Guard every write at the client, not only the ones that emit events.

Reviewing the branch for anything the last round missed turned up the same
gap a fourth time, in a place events never reach. Search records, facets
and index clearing call QuantClient directly and dispatch nothing, so the
subscriber never saw them. Clearing is the destructive one: on an
unrecognised host it wipes another client's entire search index.

Guarding those three call sites would have repeated the mistake, so the
decision moved into Drupal\quant\PublishGuard and both the subscriber and
the client consult it. The subscriber still runs first, and still stops
early enough to skip the render and search work; the client is the
backstop that covers a write method nobody has written yet.

Applied to the seven methods that change something — send, sendRedirect,
sendFile, unpublish, sendSearchRecords, clearSearchIndex, addFacets — and
deliberately not to ping, project, search or getUrlMeta, which are reads
and are how the settings form reports whether the connection works.
Verified against two domains on an unrecognised host: the three search
writes refused with zero requests reaching the API, while ping still
answers.

A refused write returns an empty array, which QuantApi::onOutput could not
survive: it read $res['attachments']['js'] straight into array_merge(),
which fatals on NULL. The guard makes that reachable, but the API was
always entitled to answer without attachments, so the keys are no longer
assumed.

Static analysis on the changed files also flagged a test constructing
QuantPurger with plugin arguments it has no constructor for, and an @var
where a @PARAM belonged in the tome batch.

94 unit and kernel tests, 39 regression cases, phpcs clean.

Author: stooit

modules/quant_api/src/Client/QuantClient.php

@@ -4,6 +4,7 @@
 
 use Drupal\Core\Config\ConfigFactoryInterface;
 use Drupal\Core\Logger\LoggerChannelFactoryInterface;
+use Drupal\quant\PublishGuard;
 use Drupal\quant_api\Exception\InvalidPayload;
 use GuzzleHttp\Client;
 use GuzzleHttp\Exception\RequestException;
@@ -113,6 +114,30 @@ protected function refreshCredentials() : void {
     $this->tlsDisabled = $this->config->get('api_tls_disabled');
   }
 
+  /**
+   * Refuses a write the current context cannot be trusted to address.
+   *
+   * The event subscriber stops most work earlier, and more cheaply. This
+   * catches the writes that never dispatch an event — search records, facets
+   * and index clearing all call this client directly — so a method added
+   * later is covered without anyone remembering to guard it.
+   *
+   * @param string $operation
+   *   What is being attempted, for the log.
+   *
+   * @return bool
+   *   TRUE when the caller must not proceed.
+   */
+  protected function refusesWrite(string $operation) : bool {
+    if (!PublishGuard::refuses($host)) {
+      return FALSE;
+    }
+
+    PublishGuard::logRefusal($operation, $host);
+
+    return TRUE;
+  }
+
   /**
    * Returns the Quant project this client currently targets.
    *
@@ -276,6 +301,11 @@ public function search() {
    */
   public function send(array $data) : array {
     $this->refreshCredentials();
+
+    if ($this->refusesWrite('to publish ' . ($data['url'] ?? 'content'))) {
+      return [];
+    }
+
     // @todo Switch from 'Quant-Customer' to 'Quant-Organization'.
     $response = $this->client->post($this->endpoint, [
       RequestOptions::JSON => $data,
@@ -295,6 +325,11 @@ public function send(array $data) : array {
    */
   public function sendRedirect(array $data) : array {
     $this->refreshCredentials();
+
+    if ($this->refusesWrite('to publish a redirect for ' . ($data['url'] ?? 'a url'))) {
+      return [];
+    }
+
     // @todo Switch from 'Quant-Customer' to 'Quant-Organization'.
     $response = $this->client->post($this->endpoint . '/redirect', [
       RequestOptions::JSON => $data,
@@ -315,6 +350,10 @@ public function sendRedirect(array $data) : array {
   public function sendFile(string $file, string $url, ?int $rid = NULL) : array {
     $this->refreshCredentials();
 
