Guard deletes, and stop malformed paths reaching the API.

Deleting content was not guarded. unpublishUrl() dispatches
QuantEvent::UNPUBLISH, a different event from the one the guard watched, so
a delete on an unrecognised host withdrew the matching URL from whichever
project the fallback landed on. That is the worst of the three: publishing
to the wrong project adds a page, but unpublishing takes a live one down.

Worse, the domain was only ever negotiated by Quant's own drush commands.
Deleting a node through drush php:eval, a migration, or any other command
resolved the base project even with --uri set. Verified: a delete as
clienta withdrew /node/8 and /fr/node/8 from the base project rather than
the domain's.

Negotiation now happens in the guard subscriber, which every publish,
redirect and unpublish passes through, so it no longer depends on which
entry point started the work. The call is cached per process.

Separately, nothing should ever be published at //fr/node/1. The
handleInternalPathRedirects fix removed the cause found so far, but paths
are assembled from prefixes, base paths and aliases all over the module,
and any of them can be empty. Utility::normalizePath() collapses repeated
slashes and is applied where routes enter the queue and again at the API
boundary for content, redirects and unpublishes. Normalising before the
self-redirect check also means a malformed source is recognised as equal
to its destination instead of being published as a redirect to itself.
quant_cron had one more producer, filtering out the empty default prefix.

The query string is left alone: an oEmbed route carries a whole URL in
one, and those slashes are not ours to collapse.

Regression matrix now covers deletion in both shapes and multilingual:
25 cases, all passing. 76 unit and kernel tests.

Author: stooit

modules/quant_api/src/EventSubscriber/QuantApi.php

@@ -79,8 +79,11 @@ public static function getSubscribedEvents(): array {
    *   The redirect event.
    */
   public function onRedirect(QuantRedirectEvent $event) {
-    $source = $event->getSourceUrl();
-    $dest = $event->getDestinationUrl();
+    // Normalise before the self-redirect check, so that a malformed source
+    // like //fr/node/1 is recognised as the same path as its destination
+    // rather than published as a redirect to itself.
+    $source = Utility::normalizePath($event->getSourceUrl());
+    $dest = Utility::normalizePath($event->getDestinationUrl());
     $statusCode = $event->getStatusCode();
 
     if ($source == $dest) {
@@ -114,7 +117,10 @@ public function onRedirect(QuantRedirectEvent $event) {
   public function onOutput(QuantEvent $event) {
 
     $config = \Drupal::config('quant.settings');
-    $path = $event->getLocation();
+    // Last line of defence: a path assembled from an empty prefix or base
+    // must not reach the API as //fr/node/1, which would publish a duplicate
+    // resource alongside the real one.
+    $path = Utility::normalizePath($event->getLocation());
     $content = $event->getContents();
     $meta = $event->getMetadata();
 

modules/quant_cron/quant_cron.module

@@ -284,9 +284,11 @@ function quant_cron_get_views_routes() {
 
         $paths[] = $path;
 
-        // Language negotiation may also provide path prefixes.
+        // Language negotiation may also provide path prefixes. The default
+        // language usually has an empty one, which would otherwise produce
+        // //path.
         if ($prefixes = \Drupal::config('language.negotiation')->get('url.prefixes')) {
-          foreach ($prefixes as $prefix) {
+          foreach (array_filter($prefixes) as $prefix) {
             $paths[] = "/{$prefix}/{$path}";
           }
         }

src/EventSubscriber/DomainGuardSubscriber.php

@@ -2,6 +2,7 @@
 
 namespace Drupal\quant\EventSubscriber;
 
+use Drupal\quant\CliDomainContext;
 use Drupal\quant\Event\QuantEvent;
 use Drupal\quant\Event\QuantRedirectEvent;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
@@ -62,6 +63,11 @@ public static function getSubscribedEvents(): array {
       // content would still let a misdirected run rewrite another client's
       // redirect map. The publisher listens at -999.
       QuantRedirectEvent::UPDATE => ['onOutput', 100],
+      // Unpublishing is the one that cannot be walked back. Deleting a node
+      // on an unrecognised host would withdraw the matching URL from
+      // whichever project the fallback landed on, taking down a live page
+      // belonging to another client.
+      QuantEvent::UNPUBLISH => ['onOutput', 100],
     ];
   }
 
@@ -72,6 +78,14 @@ public static function getSubscribedEvents(): array {
    *   The content or redirect event.
    */
   public function onOutput($event) {
+    // Every publish, redirect and unpublish passes through here, which makes
+    // it the one place guaranteed to run no matter what triggered the work.
+    // Quant's own drush commands negotiate the domain themselves, but a node
+    // deleted by drush php:eval, a migration, or any other command does not
+    // reach them, and would resolve the base project instead of the domain's.
+    // The call is cached per process, so this costs nothing after the first.
+    CliDomainContext::initialize();
+
     if (!$this->hostIsUnknown($host)) {
       return;
     }

src/Plugin/QueueItem/RouteItem.php

@@ -4,6 +4,7 @@
 
 use Drupal\quant\Event\QuantEvent;
 use Drupal\quant\Seed;
+use Drupal\quant\Utility;
 
