Remove administration from the publisher's domain

.env.dev

@@ -9,7 +9,6 @@ TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=http://localhost:9090
 
 # [synthetic]
 TRUSTED_SERVER__SYNTHETIC__COUNTER_STORE=counter_store
-TRUSTED_SERVER__SYNTHETIC__OPID_STORE=opid_store
 
 # [proxy]
 # Disable TLS certificate verification for local dev with self-signed certs

.env.example

@@ -21,7 +21,6 @@ TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://origin.publisher.com
 # Synthetic ID Settings
 # =============================================================================
 TRUSTED_SERVER__SYNTHETIC__COUNTER_STORE=counter_store
-TRUSTED_SERVER__SYNTHETIC__OPID_STORE=opid_store
 # Template variables: client_ip, user_agent, first_party_id, auth_user_id, publisher_domain, accept_language
 TRUSTED_SERVER__SYNTHETIC__TEMPLATE={{ client_ip }}:{{ user_agent }}:{{ first_party_id }}
 

.github/workflows/test.yml

@@ -62,9 +62,6 @@ jobs:
       - name: Run inline control harness
         run: BID_DELAY=3 ./scripts/template-cache-local-test.sh inline
 
-      - name: Run cache purge harness
-        run: BID_DELAY=3 ./scripts/template-cache-local-test.sh purge
-
       - name: Run config by host harness
         run: ./scripts/config-by-host-local-test.sh
 

crates/auction/prebid-server/src/lib.rs

@@ -3039,11 +3039,6 @@ mod tests {
 [auction]
 modules = ["prebid"]
 
-[[handlers]]
-path = "^/_ts/admin"
-username = "admin"
-password = "admin-pass"
-
 [publisher]
 domain = "test-publisher.com"
 cookie_domain = ".test-publisher.com"

crates/auction/prebid/src/lib.rs

@@ -1722,11 +1722,6 @@ mod tests {
 [auction]
 modules = ["prebid"]
 
-[[handlers]]
-path = "^/_ts/admin"
-username = "admin"
-password = "admin-pass"
-
 [publisher]
 domain = "test-publisher.com"
 cookie_domain = ".test-publisher.com"

crates/bot-protection/datadome/src/protection.rs

@@ -600,8 +600,6 @@ fn is_internal_path(path: &str) -> bool {
         || path.starts_with("/first-party/")
         || path == "/.well-known/trusted-server.json"
         || path == "/verify-signature"
-        || path.starts_with("/admin/")
-        || path.starts_with("/_ts/admin/")
         || path == "/_ts/api/v1/identify"
         || path == "/_ts/api/v1/batch-sync"
 }
@@ -950,6 +948,27 @@ mod tests {
             .is_some()
     }
 
+    #[test]
+    fn only_the_servers_own_paths_are_internal() {
+        for path in [
+            "/static/tsjs=tsjs-core.min.js",
+            "/integrations/example/script.js",
+            "/first-party/proxy",
+            "/.well-known/trusted-server.json",
+            "/verify-signature",
+            "/_ts/api/v1/identify",
+            "/_ts/api/v1/batch-sync",
+        ] {
+            assert!(is_internal_path(path), "{path} should skip protection");
+        }
+        for path in ["/", "/article", "/admin/", "/admin/login", "/wp-admin/"] {
+            assert!(
+                !is_internal_path(path),
+                "{path} is the publisher's own, so protection should be asked about it"
+            );
+        }
+    }
+
     #[test]
     fn protection_test_bypass_skips_api_suppresses_tag_and_strips_header() {
         let config = DataDomeConfig {

crates/tag/google-tag-manager/src/lib.rs

@@ -3050,11 +3050,6 @@ j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
     #[test]
     fn test_config_parsing() {
         let toml_str = r#"
-[[handlers]]
-path = "^/_ts/admin"
-username = "admin"
-password = "admin-pass"
-
 [publisher]
 domain = "test-publisher.com"
 cookie_domain = ".test-publisher.com"
@@ -3090,11 +3085,6 @@ assume_single_jurisdiction = true
     #[test]
     fn a_block_for_an_unnamed_integration_is_refused() {
         let toml_str = r#"
-[[handlers]]
-path = "^/_ts/admin"
-username = "admin"
-password = "admin-pass"
-
 [publisher]
 domain = "test-publisher.com"
 cookie_domain = ".test-publisher.com"

crates/testing/seam-probe/src/lib.rs

@@ -872,11 +872,6 @@ mod tests {
     fn settings_with_probe(body: &str) -> Settings {
         Settings::from_toml(&format!(
             r#"
-                [[handlers]]
-                path = "^/_ts/admin"
-                username = "admin"
-                password = "admin-pass"
-
                 [publisher]
                 domain = "test-publisher.example.com"
                 cookie_domain = ".test-publisher.example.com"
@@ -1120,11 +1115,6 @@ mod tests {
     fn validate_reports_not_selected_without_a_module_entry() {
         let settings = Settings::from_toml(
             r#"
-                [[handlers]]
-                path = "^/_ts/admin"
-                username = "admin"
-                password = "admin-pass"
-
                 [publisher]
                 domain = "test-publisher.example.com"
                 cookie_domain = ".test-publisher.example.com"