+    if ($this->refusesWrite('to upload ' . $url)) {
+      return [];
+    }
+
     // Ensure the file is accessible before attempting to send to the API.
     if (!file_exists($file) || !is_readable($file) || !is_file($file)) {
       throw new InvalidPayload($file);
@@ -363,6 +402,11 @@ public function sendFile(string $file, string $url, ?int $rid = NULL) : array {
    */
   public function unpublish(string $url) : array {
     $this->refreshCredentials();
+
+    if ($this->refusesWrite('to unpublish ' . $url)) {
+      return [];
+    }
+
     // @todo Switch from 'Quant-Customer' to 'Quant-Organization'.
     $response = $this->client->patch($this->endpoint . '/unpublish', [
       'headers' => [
@@ -394,6 +438,7 @@ public function getUrlMeta(array $urls) : array {
         'Quant-Url' => $urls,
       ];
     }
+
     // @todo Switch from 'Quant-Customer' to 'Quant-Organization'.
     $response = $this->client->post($this->endpoint . '/url-meta', [
       RequestOptions::JSON => $urls,
@@ -413,6 +458,11 @@ public function getUrlMeta(array $urls) : array {
    */
   public function sendSearchRecords(array $records) : array {
     $this->refreshCredentials();
+
+    if ($this->refusesWrite('to write ' . count($records) . ' search records')) {
+      return [];
+    }
+
     // @todo Switch from 'Quant-Customer' to 'Quant-Organization'.
     $response = $this->client->post($this->endpoint . '/search', [
       RequestOptions::JSON => $records,
@@ -432,6 +482,11 @@ public function sendSearchRecords(array $records) : array {
    */
   public function clearSearchIndex() : array {
     $this->refreshCredentials();
+
+    if ($this->refusesWrite('to clear the search index')) {
+      return [];
+    }
+
     // @todo Switch from 'Quant-Customer' to 'Quant-Organization'.
     $response = $this->client->delete($this->endpoint . '/search/all', [
       'headers' => [
@@ -450,6 +505,11 @@ public function clearSearchIndex() : array {
    */
   public function addFacets(array $facets) : array {
     $this->refreshCredentials();
+
+    if ($this->refusesWrite('to write search facets')) {
+      return [];
+    }
+
     // @todo Switch from 'Quant-Customer' to 'Quant-Organization'.
     $response = $this->client->post($this->endpoint . '/search/facet', [
       RequestOptions::JSON => $facets,

modules/quant_api/src/EventSubscriber/QuantApi.php

@@ -157,7 +157,17 @@ public function onOutput(QuantEvent $event) {
       return FALSE;
     }
 
-    $media = array_merge($res['attachments']['js'], $res['attachments']['css'], $res['attachments']['media']['images'], $res['attachments']['media']['documents'], $res['attachments']['media']['video']);
+    // A refused write returns an empty array, and the API is entitled to
+    // answer without attachments, so none of these keys can be assumed.
+    // array_merge() fatals on a NULL argument.
+    $attachments = $res['attachments'] ?? [];
+    $media = array_merge(
+      $attachments['js'] ?? [],
+      $attachments['css'] ?? [],
+      $attachments['media']['images'] ?? [],
+      $attachments['media']['documents'] ?? [],
+      $attachments['media']['video'] ?? []
+    );
 
     $queue_factory = QuantQueueFactory::getInstance();
     $queue = $queue_factory->get('quant_seed_worker');

modules/quant_purger/tests/src/Kernel/QuantPurgerProjectTest.php

@@ -62,7 +62,7 @@ protected function setUp() : void {
    *   The resolved project.
    */
   protected function resolve(string $domainId) {
-    $plugin = new QuantPurger([], 'quant', []);
+    $plugin = new QuantPurger();
     $plugin->setContainer($this->container);
 
     $method = new \ReflectionMethod($plugin, 'getProjectForDomain');

modules/quant_tome/src/QuantTomeBatch.php

@@ -207,8 +207,10 @@ public function pathToUri($file_path) {
   /**
    * Deploy a file to Quant.
    *
-   * @var \Drupal\quant\Plugin\QueueItem $item
+   * @param \Drupal\quant\Plugin\QueueItem\QuantQueueItemInterface $item
    *   The file item to send to Quant API.
+   * @param array $context
+   *   The batch context.
    */
   public function deploy($item, array &$context) {
     // Batch operations may run in a forked process that never negotiated a

src/EventSubscriber/DomainGuardSubscriber.php

@@ -6,6 +6,7 @@
 use Drupal\quant\Event\QuantEvent;
 use Drupal\quant\Event\QuantFileEvent;
 use Drupal\quant\Event\QuantRedirectEvent;
+use Drupal\quant\PublishGuard;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\HttpFoundation\RequestStack;
 
@@ -95,15 +96,13 @@ public function onOutput($event) {
     // The call is cached per process, so this costs nothing after the first.
     CliDomainContext::initialize();
 
-    if (!$this->hostIsUnknown($host)) {
+    if (!PublishGuard::refuses($host, $this->requestStack)) {
       return;
     }
 
-    \Drupal::logger('quant')->error('Refused to publish @path: the host @host matches no domain, so the Domain module fell back to the default and this content would be published to project @project. Add a domain for @host, or correct the Host header reaching Drupal.', [
-      '@path' => self::describe($event),
-      '@host' => $host,
-      '@project' => \Drupal::config('quant_api.settings')->get('api_project') ?: 'unknown',
-    ]);
+    // Stopping here also skips the render and search work the later
+    // subscribers would do, which the client-level backstop cannot.
+    PublishGuard::logRefusal('to publish ' . self::describe($event), $host);
 
