Strip all trailing slashes in normalizeUrlPath (review)

Gemini review: '/api//' normalized to '/api/', which then failed both
the exact and boundary match for '/api/...' requests; '///' likewise
survived as '//'. Strip the full trailing-slash run instead of one.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people

server/middlewareChain.ts

@@ -125,7 +125,7 @@ export function resolveDeps(entries: HttpEntry[], nameToEntry: Map<string, HttpE
 }
 
 /**
- * Normalizes a urlPath by ensuring a leading slash and stripping a single trailing slash.
+ * Normalizes a urlPath by ensuring a leading slash and stripping trailing slashes.
  * '/api', 'api', and '/api/' are treated equivalently for routing/matching — pathnames
  * always begin with '/', so a slash-less urlPath could otherwise never match anything (#1583).
  * A urlPath that constrains nothing — the root mount ('/'), empty, or undefined — normalizes
@@ -135,7 +135,7 @@ export function resolveDeps(entries: HttpEntry[], nameToEntry: Map<string, HttpE
 export function normalizeUrlPath(urlPath: string | undefined): string | undefined {
 	if (!urlPath) return undefined;
 	if (!urlPath.startsWith('/')) urlPath = '/' + urlPath;
-	if (urlPath.endsWith('/')) urlPath = urlPath.slice(0, -1);
+	urlPath = urlPath.replace(/\/+$/, '');
 	return urlPath.length <= 1 ? undefined : urlPath;
 }
 

unitTests/server/middlewareChain.test.js

@@ -683,10 +683,12 @@ describe('normalizeUrlPath', () => {
 	it('normalizes the root mount to undefined — no path constraint (#1766)', () => {
 		assert.strictEqual(normalizeUrlPath('/'), undefined);
 		assert.strictEqual(normalizeUrlPath('//'), undefined);
+		assert.strictEqual(normalizeUrlPath('///'), undefined);
 	});
 
-	it('strips a single trailing slash', () => {
+	it('strips trailing slashes', () => {
 		assert.strictEqual(normalizeUrlPath('/api/'), '/api');
+		assert.strictEqual(normalizeUrlPath('/api//'), '/api');
 	});
 
 	it('leaves paths without trailing slash unchanged', () => {