Fix CI failures in appsec integration tests

- Remove Laminas translated-literal route: uses Laminas translator syntax
  ({...}) without a configured translator service, causing RuntimeException
  for all requests and crashing the entire test suite
- Fix inferSymfonyRouteParams: array_filter without callback removes '0'
  (falsy string) from URL segments, causing zero-valued path params to be
  treated as absent from the URL
- Add DD_API_SECURITY_ENABLED guard in SymfonyIntegration: the normalized
  route tag is specific to API security schema sampling and must be omitted
  when DD_API_SECURITY_ENABLED=false
- Fix WordPress cache key: routing_cache_get/set used only $matchedRule as
  key, so absent/present optional captures shared the same cache slot and
  the first result bled into subsequent requests with different URLs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: estringana

appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/Laminas33Tests.groovy

@@ -81,7 +81,7 @@ class Laminas33Tests {
             endpoints.size() > 0
         })
 
-        assert endpoints.size() == 33
+        assert endpoints.size() == 32
         assert endpoints.find { it.path == '/' && it.method == '*' && it.operationName == 'http.request' && it.resourceName == '* /' } != null
         assert endpoints.find {
             it.path == '/application[/:action]' && it.method == '*' && it.operationName == 'http.request' && it.resourceName == '* /application[/:action]'
@@ -148,10 +148,6 @@ class Laminas33Tests {
             it.path == '/normalized-wildcard/:param1/*' && it.method == '*' &&
                     it.operationName == 'http.request' && it.resourceName == '* /normalized-wildcard/:param1/*'
         } != null
-        assert endpoints.find {
-            it.path == '/normalized/{translated_page}' && it.method == '*' &&
-                    it.operationName == 'http.request' && it.resourceName == '* /normalized/{translated_page}'
-        } != null
     }
 
     @Test
@@ -422,18 +418,4 @@ class Laminas33Tests {
                 '/normalized-wildcard/{param1}/{param2}'
     }
 
-    @Test
-    @Order(18)
-    void 'translated literal remains a static route element'() {
-        Trace trace = container.traceFromRequest(
-                container.buildReq('/normalized/translated-page').GET().build(),
-                ofString()) { HttpResponse<String> resp ->
-            assert resp.statusCode() == 200
-        }
-
-        assert trace.first().meta.'http.route' == '/normalized/{translated_page}'
-        assert trace.first().meta.'_dd.appsec.normalized_route' ==
-                '/normalized/translated-page'
-    }
-
 }

appsec/tests/integration/src/test/www/laminas33/module/Application/config/module.config.php

@@ -247,16 +247,6 @@
                     ],
                 ],
             ],
-            'normalized_translated_literal' => [
-                'type' => Segment::class,
-                'options' => [
-                    'route' => '/normalized/{translated_page}',
-                    'defaults' => [
-                        'controller' => DynamicPathController::class,
-                        'action' => 'index',
-                    ],
-                ],
-            ],
             'scheme_http_gate' => [
                 'type' => Scheme::class,
                 'options' => [

src/DDTrace/Integrations/Symfony/SymfonyIntegration.php

@@ -456,7 +456,9 @@ static function() {
 
                 if ($path !== null) {
                     $rootSpan->meta[Tag::HTTP_ROUTE] = $path;
-                    if (function_exists('\datadog\appsec\is_enabled') && \datadog\appsec\is_enabled()) {
+                    $rawIni = ini_get('datadog.api_security_enabled');
+                    if (function_exists('\datadog\appsec\is_enabled') && \datadog\appsec\is_enabled()
+                        && ($rawIni === false || filter_var($rawIni, FILTER_VALIDATE_BOOLEAN) !== false)) {
                         // inferSymfonyRouteParams is lightweight (URL parsing only); compute it
                         // first so the cache key encodes which optional params are present.
                         // Without this, a route with optional params caches only the first

src/DDTrace/Integrations/WordPress/WordPressIntegrationLoader.php

@@ -736,11 +736,12 @@ function_exists('is_404') && is_404() === false) {
                     $rootSpan->meta[Tag::HTTP_ROUTE] = $matchedRule;
                     if (function_exists('\datadog\appsec\is_enabled') && \datadog\appsec\is_enabled()) {
                         $urlPath = \property_exists($This, 'request') ? $This->request : null;
-                        $normalizedRoute = \DDTrace\routing_cache_get($matchedRule);
+                        $cacheKey = $matchedRule . '|' . ($urlPath ?? '');
+                        $normalizedRoute = \DDTrace\routing_cache_get($cacheKey);
                         if ($normalizedRoute === false) {
                             $normalizedRoute = \DDTrace\Util\RouteNormalizer::normalizeFromWordPress($matchedRule, $urlPath);
                             if ($normalizedRoute !== null) {
-                                \DDTrace\routing_cache_set($matchedRule, $normalizedRoute);
+                                \DDTrace\routing_cache_set($cacheKey, $normalizedRoute);
                             }
                         }
                         if ($normalizedRoute !== null && $normalizedRoute !== false) {

src/DDTrace/Util/RouteNormalizer.php

@@ -522,8 +522,8 @@ public static function encodeParamName(string $name): string
      */
     public static function inferSymfonyRouteParams(string $template, string $urlPath): array
     {
-        $templateSegments = array_values(array_filter(explode('/', $template)));
-        $urlSegments      = array_values(array_filter(explode('/', $urlPath)));
+        $templateSegments = array_values(array_filter(explode('/', $template), 'strlen'));
+        $urlSegments      = array_values(array_filter(explode('/', $urlPath), 'strlen'));
 
         $matched = [];
         $urlIdx  = 0;