feat: check consent for DNPM 2.1 requests (#126)

Co-authored-by: Jakub Lidke <jakub.lidke@uni-marburg.de>

6 files changed, 508 insertions, 18 deletions

diff --git a/src/test/kotlin/dev/dnpm/etl/processor/consent/Dnpm21BasedConsentEvaluatorTest.kt b/src/test/kotlin/dev/dnpm/etl/processor/consent/Dnpm21BasedConsentEvaluatorTest.kt
new file mode 100644
index 0000000..adbec2f
--- /dev/null
+++ b/src/test/kotlin/dev/dnpm/etl/processor/consent/Dnpm21BasedConsentEvaluatorTest.kt
@@ -0,0 +1,287 @@
+/*
+ * This file is part of ETL-Processor
+ *
+ * Copyright (c) 2025  Comprehensive Cancer Center Mainfranken, Datenintegrationszentrum Philipps-Universität Marburg and Contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package dev.dnpm.etl.processor.consent
+
+import dev.dnpm.etl.processor.ArgProvider
+import dev.pcvolkmer.mv64e.mtb.*
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Nested
+import org.junit.jupiter.api.extension.ExtendWith
+import org.junit.jupiter.params.ParameterizedTest
+import org.junit.jupiter.params.provider.Arguments
+import org.junit.jupiter.params.provider.ArgumentsSource
+import org.mockito.ArgumentMatchers.anyString
+import org.mockito.Mock
+import org.mockito.junit.jupiter.MockitoExtension
+import org.mockito.kotlin.whenever
+import java.time.Instant
+import java.util.*
+
+@ExtendWith(MockitoExtension::class)
+class Dnpm21BasedConsentEvaluatorTest {
+
+    @Nested
+    inner class WithGicsConsentEnabled {
+
+        lateinit var consentService: GicsConsentService
+        lateinit var consentEvaluator: ConsentEvaluator
+
+        @BeforeEach
+        fun setUp(
+            @Mock consentService: GicsConsentService
+        ) {
+            this.consentService = consentService
+            this.consentEvaluator = ConsentEvaluator(consentService)
+        }
+
+        @ParameterizedTest
+        @ArgumentsSource(WithGicsMtbFileProvider::class)
+        fun test(
+            mtbFile: Mtb,
+            ttpConsentStatus: TtpConsentStatus,
+            expectedConsentEvaluation: ConsentEvaluation
+        ) {
+            whenever(consentService.getTtpBroadConsentStatus(anyString())).thenReturn(
+                ttpConsentStatus
+            )
+            assertThat(consentEvaluator.check(mtbFile)).isEqualTo(expectedConsentEvaluation)
+        }
+    }
+
+    @Nested
+    inner class WithFileConsentOnly {
+
+        lateinit var consentService: MtbFileConsentService
+        lateinit var consentEvaluator: ConsentEvaluator
+
+        @BeforeEach
+        fun setUp() {
+            this.consentService = MtbFileConsentService()
+            this.consentEvaluator = ConsentEvaluator(consentService)
+        }
+
+        @ParameterizedTest
+        @ArgumentsSource(MtbFileProvider::class)
+        fun test(mtbFile: Mtb, expectedConsentEvaluation: ConsentEvaluation) {
+            assertThat(consentEvaluator.check(mtbFile)).isEqualTo(expectedConsentEvaluation)
+        }
+    }
+
+    // Util classes
+
+    class WithGicsMtbFileProvider : ArgProvider(
+        // Has file ModelProjectConsent and broad consent => consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.PERMIT),
+            TtpConsentStatus.BROAD_CONSENT_GIVEN,
+            ConsentEvaluation(TtpConsentStatus.BROAD_CONSENT_GIVEN, true)
+        ),
+        // Has file ModelProjectConsent and broad consent missing => no consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.PERMIT),
+            TtpConsentStatus.BROAD_CONSENT_MISSING,
+            ConsentEvaluation(TtpConsentStatus.BROAD_CONSENT_MISSING, false)
+        ),
+        // Has file ModelProjectConsent and broad consent missing or rejected => no consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.PERMIT),
+            TtpConsentStatus.BROAD_CONSENT_MISSING_OR_REJECTED,
+            ConsentEvaluation(TtpConsentStatus.BROAD_CONSENT_MISSING_OR_REJECTED, false)
+        ),
+        // Has file ModelProjectConsent and MV consent => consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.PERMIT),
+            TtpConsentStatus.GENOM_DE_CONSENT_SEQUENCING_PERMIT,
+            ConsentEvaluation(TtpConsentStatus.GENOM_DE_CONSENT_SEQUENCING_PERMIT, true)
+        ),
+        // Has file ModelProjectConsent and MV consent rejected => no consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.PERMIT),
+            TtpConsentStatus.GENOM_DE_SEQUENCING_REJECTED,