 /**
  * A Quant queue item for a redirect.
@@ -49,7 +50,7 @@ public function __construct(array $data = []) {
     if (substr($route, 0, 1) != '/') {
       $route = "/{$route}";
     }
-    $route = trim($route);
+    $route = Utility::normalizePath(trim($route));
 
     $this->route = $route;
     $this->uri = $data['uri'] ?? strtok($route, '?');

src/Utility.php

@@ -305,14 +305,43 @@ public static function getPageInfo(?array $urls = NULL) : string {
   }
 
   /**
-   * Unpublish the given URL and optionally log a message.
+   * Collapses repeated slashes in a path.
+   *
+   * Paths are assembled from language prefixes, base paths and aliases, and
+   * any of those can be empty, which leaves a stray slash behind. A path like
+   * //fr/node/1 is published as a distinct resource from /fr/node/1, so the
+   * project accumulates duplicates nobody asked for. Callers should build the
+   * path correctly; this is the backstop that keeps a malformed one off the
+   * wire.
+   *
+   * @param string $path
+   *   The path, which may carry a query string.
+   *
+   * @return string
+   *   The path with repeated slashes collapsed.
+   */
+  public static function normalizePath(string $path) : string {
+    // Only the path can pick up stray slashes. A query string may legitimately
+    // contain them, in an oEmbed url for instance, so it is left alone.
+    $parts = explode('?', $path, 2);
+    $parts[0] = preg_replace('#/{2,}#', '/', $parts[0]);
+
+    if ($parts[0] === '') {
+      $parts[0] = '/';
+    }
+
+    return implode('?', $parts);
+  }
+
+  /**
+   * Unpublishes a url from Quant.
    *
    * @param string $url
-   *   The URL to unpublish.
+   *   The url to unpublish.
    * @param string $message
-   *   The message to log.
+   *   Message to log.
    * @param bool $log
-   *   Whether or not to log the message.
+   *   Whether to log the action.
    */
   public static function unpublishUrl(string $url, string $message = '', bool $log = TRUE) : void {
     if (!trim($url)) {
@@ -321,6 +350,8 @@ public static function unpublishUrl(string $url, string $message = '', bool $log
       return;
     }
 
+    $url = self::normalizePath($url);
+
     \Drupal::service('event_dispatcher')->dispatch(new QuantEvent('', $url, [], NULL), QuantEvent::UNPUBLISH);
 
     if ($log) {

tests/src/Unit/UtilityNormalizePathTest.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace Drupal\Tests\quant\Unit;
+
+use Drupal\quant\Utility;
+use Drupal\Tests\UnitTestCase;
+
+/**
+ * Ensures malformed paths cannot reach the API.
+ *
+ * Paths are assembled from language prefixes, base paths and aliases, any of
+ * which can be empty. //fr/node/1 is a different resource from /fr/node/1, so
+ * a stray slash publishes a duplicate nobody asked for.
+ *
+ * @coversDefaultClass \Drupal\quant\Utility
+ *
+ * @group quant
+ */
+class UtilityNormalizePathTest extends UnitTestCase {
+
+  /**
+   * Paths and what they should collapse to.
+   *
+   * @return array
+   *   Test cases.
+   */
+  public static function pathProvider() : array {
+    return [
+      'already correct' => ['/fr/node/1', '/fr/node/1'],
+      'doubled prefix slash' => ['//fr/node/1', '/fr/node/1'],
+      'doubled root slash' => ['//node/1', '/node/1'],
+      'tripled' => ['///node/1', '/node/1'],
+      'interior double' => ['/fr//node/1', '/fr/node/1'],
+      'trailing double' => ['/fr/node//', '/fr/node/'],
+      'root stays root' => ['/', '/'],
+      'empty becomes root' => ['', '/'],
+      'query string kept' => ['//fr/search?page=2', '/fr/search?page=2'],
+      // An oEmbed route carries a whole URL in its query string, and the
+      // slashes in that URL are not ours to touch.
+      'slashes in query untouched' => [
+        '//media/oembed?url=https://example.com/a//b',
+        '/media/oembed?url=https://example.com/a//b',
+      ],
+    ];
+  }
+
+  /**
+   * Repeated slashes collapse, without disturbing the query string.
+   *
+   * @dataProvider pathProvider
+   * @covers ::normalizePath
+   */
+  public function testNormalizePath(string $input, string $expected) {
+    $this->assertEquals($expected, Utility::normalizePath($input));
+  }
+
+}