fc_cid cookie expiration comment says 28 days but value is 112 days

[ryu3k]

Bug Description

In app/Hooks/Handlers/RedirectionHandler.php, the fc_cid cookie is set with a documentation comment stating "28 days", but the actual expiration value is 9676800 seconds, which equals 112 days (4× longer than documented).

This affects how long campaign-revenue attribution remains active after a click, which is relied on for the WooCommerce / EDD revenue reports surfaced in the campaign analytics UI.

Location

https://github.com/FluentCRM/fluent-crm/blob/master/app/Hooks/Handlers/RedirectionHandler.php#L116

if ($campaignEmail->campaign_id) {
    setcookie("fc_cid", $campaignEmail->campaign_id, time() + 9676800, COOKIEPATH, COOKIE_DOMAIN);  /* expire in 28 days */
}

Math

• 28 days = 28 * 86400 = 2,419,200 seconds
• 9,676,800 seconds = 9676800 / 86400 = 112 days

Impact

Site owners reading the inline comment assume revenue attribution is bounded at 28 days. In reality, a click can attribute a purchase made up to ~4 months later, which can materially change how Revenue numbers are interpreted (especially for stores with longer purchase consideration cycles).

The same file also sets fc_hash_secure to time() + 7776000 (90 days), which matches its comment correctly.

Suggested fix

Either:

A. Update the value to truly be 28 days:

setcookie("fc_cid", $campaignEmail->campaign_id, time() + 2419200, COOKIEPATH, COOKIE_DOMAIN);  /* expire in 28 days */

B. Update the comment to match the actual 112-day value:

setcookie("fc_cid", $campaignEmail->campaign_id, time() + 9676800, COOKIEPATH, COOKIE_DOMAIN);  /* expire in 112 days */

Option A is likely the original intent given the comment, but changing it now would shorten the attribution window for existing installations — so this is a behavior decision, not just a docs fix.

Bonus suggestion (optional)

A fluent_crm/cookie_lifetime filter (similar to the existing fluent_crm/will_use_cookie) would let site owners tune the attribution window without forking the plugin.