+            ConsentEvaluation(TtpConsentStatus.GENOM_DE_SEQUENCING_REJECTED, false)
+        ),
+        // Has file ModelProjectConsent and MV consent missing => no consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.PERMIT),
+            TtpConsentStatus.GENOM_DE_CONSENT_MISSING,
+            ConsentEvaluation(TtpConsentStatus.GENOM_DE_CONSENT_MISSING, false)
+        ),
+        // Has file ModelProjectConsent and no broad consent result => consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.PERMIT),
+            TtpConsentStatus.UNKNOWN_CHECK_FILE,
+            ConsentEvaluation(TtpConsentStatus.UNKNOWN_CHECK_FILE, true)
+        ),
+        // Has file ModelProjectConsent and failed to ask => no consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.PERMIT),
+            TtpConsentStatus.FAILED_TO_ASK,
+            ConsentEvaluation(TtpConsentStatus.FAILED_TO_ASK, false)
+        ),
+        // File ModelProjectConsent rejected and broad consent => consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.DENY),
+            TtpConsentStatus.BROAD_CONSENT_GIVEN,
+            ConsentEvaluation(TtpConsentStatus.BROAD_CONSENT_GIVEN, true)
+        ),
+        // File ModelProjectConsent rejected and broad consent missing => no consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.DENY),
+            TtpConsentStatus.BROAD_CONSENT_MISSING,
+            ConsentEvaluation(TtpConsentStatus.BROAD_CONSENT_MISSING, false)
+        ),
+        // File ModelProjectConsent rejected and broad consent missing or rejected => no consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.DENY),
+            TtpConsentStatus.BROAD_CONSENT_MISSING_OR_REJECTED,
+            ConsentEvaluation(TtpConsentStatus.BROAD_CONSENT_MISSING_OR_REJECTED, false)
+        ),
+        // File ModelProjectConsent rejected and MV consent => consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.DENY),
+            TtpConsentStatus.GENOM_DE_CONSENT_SEQUENCING_PERMIT,
+            ConsentEvaluation(TtpConsentStatus.GENOM_DE_CONSENT_SEQUENCING_PERMIT, true)
+        ),
+        // File ModelProjectConsent rejected and MV consent rejected => no consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.DENY),
+            TtpConsentStatus.GENOM_DE_SEQUENCING_REJECTED,
+            ConsentEvaluation(TtpConsentStatus.GENOM_DE_SEQUENCING_REJECTED, false)
+        ),
+        // File ModelProjectConsent rejected and MV consent missing => no consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.DENY),
+            TtpConsentStatus.GENOM_DE_CONSENT_MISSING,
+            ConsentEvaluation(TtpConsentStatus.GENOM_DE_CONSENT_MISSING, false)
+        ),
+        // File ModelProjectConsent rejected and no broad consent result => no consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.DENY),
+            TtpConsentStatus.UNKNOWN_CHECK_FILE,
+            ConsentEvaluation(TtpConsentStatus.UNKNOWN_CHECK_FILE, false)
+        ),
+        // File ModelProjectConsent rejected and failed to ask => no consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.DENY),
+            TtpConsentStatus.FAILED_TO_ASK,
+            ConsentEvaluation(TtpConsentStatus.FAILED_TO_ASK, false)
+        )
+    ) {
+
+        companion object {
+            fun buildMtb(consentProvision: ConsentProvision): Mtb {
+                return Mtb.builder()
+                    .patient(
+                        Patient.builder().id("TEST_12345678")
+                            .birthDate(Date.from(Instant.parse("2000-08-08T12:34:56Z"))).gender(
+                                GenderCoding.builder().code(GenderCodingCode.MALE).build()
+                            ).build()
+                    )
+                    .metadata(
+                        MvhMetadata.builder().modelProjectConsent(
+                            ModelProjectConsent.builder().provisions(
+                                listOf(
+                                    Provision.builder().date(Date()).type(consentProvision)
+                                        .purpose(ModelProjectConsentPurpose.SEQUENCING).build()
+                                )
+                            ).build()
+                        ).build()
+                    )
+                    .episodesOfCare(
+                        listOf(
+                            MtbEpisodeOfCare.builder().id("1")
+                                .patient(Reference.builder().id("TEST_12345678").build())
