fix(guest): prevent vary cookie mismatch under scoped debug log

[faisalahammad]

Summary

Fixes a Guest Mode cache miss issue where the guest vary cookie value diverges between guest.vary.php and WordPress core rendering when Debug Log is active with URI includes/excludes or Admin IP restrictions. The vary calculation now evaluates client debug eligibility and URI scoping consistently across both execution contexts.

Fixes #1026

Changes

Configuration Persistence (src/activation.cls.php)

Before:

if ( $options[ self::O_GUEST ] ) {
	$this_ids = [
		self::HASH,
		self::O_CACHE_LOGIN_COOKIE,
		self::O_DEBUG_IPS,
		self::O_UTIL_NO_HTTPS_VARY,
	];
	$ids = array_merge( $ids, $this_ids );
}

After:

if ( $options[ self::O_GUEST ] ) {
	$this_ids = [
		self::HASH,
		self::O_CACHE_LOGIN_COOKIE,
		self::O_DEBUG,
		self::O_DEBUG_INC,
		self::O_DEBUG_EXC,
		self::O_DEBUG_IPS,
		self::O_UTIL_NO_HTTPS_VARY,
	];
	$ids = array_merge( $ids, $this_ids );
}

Why: Ensures lib/guest.cls.php can access the active debug configuration from .litespeed_conf.dat when Object Cache is disabled.

Standalone Guest Handler (lib/guest.cls.php)

Before:

$vary = 'guest_mode:1';
if ( $this->_conf && empty( $this->_conf[ self::O_DEBUG ] ) ) {
	$vary = md5( $this->_conf[ self::HASH ] . $vary );
}

After:

$vary     = 'guest_mode:1';
$is_debug = false;
if ( ! empty( $this->_conf[ self::O_DEBUG ] ) ) {
	if ( 2 === (int) $this->_conf[ self::O_DEBUG ] ) {
		$debug_ips = ! empty( $this->_conf[ self::O_DEBUG_IPS ] ) ? $this->_conf[ self::O_DEBUG_IPS ] : [];
		$is_debug  = $this->ip_access( $debug_ips );
	} elseif ( 1 === (int) $this->_conf[ self::O_DEBUG ] ) {
		$is_debug = true;
	}
}

if ( $is_debug && ( ! empty( $this->_conf[ self::O_DEBUG_INC ] ) || ! empty( $this->_conf[ self::O_DEBUG_EXC ] ) ) ) {
	$is_debug = false;
}

if ( ! $is_debug && ! empty( $this->_conf[ self::HASH ] ) ) {
	$vary = md5( $this->_conf[ self::HASH ] . $vary );
}

Why: Prevents guest.vary.php from emitting an unhashed cookie when debug logging is restricted to specific URIs or non-matching client IPs.

Core Vary Engine (src/vary.cls.php)

Before:

$res = implode( ';', $list );
if ( defined( 'LSCWP_LOG' ) ) {
	return $res;
}
return md5( $this->conf( Base::HASH ) . $res );

After:

$res      = implode( ';', $list );
$is_debug = false;
$debug    = $this->conf( Base::O_DEBUG );

if ( Base::VAL_ON === $debug ) {
	$is_debug = true;
} elseif ( Base::VAL_ON2 === $debug && $this->cls( 'Router' )->is_admin_ip() ) {
	$is_debug = true;
}

if ( $is_debug && ( $this->conf( Base::O_DEBUG_INC ) || $this->conf( Base::O_DEBUG_EXC ) ) ) {
	$is_debug = false;
}

if ( $is_debug ) {
	return $res;
}
return md5( $this->conf( Base::HASH ) . $res );

Why: Keeps the domain-wide vary cookie hashed consistently across all pages when URI scoping is enabled.

Crawler Factors (src/crawler.cls.php)

Before:

if ( ! defined( 'LSCWP_LOG' ) ) {
	$vary_val = md5( $this->conf( Base::HASH ) . $vary_val );
}

After:

$is_debug = Base::VAL_ON === $this->conf( Base::O_DEBUG );
if ( $is_debug && ( $this->conf( Base::O_DEBUG_INC ) || $this->conf( Base::O_DEBUG_EXC ) ) ) {
	$is_debug = false;
}
if ( ! $is_debug ) {
	$vary_val = md5( $this->conf( Base::HASH ) . $vary_val );
}

Why: Aligns guest mode crawler factor vary hashing with the updated vary debug rules.

Testing

Test 1: Guest Mode ON + Debug Log ON + Debug URI Includes set

1. Configure Guest Mode ON and Debug Log ON with Debug URI Includes set (rest_route=/litespeed).
2. Make a request to guest.vary.php and verify the cookie header value.
3. Reload / with the returned cookie header.
   Result: Response returns x-litespeed-cache: hit on reload with no cookie overwrite.