fix: prevent subdomain-only route from overwriting hostname route

[jalexiscv]

Description

Fixes #7214 - Inconsistent hostname/subdomain limitation in Routing

Problem

When using hostname and subdomain route options, the precedence was inconsistent depending on whether they were on the same route or separate routes:

Case 1: Same route (hostname took precedence - correct)

$routes->get('/', 'Home::index');
$routes->get('/', 'Media::index', ['hostname' => 'media.example.com', 'subdomain' => '*']);

media.example.com → Media::index ✓

Case 2: Separate routes (subdomain incorrectly won)

$routes->get('/', 'Home::index');
$routes->get('/', 'Media::index', ['hostname' => 'media.example.com']);
$routes->get('/', 'All::index', ['subdomain' => '*']);

media.example.com → All::index ✗ (should be Media::index)

Root Cause

Two issues:

1. elseif meant routes with both hostname and subdomain only validated hostname
2. No protection against subdomain-only routes overwriting hostname routes

Solution

1. Change elseif to if — both hostname and subdomain are validated independently
2. Track matchedByHostname/matchedBySubdomain flags during registration
3. Add guard: routes matched only by subdomain cannot overwrite existing hostname routes

Changes

One file: system/Router/RouteCollection.php

• Independent hostname/subdomain validation
• Hostname route protection from subdomain-only overwrite

Ref: #7214
Closes #7214

[mergeable]

Hi there, jalexiscv! 👋

Thank you for sending this PR!

We expect the following in all Pull Requests (PRs).

• PRs must be sent to the appropriate branch
• All git commits must be GPG-signed
• Must follow our style guide
• Be commented in the PHP source file
• Be documented in the user guide
• Be unit tested
• Pass all checks in GitHub Actions

Important

We expect all code changes or bug-fixes to be accompanied by one or more tests added to our test suite to prove the code works.

If pull requests do not comply with the above, they will likely be closed. Since we are a team of volunteers, we don't have any more time to work
on the framework than you do. Please make it as painless for your contributions to be included as possible.

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md

Sincerely, the mergeable bot 🤖

[paulbalandan]

Please add tests to prove the fix works. Also, add the fix to the changelog.

[paulbalandan]

Closing due to no activity for over a month.

We appreciate PRs sent but please ensure they’re complete or you’re prepared to complete them. Unfinished PRs simply add to maintainers’ review time and are not considerate of everyone’s time.