+                                .build()
+                        )
+                    )
+                    .build()
+            }
+        }
+    }
+
+    class MtbFileProvider : ArgProvider(
+        // Has file consent => consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.PERMIT),
+            ConsentEvaluation(TtpConsentStatus.UNKNOWN_CHECK_FILE, true)
+        ),
+        // File consent rejected => no consent given
+        Arguments.of(
+            buildMtb(ConsentProvision.DENY),
+            ConsentEvaluation(TtpConsentStatus.UNKNOWN_CHECK_FILE, false)
+        ),
+        // policy REIDENTIFICATION has no effect on ConsentEvaluation
+        Arguments.of(
+            buildMtb(ModelProjectConsentPurpose.REIDENTIFICATION, ConsentProvision.DENY),
+            ConsentEvaluation(TtpConsentStatus.UNKNOWN_CHECK_FILE, false)
+        ), Arguments.of(
+            buildMtb(ModelProjectConsentPurpose.REIDENTIFICATION, ConsentProvision.PERMIT),
+            ConsentEvaluation(TtpConsentStatus.UNKNOWN_CHECK_FILE, false)
+        ),
+        // policy CASE_IDENTIFICATION has no effect on ConsentEvaluation
+        Arguments.of(
+            buildMtb(ModelProjectConsentPurpose.CASE_IDENTIFICATION, ConsentProvision.DENY),
+            ConsentEvaluation(TtpConsentStatus.UNKNOWN_CHECK_FILE, false)
+        ), Arguments.of(
+            buildMtb(ModelProjectConsentPurpose.CASE_IDENTIFICATION, ConsentProvision.PERMIT),
+            ConsentEvaluation(TtpConsentStatus.UNKNOWN_CHECK_FILE, false)
+        )
+    ) {
+
+        companion object {
+            fun buildMtb(consentProvision: ConsentProvision): Mtb {
+                return buildMtb(ModelProjectConsentPurpose.SEQUENCING, consentProvision)
+            }
+
+            fun buildMtb(
+                policy: ModelProjectConsentPurpose,
+                consentProvision: ConsentProvision
+            ): Mtb {
+                return Mtb.builder()
+                    .patient(
+                        Patient.builder().id("TEST_12345678")
+                            .birthDate(Date.from(Instant.parse("2000-08-08T12:34:56Z"))).gender(
+                                GenderCoding.builder().code(GenderCodingCode.MALE).build()
+                            ).build()
+                    )
+                    .metadata(
+                        MvhMetadata.builder().modelProjectConsent(
+                            ModelProjectConsent.builder().provisions(
+                                listOf(
+                                    Provision.builder().date(Date()).type(consentProvision)
+                                        .purpose(policy).build()
+                                )
+                            ).build()
+                        ).build()
+                    )
+                    .episodesOfCare(
+                        listOf(
+                            MtbEpisodeOfCare.builder().id("1")
+                                .patient(Reference.builder().id("TEST_12345678").build())
+                                .build()
+                        )
+                    )
+                    .build()
+            }
+        }
+    }
+
+}
diff --git a/src/test/kotlin/dev/dnpm/etl/processor/helpers.kt b/src/test/kotlin/dev/dnpm/etl/processor/helpers.kt
index 8caa908..2dfb1e1 100644
--- a/src/test/kotlin/dev/dnpm/etl/processor/helpers.kt
+++ b/src/test/kotlin/dev/dnpm/etl/processor/helpers.kt
@@ -17,4 +17,15 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-package dev.dnpm.etl.processor
\ No newline at end of file
+package dev.dnpm.etl.processor
+
+import org.junit.jupiter.api.extension.ExtensionContext
+import org.junit.jupiter.params.provider.Arguments
+import org.junit.jupiter.params.provider.ArgumentsProvider
+import java.util.stream.Stream
+
+open class ArgProvider(vararg val data: Arguments) : ArgumentsProvider {
+    override fun provideArguments(
+        context: ExtensionContext?
+    ): Stream<out Arguments> = Stream.of(*data)
+}
diff --git a/src/test/kotlin/dev/dnpm/etl/processor/input/KafkaInputListenerTest.kt b/src/test/kotlin/dev/dnpm/etl/processor/input/KafkaInputListenerTest.kt
index 1239cdf..a047f74 100644
--- a/src/test/kotlin/dev/dnpm/etl/processor/input/KafkaInputListenerTest.kt
+++ b/src/test/kotlin/dev/dnpm/etl/processor/input/KafkaInputListenerTest.kt
@@ -20,8 +20,10 @@
 package dev.dnpm.etl.processor.input
 
