Extract existing Sourcepoint consent synchronization

crates/trusted-server-adapter-axum/src/app.rs

@@ -172,6 +172,14 @@ where
 {
     let services = state.services_for_request(&ctx)?;
     let mut req = ctx.into_request()?;
+    if req.uri().path() == trusted_server_core::ec::consent_update::CONSENT_UPDATE_PATH {
+        req = match trusted_server_core::ec::consent_update::prepare_consent_update(&services, req)
+            .await
+        {
+            Ok(request) => request,
+            Err(response) => return Ok(*response),
+        };
+    }
     if let Err(error) = trusted_server_core::integrations::gpt_diagnostics::prepare_request(
         &state.settings,
         &mut req,
@@ -292,6 +300,7 @@ enum EcRoute {
     Publisher,
     Auction,
     PageBids,
+    ConsentUpdate,
 }
 
 // ---------------------------------------------------------------------------
@@ -355,6 +364,9 @@ async fn dispatch_ec_route(
         registry: Some(&state.partners),
     };
     let result = match route {
+        EcRoute::ConsentUpdate => Ok(
+            trusted_server_core::ec::consent_update::handle_consent_update(&req, ec.graph.as_ref()),
+        ),
         EcRoute::Auction => {
             handle_auction(
                 &state.settings,
@@ -481,6 +493,7 @@ enum NamedRouteHandler {
     LegacyAdminDenied,
     Auction,
     PageBids,
+    ConsentUpdate,
     Identify,
     FirstPartyProxy,
     FirstPartyClick,
@@ -504,8 +517,23 @@ const LEGACY_ADMIN_DENY_METHODS: &[Method] = &[
     Method::DELETE,
 ];
 
-fn named_routes() -> [NamedRoute; 18] {
+fn named_routes() -> [NamedRoute; 19] {
     [
+        NamedRoute {
+            path: trusted_server_core::ec::consent_update::CONSENT_UPDATE_PATH,
+            primary_methods: &[
+                Method::GET,
+                Method::POST,
+                Method::HEAD,
+                Method::OPTIONS,
+                Method::PUT,
+                Method::PATCH,
+                Method::DELETE,
+                Method::TRACE,
+                Method::CONNECT,
+            ],
+            handler: NamedRouteHandler::ConsentUpdate,
+        },
         NamedRoute {
             path: "/_ts/api/v1/identify",
             primary_methods: &[Method::GET, Method::OPTIONS],
@@ -683,6 +711,9 @@ fn named_route_handler(
                         handle_admin_eids_lookup(&state.partners, &req)
                     }
                     NamedRouteHandler::LegacyAdminDenied => Ok(legacy_admin_alias_denied()),
+                    NamedRouteHandler::ConsentUpdate => {
+                        dispatch_ec_route(&state, &services, req, EcRoute::ConsentUpdate).await
+                    }
                     NamedRouteHandler::Identify => {
                         // Read-only identity lookup never enters generation or
                         // response finalization, including cookie ingestion.

crates/trusted-server-adapter-axum/tests/routes.rs

@@ -256,6 +256,61 @@ fn axum_main_exits_non_zero_when_settings_fail() {
     );
 }
 
+#[tokio::test]
+async fn consent_route_rejects_other_methods_and_foreign_origins_locally() {
+    // CONNECT is registered defensively, but HTTP authority-form targets cannot
+    // address this path. Core's method tests cover its application rejection.
+    assert_route_registered("CONNECT", "/_ts/consent");
+    let server = TestServer::with_test_settings().await;
+    for method in ["GET", "HEAD", "OPTIONS", "PUT", "PATCH", "DELETE", "TRACE"] {
+        assert_route_registered(method, "/_ts/consent");
+        let response = send(server.request(method, "/_ts/consent")).await;
+        assert_eq!(
+            response.status().as_u16(),
+            405,
+            "should reject {method} locally"
+        );
+        assert!(!response.headers().contains_key("set-cookie"));
+        assert_eq!(response.headers()["allow"], "POST");
+    }
+    let response = send(
+        server
+            .request("POST", "/_ts/consent")
+            .header("origin", "https://foreign.example.com")
+            .header("content-type", "application/json")
+            .body(r#"{"gppString":null,"applicableSections":[]}"#),
+    )
+    .await;
+    assert_eq!(
+        response.status().as_u16(),
+        403,
+        "should reject a foreign origin"
+    );
+    assert!(!response.headers().contains_key("set-cookie"));
+    server.assert_no_outbound_requests();
+}
+
+#[tokio::test]
+async fn consent_route_without_storage_is_unavailable_and_does_not_mint() {
+    let server = TestServer::with_test_settings().await;
+    let origin = format!("http://{}", server.server.address());
+    let response = send(
+        server
+            .request("POST", "/_ts/consent")
+            .header("origin", origin)
+            .header("content-type", "application/json")
+            .body(r#"{"gppString":null,"applicableSections":[]}"#),
+    )
+    .await;
+    assert_eq!(
+        response.status().as_u16(),
+        503,
+        "should not acknowledge unavailable storage"
+    );
+    assert!(!response.headers().contains_key("set-cookie"));
+    server.assert_no_outbound_requests();
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn aps_profile_serves_renderer_through_adapter_fallback() {
     let mut settings = test_settings();
@@ -299,6 +354,7 @@ fn all_explicit_routes_are_registered() {
         ("POST", "/admin/keys/rotate"),
         ("POST", "/admin/keys/deactivate"),
         ("POST", "/auction"),
+        ("POST", "/_ts/consent"),
         // SPA re-auction endpoint, plus its deprecated `/__ts/` alias. Both
         // paths are spelled out as literals rather than referencing
         // `PAGE_BIDS_PATH` / `PAGE_BIDS_LEGACY_PATH` so this test pins the

