# NetSuite Module TODOs

Last updated: 2026-07-16 12:45 UTC

## Processing history

- 2026-07-16 12:00 UTC — Implemented module-owned OAuth client injection and migrated the active module REST call sites from legacy wrappers. `ahs-hub` remained excluded.
- 2026-07-16 12:30 UTC — Switched the live `NGauge_Base` cart cancellation flow to `Yii::$app->netsuiteClient` and added `cancelSalesOrder()` to the module client.
- 2026-07-16 12:45 UTC — Marked the live backend cart migration complete in the TODO and kept remaining compatibility/removal work open.

## Added

- [x] Add a reusable function to fetch a Sales Order using `cart.data.netsuite.deliveryid`.
- [x] Add a guarded controller action to refresh local NetSuite cart metadata.
- [x] Validate Sales Order IDs before using them in REST paths.
- [x] Stop logging NetSuite configuration and OAuth client objects.
- [x] Record caught exceptions through `backend\\models\\ActionLog` across the Yii2 extension.

## Verification required

- [ ] Confirm the host cart model's JSON serialization persists the new `orderno` and `salesorder_status` fields.
- [ ] Confirm the NetSuite `status` response shape in the development account before mapping it to local cart status.
- [ ] Add unit tests with a mocked `netsuiteClient` for missing IDs, invalid IDs, API failures, and successful refreshes.
- [ ] Confirm the host application exposes the `syncorder` route and invokes it with `POST` plus CSRF protection if a UI control is added.
- [x] Replace legacy hard-coded OAuth certificate/account values in the migrated REST call sites with the configured module client.
- [ ] Remove or redact remaining logs and API responses that may contain customer, address, order, or credential-related data.
- [ ] Add webhook authentication/replay protection for the inbound NetSuite API controller.

## NetSuite reference migration

- [x] Identify the active `NGauge_Base` integration path; it consumes the module bootstrap and external `config/netsuite/ns.php` configuration.
- [x] Replace module references to `common\\components\\NetSuiteApi` with the module-owned `netsuiteClient` service.
- [x] Replace the module's static `PortalPeople\\netsuite\\NetSuiteApi` usage in the product view.
- [ ] Retire the duplicate module `NetSuiteApi.php` wrapper after callers are migrated.
- [x] Review and migrate `NGauge_Base/backend/models/Cartsbe.php` references to `PortalPeople\\netsuite\\components\\NetSuite`.
- [x] Search `NGauge_Base` for any cart recalculation trait or other live NetSuite callers.
- [x] Keep `ahs-hub` out of implementation; it is a backup copy of the live system.
- [x] Search dependent modules for direct NetSuite references before removing compatibility classes.
- [ ] Remove `common\\components\\NetSuiteApi` and `common\\components\\NetSuiteApiAuth` only after runtime verification.
- [ ] Rotate credentials in the live environment and remove any remaining hard-coded values outside the migrated module paths.

See [docs/NETSUITE_REFERENCE_MIGRATION_PLAN.md](docs/NETSUITE_REFERENCE_MIGRATION_PLAN.md).