 import com.fasterxml.jackson.databind.ObjectMapper
-import dev.dnpm.etl.processor.consent.TtpConsentStatus
 import dev.dnpm.etl.processor.CustomMediaType
+import dev.dnpm.etl.processor.consent.ConsentEvaluation
+import dev.dnpm.etl.processor.consent.ConsentEvaluator
+import dev.dnpm.etl.processor.consent.TtpConsentStatus
 import dev.dnpm.etl.processor.services.RequestProcessor
 import dev.pcvolkmer.mv64e.mtb.*
 import org.apache.kafka.clients.consumer.ConsumerRecord
@@ -40,21 +42,32 @@ import java.util.*
 class KafkaInputListenerTest {
 
     private lateinit var requestProcessor: RequestProcessor
+    private lateinit var consentEvaluator: ConsentEvaluator
     private lateinit var objectMapper: ObjectMapper
+
     private lateinit var kafkaInputListener: KafkaInputListener
 
     @BeforeEach
     fun setup(
         @Mock requestProcessor: RequestProcessor,
+        @Mock consentEvaluator: ConsentEvaluator,
     ) {
         this.requestProcessor = requestProcessor
+        this.consentEvaluator = consentEvaluator
         this.objectMapper = ObjectMapper()
 
-        this.kafkaInputListener = KafkaInputListener(requestProcessor, objectMapper)
+        this.kafkaInputListener = KafkaInputListener(requestProcessor, consentEvaluator, objectMapper)
     }
 
     @Test
     fun shouldProcessMtbFileRequest() {
+        whenever(consentEvaluator.check(any())).thenReturn(
+            ConsentEvaluation(
+                TtpConsentStatus.BROAD_CONSENT_GIVEN,
+                true
+            )
+        )
+
         val mtbFile = Mtb.builder()
             .patient(Patient.builder().id("DUMMY_12345678").build())
             .metadata(
@@ -64,7 +77,10 @@ class KafkaInputListenerTest {
                         ModelProjectConsent
                             .builder()
                             .provisions(
-                                listOf(Provision.builder().type(ConsentProvision.PERMIT).purpose(ModelProjectConsentPurpose.SEQUENCING).build())
+                                listOf(
+                                    Provision.builder().type(ConsentProvision.PERMIT)
+                                        .purpose(ModelProjectConsentPurpose.SEQUENCING).build()
+                                )
                             ).build()
                     )
                     .build()
@@ -86,6 +102,13 @@ class KafkaInputListenerTest {
 