     $event->stopPropagation();
   }
@@ -129,41 +128,4 @@ protected static function describe($event) : string {
     return $event->getSourceUrl();
   }
 
-  /**
-   * Determines whether the serving host has no domain record.
-   *
-   * @param string|null $host
-   *   Set to the offending host when the check fails.
-   *
-   * @return bool
-   *   TRUE when the push must be stopped.
-   */
-  protected function hostIsUnknown(&$host = NULL) : bool {
-    $host = NULL;
-
-    $moduleHandler = \Drupal::moduleHandler();
-
-    if (!$moduleHandler->moduleExists('domain')) {
-      return FALSE;
-    }
-
-    $request = $this->requestStack->getCurrentRequest();
-
-    if (!$request) {
-      return FALSE;
-    }
-
-    $host = $request->getHttpHost();
-    $storage = \Drupal::entityTypeManager()->getStorage('domain');
-
-    // With a single domain there is only one project to publish to, so the
-    // fallback cannot send content anywhere unexpected. Only a genuine
-    // multi-domain site can lose a page to another site's project.
-    if (count($storage->loadMultiple()) < 2) {
-      return FALSE;
-    }
-
-    return empty($storage->loadByHostname($host));
-  }
-
 }

src/PublishGuard.php

@@ -0,0 +1,100 @@
+<?php
+
+namespace Drupal\quant;
+
+use Symfony\Component\HttpFoundation\RequestStack;
+
+/**
+ * Decides whether the current context may write to a Quant project.
+ *
+ * The Domain module falls back to the default domain when the request host
+ * matches no domain record. On a site publishing many clients from one Drupal
+ * instance, that sends whatever is being written to the default client's
+ * project instead: a page appears on the wrong site, or worse, one is
+ * withdrawn from it.
+ *
+ * The decision lives here rather than in the event subscriber because not
+ * everything that writes goes through an event. Search records, facets and
+ * index clearing call the API client directly, and guarding only the event
+ * path left those open. Both the subscriber and the client consult this, so a
+ * new write method is covered without anyone remembering to add a check.
+ *
+ * @see \Drupal\quant\EventSubscriber\DomainGuardSubscriber
+ * @see \Drupal\quant_api\Client\QuantClient
+ *
+ * @ingroup quant
+ */
+class PublishGuard {
+
+  /**
+   * Determines whether writing must be refused in the current context.
+   *
+   * @param string|null $host
+   *   Set to the offending host when the check fails.
+   * @param \Symfony\Component\HttpFoundation\RequestStack $requestStack
+   *   The request stack, where the caller has one injected. Falls back to the
+   *   container otherwise.
+   *
+   * @return bool
+   *   TRUE when nothing may be written.
+   */
+  public static function refuses(&$host = NULL, ?RequestStack $requestStack = NULL) : bool {
+    $host = NULL;
+
+    // No container means no domain module, and nothing to get wrong. This
+    // also keeps unit tests that never build one from fatalling here.
+    if (!\Drupal::hasContainer()) {
+      return FALSE;
+    }
+
+    if (!\Drupal::hasService('module_handler') || !\Drupal::moduleHandler()->moduleExists('domain')) {
+      return FALSE;
+    }
+
+    if (!$requestStack) {
+      if (!\Drupal::hasService('request_stack')) {
+        return FALSE;
+      }
+      $requestStack = \Drupal::service('request_stack');
+    }
+
+    if (!\Drupal::hasService('entity_type.manager')) {
+      return FALSE;
+    }
+
+    $request = $requestStack->getCurrentRequest();
+
+    if (!$request) {
+      return FALSE;
+    }
+
+    $host = $request->getHttpHost();
+    $storage = \Drupal::entityTypeManager()->getStorage('domain');
+
+    // With a single domain there is only one project to write to, so the
+    // fallback cannot reach anywhere unexpected. Only a genuine multi-domain
+    // site can lose a page to another site's project.
+    if (count($storage->loadMultiple()) < 2) {
+      return FALSE;
+    }
+
+    return empty($storage->loadByHostname($host));
+  }
+
+  /**
+   * Logs a refusal, naming the host and the project that would have received.
+   *
+   * @param string $what
+   *   The path, url or operation being refused.
+   * @param string|null $host
+   *   The host that matched no domain.
+   */
+  public static function logRefusal(string $what, ?string $host) : void {
+    \Drupal::logger('quant')->error('Refused @what: the host @host matches no domain, so the Domain module fell back to the default and this would have been written to project @project. Add a domain for @host, or correct the Host header reaching Drupal.', [
+      '@what' => $what,
+      '@host' => $host ?? 'unknown',
+      '@project' => \Drupal::config('quant_api.settings')->get('api_project') ?: 'unknown',
+    ]);
+  }
+
+}