v1/task/" + taskId + "?action=assign&toMe=true&parts=none", true);
x.setRequestHeader("BPMCSRFToken", t); x.send();
});The best migration move is to replace direct XHR in coach views with the UI Toolkit Service Call control and service flows: the framework handles the prefix, the token and the session on both platforms.
References