crates/trusted-server-adapter-cloudflare/src/app.rs

@@ -538,6 +538,22 @@ fn router_builder(state: &Arc<AppState>) -> RouterBuilder {
         ) -> Result<Response, EdgeError> {
             let services = state.services_for_request(&ctx)?;
             let mut req = ctx.into_request()?;
+            if req.uri().path() == trusted_server_core::ec::consent_update::CONSENT_UPDATE_PATH {
+                // Reserve this path without an identity graph; never forward
+                // consent snapshots or acknowledge an unpersisted revocation.
+                return Ok(
+                    match trusted_server_core::ec::consent_update::prepare_consent_update(
+                        &services, req,
+                    )
+                    .await
+                    {
+                        Ok(req) => trusted_server_core::ec::consent_update::handle_consent_update(
+                            &req, None,
+                        ),
+                        Err(response) => *response,
+                    },
+                );
+            }
             if let Some(response) = deny_admin_diagnostic_fallback(&req) {
                 return Ok(response);
             }

crates/trusted-server-adapter-fastly/src/app.rs

@@ -571,6 +571,14 @@ async fn execute_named(
 ) -> Result<Response, EdgeError> {
     let services = build_per_request_services(&state, &ctx)?;
     let mut req = ctx.into_request()?;
+    if matches!(handler, NamedRouteHandler::ConsentUpdate) {
+        req = match trusted_server_core::ec::consent_update::prepare_consent_update(&services, req)
+            .await
+        {
+            Ok(req) => req,
+            Err(response) => return Ok(*response),
+        };
+    }
 
     // S2S batch sync uses Bearer auth (not EC cookies), so it skips EC
     // context creation entirely — mirroring the dedicated early arm in the
@@ -698,6 +706,12 @@ async fn run_named_route(
                 .await
             }
         }
+        NamedRouteHandler::ConsentUpdate => Ok(
+            trusted_server_core::ec::consent_update::handle_consent_update(
+                &req,
+                ec.finalize_kv_graph.as_ref(),
+            ),
+        ),
         NamedRouteHandler::SetTester => handle_set_tester(&state.settings),
         NamedRouteHandler::ClearTester => handle_clear_tester(&state.settings),
         NamedRouteHandler::Auction => {
@@ -807,6 +821,14 @@ async fn dispatch_fallback(
     services: &RuntimeServices,
     mut req: Request,
 ) -> Response {
+    if req.uri().path() == trusted_server_core::ec::consent_update::CONSENT_UPDATE_PATH {
+        return match trusted_server_core::ec::consent_update::prepare_consent_update(services, req)
+            .await
+        {
+            Ok(req) => trusted_server_core::ec::consent_update::handle_consent_update(&req, None),
+            Err(response) => *response,
+        };
+    }
     if let Some(response) = deny_admin_diagnostic_fallback(&req) {
         return response;
     }
@@ -1091,6 +1113,7 @@ enum NamedRouteHandler {
     LegacyAdminDenied,
     BatchSync,
     Identify,
+    ConsentUpdate,
     SetTester,
     ClearTester,
     Auction,
@@ -1123,6 +1146,21 @@ const LEGACY_ADMIN_DENY_METHODS: &[Method] = &[
 ];
 
 const NAMED_ROUTES: &[NamedRoute] = &[
+    NamedRoute {
+        path: trusted_server_core::ec::consent_update::CONSENT_UPDATE_PATH,
+        primary_methods: &[
+            Method::GET,
+            Method::POST,
+            Method::HEAD,
+            Method::OPTIONS,
+            Method::PUT,
+            Method::PATCH,
+            Method::DELETE,
+            Method::TRACE,
+            Method::CONNECT,
+        ],
+        handler: NamedRouteHandler::ConsentUpdate,
+    },
     NamedRoute {
         path: "/.well-known/trusted-server.json",
         primary_methods: &[Method::GET],

crates/trusted-server-adapter-spin/src/app.rs

@@ -820,6 +820,22 @@ fn router_builder(state: &Arc<AppState>) -> RouterBuilder {
         ) -> Result<Response, EdgeError> {
             let services = state.services_for_request(&ctx)?;
             let mut req = ctx.into_request()?;
+            if req.uri().path() == trusted_server_core::ec::consent_update::CONSENT_UPDATE_PATH {
+                // Reserve this path without an identity graph; never forward
+                // consent snapshots or acknowledge an unpersisted revocation.
+                return Ok(
+                    match trusted_server_core::ec::consent_update::prepare_consent_update(
+                        &services, req,
+                    )
+                    .await
+                    {
+                        Ok(req) => trusted_server_core::ec::consent_update::handle_consent_update(
+                            &req, None,
+                        ),
+                        Err(response) => *response,
+                    },
+                );
+            }
             if let Some(response) = deny_admin_diagnostic_fallback(&req) {
                 return Ok(response);
             }