Add configuration to disable the GDPR API

lib/decidim/helsinki_profile.rb

@@ -47,6 +47,13 @@ module HelsinkiProfile
       true
     end
 
+    # Set this to `false` in case the Helsinki profile authentication server is
+    # used only for AD/Entra authentications. When set to `true` (default), the
+    # GDPR API endpoints are added to the application.
+    config_accessor :gdpr_api_enabled do
+      true
+    end
+
     # Allows changing the auth service name in case we need to perform a
     # "handover" process from the legacy authentication server. Once Helsinki
     # profile is ready to be used, this configuration is no longer needed.

lib/decidim/helsinki_profile/engine.rb

@@ -9,11 +9,13 @@ class Engine < ::Rails::Engine
 
       routes do
         # GDPR API
-        namespace :gdpr_api, path: "gdpr-api" do
-          namespace :v1 do
-            # GET /gdpr-api/v1/profiles/:uuid
-            # DELETE /gdpr-api/v1/profiles/:uuid
-            resources :profiles, only: [:show, :destroy], param: :uuid
+        if Decidim::HelsinkiProfile.gdpr_api_enabled
+          namespace :gdpr_api, path: "gdpr-api" do
+            namespace :v1 do
+              # GET /gdpr-api/v1/profiles/:uuid
+              # DELETE /gdpr-api/v1/profiles/:uuid
+              resources :profiles, only: [:show, :destroy], param: :uuid
+            end
           end
         end