commit d566f16157971f6d424514325a5518389c0a20f1
parent 544534653ffbe8fb89dae56e85851def89678ae1
Author: Christian Grothoff <christian@grothoff.org>
Date: Fri, 7 Aug 2026 01:05:54 +0200
todos for turnstiles
Diffstat:
2 files changed, 24 insertions(+), 0 deletions(-)
diff --git a/frags/drupal-paivana-manual.rst b/frags/drupal-paivana-manual.rst
@@ -449,6 +449,19 @@ paid amount is one of the amounts the price category accepts**.
Only then does it mint the ``taler_turnstile_paivana`` cookie
and 303-redirect the browser back to the article.
+.. note::
+
+ The field named ``cur_time`` here is not a current time: it is
+ the *expiration* of the access being bought, which is why it is
+ also one of the inputs hashed into the ``paivana_id``.
+ ``paivana-httpd`` and
+ :doc:`DD 76 </design-documents/076-paywall-proxy>` have renamed
+ it to ``expiration`` for exactly that reason. **TODO:** rename
+ it here too, in the module's JavaScript and controller and then
+ in this manual; until the module changes, this document
+ deliberately keeps the old name so that it matches the code that
+ is shipped.
+
The cookie is keyed on Drupal's per-site ``private_key``, bound
to the visitor's client IP and to the specific fulfillment URL,
marked ``HttpOnly``, ``SameSite=Lax``, and ``Secure`` when the
diff --git a/frags/wordpress-paivana-manual.rst b/frags/wordpress-paivana-manual.rst
@@ -443,6 +443,17 @@ the requesting page and that the paid amount is one of the amounts the price
category accepts**. Only then does it mint the ``taler_turnstile_paivana``
cookie and instruct the browser to reload the article.
+.. note::
+
+ The field named ``cur_time`` here is not a current time: it is the
+ *expiration* of the access being bought, which is why it is also one of
+ the inputs hashed into the ``paivana_id``. ``paivana-httpd`` and
+ :doc:`DD 76 </design-documents/076-paywall-proxy>` have renamed it to
+ ``expiration`` for exactly that reason. **TODO:** rename it here too, in
+ the plugin's JavaScript and REST controller and then in this manual;
+ until the plugin changes, this document deliberately keeps the old name
+ so that it matches the code that is shipped.
+
The cookie is keyed on Wordpress' built-in ``wp_salt('auth')``, bound to the
visitor's ``REMOTE_ADDR`` and ``Path``-scoped to the specific fulfillment URL,
marked ``HttpOnly``, ``SameSite=Lax``, and ``Secure`` when the page was served