     @Test
     fun shouldProcessDeleteRequest() {
+        whenever(consentEvaluator.check(any())).thenReturn(
+            ConsentEvaluation(
+                TtpConsentStatus.BROAD_CONSENT_GIVEN,
+                false
+            )
+        )
+
         val mtbFile = Mtb.builder()
             .patient(Patient.builder().id("DUMMY_12345678").build())
             .metadata(
@@ -95,7 +118,10 @@ class KafkaInputListenerTest {
                         ModelProjectConsent
                             .builder()
                             .provisions(
-                                listOf(Provision.builder().type(ConsentProvision.DENY).purpose(ModelProjectConsentPurpose.SEQUENCING).build())
+                                listOf(
+                                    Provision.builder().type(ConsentProvision.DENY)
+                                        .purpose(ModelProjectConsentPurpose.SEQUENCING).build()
+                                )
                             ).build()
                     )
                     .build()
@@ -120,6 +146,13 @@ class KafkaInputListenerTest {
 
     @Test
     fun shouldProcessMtbFileRequestWithExistingRequestId() {
+        whenever(consentEvaluator.check(any())).thenReturn(
+            ConsentEvaluation(
+                TtpConsentStatus.BROAD_CONSENT_GIVEN,
+                true
+            )
+        )
+
         val mtbFile = Mtb.builder()
             .patient(Patient.builder().id("DUMMY_12345678").build())
             .metadata(
@@ -129,7 +162,10 @@ class KafkaInputListenerTest {
                         ModelProjectConsent
                             .builder()
                             .provisions(
-                                listOf(Provision.builder().type(ConsentProvision.PERMIT).purpose(ModelProjectConsentPurpose.SEQUENCING).build())
+                                listOf(
+                                    Provision.builder().type(ConsentProvision.PERMIT)
+                                        .purpose(ModelProjectConsentPurpose.SEQUENCING).build()
+                                )
                             ).build()
                     )
                     .build()
@@ -158,6 +194,13 @@ class KafkaInputListenerTest {
 
     @Test
     fun shouldProcessDeleteRequestWithExistingRequestId() {
+        whenever(consentEvaluator.check(any())).thenReturn(
+            ConsentEvaluation(
+                TtpConsentStatus.BROAD_CONSENT_GIVEN,
+                false
+            )
+        )
+
         val mtbFile = Mtb.builder()
             .patient(Patient.builder().id("DUMMY_12345678").build())
             .metadata(
@@ -167,7 +210,10 @@ class KafkaInputListenerTest {
                         ModelProjectConsent
                             .builder()
                             .provisions(
-                                listOf(Provision.builder().type(ConsentProvision.DENY).purpose(ModelProjectConsentPurpose.SEQUENCING).build())
+                                listOf(
+                                    Provision.builder().type(ConsentProvision.DENY)
+                                        .purpose(ModelProjectConsentPurpose.SEQUENCING).build()
+                                )
                             ).build()
                     )
                     .build()
@@ -208,7 +254,10 @@ class KafkaInputListenerTest {
                         ModelProjectConsent
                             .builder()
                             .provisions(
-                                listOf(Provision.builder().type(ConsentProvision.DENY).purpose(ModelProjectConsentPurpose.SEQUENCING).build())
+                                listOf(
+                                    Provision.builder().type(ConsentProvision.DENY)
+                                        .purpose(ModelProjectConsentPurpose.SEQUENCING).build()
+                                )
                             ).build()
                     )
                     .build()
diff --git a/src/test/kotlin/dev/dnpm/etl/processor/input/MtbFileRestControllerTest.kt b/src/test/kotlin/dev/dnpm/etl/processor/input/MtbFileRestControllerTest.kt
index 845f325..ae9e4e2 100644
--- a/src/test/kotlin/dev/dnpm/etl/processor/input/MtbFileRestControllerTest.kt
+++ b/src/test/kotlin/dev/dnpm/etl/processor/input/MtbFileRestControllerTest.kt
@@ -20,23 +20,34 @@
 package dev.dnpm.etl.processor.input
 
