Fix Sourcepoint first-party consent: iframe asset 404s + same-origin message guard

crates/trusted-server-core/src/integrations/datadome.rs

@@ -803,7 +803,7 @@ impl IntegrationAttributeRewriter for DataDomeIntegration {
         &self,
         _attr_name: &str,
         attr_value: &str,
-        ctx: &IntegrationAttributeContext<'_>,
+        _ctx: &IntegrationAttributeContext<'_>,
     ) -> AttributeRewriteAction {
         // Check if this is a DataDome script URL
         let is_datadome =
@@ -814,10 +814,8 @@ impl IntegrationAttributeRewriter for DataDomeIntegration {
         }
 
         let path = Self::extract_datadome_path(attr_value);
-        let new_url = format!(
-            "{}://{}/integrations/datadome{}",
-            ctx.request_scheme, ctx.request_host, path
-        );
+        // Root-relative so the browser resolves it against the page host.
+        let new_url = format!("/integrations/datadome{path}");
 
         log::info!(
             "[datadome] Rewriting script src from {} to {}",
@@ -1328,10 +1326,7 @@ mod tests {
         let action = integration.rewrite("src", "https://js.datadome.co/tags.js", &ctx);
         match action {
             AttributeRewriteAction::Replace(new_url) => {
-                assert_eq!(
-                    new_url,
-                    "https://publisher.com/integrations/datadome/tags.js"
-                );
+                assert_eq!(new_url, "/integrations/datadome/tags.js");
             }
             _ => panic!("Expected Replace action"),
         }
@@ -1340,10 +1335,7 @@ mod tests {
         let action = integration.rewrite("href", "https://js.datadome.co/tags.js", &ctx);
         match action {
             AttributeRewriteAction::Replace(new_url) => {
-                assert_eq!(
-                    new_url,
-                    "https://publisher.com/integrations/datadome/tags.js"
-                );
+                assert_eq!(new_url, "/integrations/datadome/tags.js");
             }
             _ => panic!("Expected Replace action for href"),
         }
@@ -1368,10 +1360,7 @@ mod tests {
         let action = integration.rewrite("src", "https://js.datadome.co/js/check", &ctx);
         match action {
             AttributeRewriteAction::Replace(new_url) => {
-                assert_eq!(
-                    new_url,
-                    "https://publisher.com/integrations/datadome/js/check"
-                );
+                assert_eq!(new_url, "/integrations/datadome/js/check");
             }
             _ => panic!("Expected Replace action"),
         }
@@ -1380,10 +1369,7 @@ mod tests {
         let action = integration.rewrite("href", "//js.datadome.co/js/signal", &ctx);
         match action {
             AttributeRewriteAction::Replace(new_url) => {
-                assert_eq!(
-                    new_url,
-                    "https://publisher.com/integrations/datadome/js/signal"
-                );
+                assert_eq!(new_url, "/integrations/datadome/js/signal");
             }
             _ => panic!("Expected Replace action for protocol-relative URL"),
         }
@@ -1392,10 +1378,7 @@ mod tests {
         let action = integration.rewrite("src", "https://js.datadome.co", &ctx);
         match action {
             AttributeRewriteAction::Replace(new_url) => {
-                assert_eq!(
-                    new_url,
-                    "https://publisher.com/integrations/datadome/tags.js"
-                );
+                assert_eq!(new_url, "/integrations/datadome/tags.js");
             }
             _ => panic!("Expected Replace action for bare domain"),
         }

crates/trusted-server-core/src/integrations/gpt.rs

@@ -435,17 +435,15 @@ impl IntegrationAttributeRewriter for GptIntegration {
         &self,
         _attr_name: &str,
         attr_value: &str,
-        ctx: &IntegrationAttributeContext<'_>,
+        _ctx: &IntegrationAttributeContext<'_>,
     ) -> AttributeRewriteAction {
         if !self.config.rewrite_script {
             return AttributeRewriteAction::keep();
         }
 
         if Self::is_gpt_script_url(attr_value) {
-            AttributeRewriteAction::replace(format!(
-                "{}://{}/integrations/gpt/script",
-                ctx.request_scheme, ctx.request_host
-            ))
+            // Root-relative so the browser resolves it against the page host.
+            AttributeRewriteAction::replace("/integrations/gpt/script".to_string())
         } else {
             AttributeRewriteAction::keep()
         }
@@ -587,8 +585,8 @@ mod tests {
         match result {
             AttributeRewriteAction::Replace(url) => {
                 assert_eq!(
-                    url, "https://edge.example.com/integrations/gpt/script",
-                    "should rewrite to first-party script endpoint"
+                    url, "/integrations/gpt/script",
+                    "should rewrite to root-relative first-party script endpoint"
                 );
             }
             other => panic!("Expected Replace action, got {:?}", other),

crates/trusted-server-core/src/integrations/lockr.rs

@@ -412,17 +412,15 @@ impl IntegrationAttributeRewriter for LockrIntegration {
         &self,
         _attr_name: &str,
         attr_value: &str,
-        ctx: &IntegrationAttributeContext<'_>,
+        _ctx: &IntegrationAttributeContext<'_>,
     ) -> AttributeRewriteAction {
         if !self.config.rewrite_sdk {
             return AttributeRewriteAction::Keep;
         }
 
         if self.is_lockr_sdk_url(attr_value) {
-            let replacement = format!(
-                "{}://{}/integrations/lockr/sdk",
-                ctx.request_scheme, ctx.request_host
-            );
+            // Root-relative so the browser resolves it against the page host.
+            let replacement = "/integrations/lockr/sdk".to_string();
             log::debug!("Rewriting Lockr SDK URL to {}", replacement);
             AttributeRewriteAction::Replace(replacement)
         } else {
@@ -532,10 +530,8 @@ mod tests {
 
         assert_eq!(
             result,
-            AttributeRewriteAction::Replace(
-                "https://edge.example.com/integrations/lockr/sdk".to_string()
-            ),
-            "should rewrite Lockr SDK URL to first-party proxy"
+            AttributeRewriteAction::Replace("/integrations/lockr/sdk".to_string()),
+            "should rewrite Lockr SDK URL to root-relative first-party proxy"
         );
     }
 

crates/trusted-server-core/src/integrations/permutive.rs

@@ -425,18 +425,16 @@ impl IntegrationAttributeRewriter for PermutiveIntegration {
         &self,
         _attr_name: &str,
         attr_value: &str,
-        ctx: &IntegrationAttributeContext<'_>,
+        _ctx: &IntegrationAttributeContext<'_>,
     ) -> AttributeRewriteAction {
         if !self.config.rewrite_sdk {
             return AttributeRewriteAction::keep();
         }
 
         if self.is_permutive_sdk_url(attr_value) {
-            // Rewrite to first-party SDK endpoint
-            AttributeRewriteAction::replace(format!(
-                "{}://{}/integrations/permutive/sdk",
-                ctx.request_scheme, ctx.request_host
-            ))
+            // Rewrite to first-party SDK endpoint.
+            // Root-relative so the browser resolves it against the page host.
+            AttributeRewriteAction::replace("/integrations/permutive/sdk".to_string())
         } else {
             AttributeRewriteAction::keep()
         }
@@ -547,7 +545,7 @@ mod tests {
 
         assert!(matches!(rewritten, AttributeRewriteAction::Replace(_)));
         if let AttributeRewriteAction::Replace(url) = rewritten {
-            assert_eq!(url, "https://edge.example.com/integrations/permutive/sdk");
+            assert_eq!(url, "/integrations/permutive/sdk");
         }
     }