 import com.fasterxml.jackson.databind.ObjectMapper
+import dev.dnpm.etl.processor.ArgProvider
 import dev.dnpm.etl.processor.CustomMediaType
-import dev.dnpm.etl.processor.consent.GicsConsentService
+import dev.dnpm.etl.processor.consent.ConsentEvaluation
+import dev.dnpm.etl.processor.consent.ConsentEvaluator
+import dev.dnpm.etl.processor.consent.TtpConsentStatus
 import dev.dnpm.etl.processor.services.RequestProcessor
-import dev.pcvolkmer.mv64e.mtb.Mtb
+import dev.pcvolkmer.mv64e.mtb.*
 import org.junit.jupiter.api.BeforeEach
 import org.junit.jupiter.api.Nested
 import org.junit.jupiter.api.Test
 import org.junit.jupiter.api.extension.ExtendWith
+import org.junit.jupiter.params.ParameterizedTest
+import org.junit.jupiter.params.provider.Arguments
+import org.junit.jupiter.params.provider.ArgumentsSource
 import org.mockito.Mock
 import org.mockito.Mockito.times
 import org.mockito.Mockito.verify
 import org.mockito.junit.jupiter.MockitoExtension
 import org.mockito.kotlin.any
+import org.mockito.kotlin.anyValueClass
+import org.mockito.kotlin.whenever
 import org.springframework.core.io.ClassPathResource
 import org.springframework.test.web.servlet.MockMvc
+import org.springframework.test.web.servlet.delete
 import org.springframework.test.web.servlet.post
 import org.springframework.test.web.servlet.setup.MockMvcBuilders
+import java.time.Instant
+import java.util.*
 
 @ExtendWith(MockitoExtension::class)
 class MtbFileRestControllerTest {
@@ -49,22 +60,31 @@ class MtbFileRestControllerTest {
         private lateinit var mockMvc: MockMvc
 
         private lateinit var requestProcessor: RequestProcessor
+        private lateinit var consentEvaluator: ConsentEvaluator
 
         @BeforeEach
         fun setup(
             @Mock requestProcessor: RequestProcessor,
-            @Mock gicsConsentService: GicsConsentService
+            @Mock consentEvaluator: ConsentEvaluator
         ) {
             this.requestProcessor = requestProcessor
+            this.consentEvaluator = consentEvaluator
             val controller = MtbFileRestController(
                 requestProcessor,
-                gicsConsentService
+                consentEvaluator
             )
             this.mockMvc = MockMvcBuilders.standaloneSetup(controller).build()
         }
 
         @Test
         fun shouldRespondPostRequest() {
+            whenever(consentEvaluator.check(any())).thenReturn(
+                ConsentEvaluation(
+                    TtpConsentStatus.BROAD_CONSENT_GIVEN,
+                    true
+                )
+            )
+
             val mtbFileContent =
                 ClassPathResource("mv64e-mtb-fake-patient.json").inputStream.readAllBytes().toString(Charsets.UTF_8)
 
@@ -80,5 +100,127 @@ class MtbFileRestControllerTest {
             verify(requestProcessor, times(1)).processMtbFile(any<Mtb>())
         }
 
+        @ParameterizedTest
+        @ArgumentsSource(Dnpm21MtbFile::class)
+        fun shouldProcessPostRequest(mtb: Mtb, broadConsent: TtpConsentStatus, shouldProcess: String) {
+            whenever(consentEvaluator.check(any<Mtb>())).thenReturn(
+                ConsentEvaluation(
+                    broadConsent,
+                    shouldProcess == "process"
+                )
+            )
+
+            mockMvc.post("/mtbfile") {
+                content = objectMapper.writeValueAsString(mtb)
+                contentType = CustomMediaType.APPLICATION_VND_DNPM_V2_MTB_JSON
+            }.andExpect {
+                status {
+                    isAccepted()
+                }
+            }
+
+            if (shouldProcess == "process") {
+                verify(requestProcessor, times(1)).processMtbFile(any<Mtb>())
+            } else {
+                verify(requestProcessor, times(1)).processDeletion(
+                    anyValueClass(),
+                    org.mockito.kotlin.eq(broadConsent)
+                )
+            }
+        }
+
+        @Test
+        fun shouldProcessDeleteRequest() {
+            mockMvc.delete("/mtbfile/TEST_12345678").andExpect {
+                status {
+                    isAccepted()
+                }
+            }
+
+            verify(requestProcessor, times(1)).processDeletion(
+                anyValueClass(),
+                org.mockito.kotlin.eq(TtpConsentStatus.UNKNOWN_CHECK_FILE)
+            )
+            verify(consentEvaluator, times(0)).check(any<Mtb>())
+        }
+    }
+}
+
+class Dnpm21MtbFile : ArgProvider(
+    // No Metadata and no broad consent => delete
+    Arguments.of(
+        buildMtb(null),
+        TtpConsentStatus.BROAD_CONSENT_MISSING_OR_REJECTED,
+        "delete"
+    ),
+    // No Metadata and broad consent given => process
+    Arguments.of(
+        buildMtb(null),
+        TtpConsentStatus.BROAD_CONSENT_GIVEN,
+        "process"
+    ),
+    // No model project consent and no broad consent => delete
+    Arguments.of(
+        buildMtb(MvhMetadata.builder().modelProjectConsent(ModelProjectConsent.builder().build()).build()),
+        TtpConsentStatus.BROAD_CONSENT_MISSING_OR_REJECTED,
+        "delete"
+    ),
+    // No model project consent and broad consent given => process
+    Arguments.of(
+        buildMtb(MvhMetadata.builder().modelProjectConsent(ModelProjectConsent.builder().build()).build()),
+        TtpConsentStatus.BROAD_CONSENT_GIVEN,
+        "process"
+    ),
+    // Model project consent given and no broad consent => process
+    Arguments.of(
+        buildMtb(
+            MvhMetadata.builder().modelProjectConsent(
+                ModelProjectConsent.builder().provisions(
+                    listOf(
+                        Provision.builder().date(Date()).type(ConsentProvision.PERMIT)
+                            .purpose(ModelProjectConsentPurpose.SEQUENCING).build()
+                    )
+                ).build()
+            ).build()
+        ),
+        TtpConsentStatus.UNKNOWN_CHECK_FILE,
+        "process"
+    ),
+    // Model project consent given and broad consent given => process
+    Arguments.of(
+        buildMtb(
+            MvhMetadata.builder().modelProjectConsent(
+                ModelProjectConsent.builder().provisions(
+                    listOf(
+                        Provision.builder().date(Date()).type(ConsentProvision.PERMIT)
+                            .purpose(ModelProjectConsentPurpose.SEQUENCING).build()
+                    )
+                ).build()
+            ).build()
+        ),
+        TtpConsentStatus.BROAD_CONSENT_GIVEN,
+        "process"
+    )
+) {
+
+    companion object {
+        fun buildMtb(metadata: MvhMetadata?): Mtb {
+            return Mtb.builder()
+                .patient(
+                    Patient.builder().id("TEST_12345678")
+                        .birthDate(Date.from(Instant.parse("2000-08-08T12:34:56Z"))).gender(
+                            GenderCoding.builder().code(GenderCodingCode.MALE).build()
+                        ).build()
+                )
+                .metadata(metadata)
+                .episodesOfCare(
+                    listOf(
+                        MtbEpisodeOfCare.builder().id("1")
+                            .patient(Reference.builder().id("TEST_12345678").build())
+                            .build()
+                    )
+                )
+                .build()
+        }
     }
 }
diff --git a/src/test/kotlin/dev/dnpm/etl/processor/pseudonym/ExtensionsTest.kt b/src/test/kotlin/dev/dnpm/etl/processor/pseudonym/ExtensionsTest.kt
index 58405cd..8460293 100644
--- a/src/test/kotlin/dev/dnpm/etl/processor/pseudonym/ExtensionsTest.kt
+++ b/src/test/kotlin/dev/dnpm/etl/processor/pseudonym/ExtensionsTest.kt
@@ -24,7 +24,7 @@ import com.fasterxml.jackson.databind.ObjectMapper
 import dev.dnpm.etl.processor.config.AppConfigProperties
 import dev.dnpm.etl.processor.config.GIcsConfigProperties
 import dev.dnpm.etl.processor.config.JacksonConfig
-import dev.dnpm.etl.processor.consent.ConsentByMtbFile
+import dev.dnpm.etl.processor.consent.MtbFileConsentService
 import dev.dnpm.etl.processor.services.ConsentProcessor
 import dev.dnpm.etl.processor.services.ConsentProcessorTest
 import dev.pcvolkmer.mv64e.mtb.*
@@ -95,7 +95,7 @@ class ExtensionsTest {
                 gIcsConfigProperties,
                 JacksonConfig().objectMapper(),
                 FhirContext.forR4(),
-                ConsentByMtbFile()
+                MtbFileConsentService()
             ).embedBroadConsentResources(mtbFile, bundle)
 
         }
diff --git a/src/test/kotlin/dev/dnpm/etl/processor/services/ConsentProcessorTest.kt b/src/test/kotlin/dev/dnpm/etl/processor/services/ConsentProcessorTest.kt
index af93f7b..5a3fad0 100644
--- a/src/test/kotlin/dev/dnpm/etl/processor/services/ConsentProcessorTest.kt
+++ b/src/test/kotlin/dev/dnpm/etl/processor/services/ConsentProcessorTest.kt
@@ -7,7 +7,8 @@ import dev.dnpm.etl.processor.config.GIcsConfigProperties
 import dev.dnpm.etl.processor.config.JacksonConfig
 import dev.dnpm.etl.processor.consent.ConsentDomain
 import dev.dnpm.etl.processor.consent.GicsConsentService
-import dev.pcvolkmer.mv64e.mtb.*
+import dev.pcvolkmer.mv64e.mtb.Mtb
+import dev.pcvolkmer.mv64e.mtb.Patient
 import org.assertj.core.api.Assertions.assertThat
 import org.hl7.fhir.r4.model.Bundle
 import org.hl7.fhir.r4.model.CodeableConcept
@@ -46,7 +47,7 @@ class ConsentProcessorTest {
         @Mock gicsConsentService: GicsConsentService,
     ) {
 
-        this.gIcsConfigProperties = GIcsConfigProperties(null, null, null)
+        this.gIcsConfigProperties = GIcsConfigProperties("https://gics.example.com")
         val jacksonConfig = JacksonConfig()
         this.objectMapper = jacksonConfig.objectMapper()
         this.fhirContext = JacksonConfig.fhirContext()
@@ -67,10 +68,10 @@ class ConsentProcessorTest {
         assertThat(consentProcessor.toString()).isNotNull
         // prep gICS response
         doAnswer { getDummyBroadConsentBundle() }.whenever(gicsConsentService)
-            .getConsent(any(), any(), eq(ConsentDomain.BroadConsent))
+            .getConsent(any(), any(), eq(ConsentDomain.BROAD_CONSENT))
 
         doAnswer { Bundle() }.whenever(gicsConsentService)
-            .getConsent(any(), any(), eq(ConsentDomain.Modelvorhaben64e))
+            .getConsent(any(), any(), eq(ConsentDomain.MODELLVORHABEN_64E))
 
         val inputMtb = Mtb.builder()
             .patient(Patient.builder().id("d611d429-5003-11f0-a144-661e92ac9503").build()).build()