# TODO — magento-orderwebhook

> **Last updated:** 2026-02-26 (Europe/London)
> **Source:** AUDIT.md findings + ADR-000 follow-up actions
> **Owner:** Engineering
>
> Items are grouped by priority. AUDIT.md finding reference shown where applicable.

---

## HIGH

| # | Task | Finding | Evidence |
|---|------|---------|----------|
| H1 | Replace `ObjectManager::getInstance()` in `WebhookSender::sendRequest()` with constructor-injected `EncryptorInterface` | F1 / S1 | `src/Model/WebhookSender.php` |
| H2 | Document GDPR legal basis and DPA status for transmitting customer DOB and gender to NGauge — update `docs/GDPR.md` and `docs/DATA_OWNERSHIP.md` | F4 / S2 | `src/Model/OrderDataBuilder.php` |
| H3 | Confirm PCI-DSS scope for `cc_last4`, `cc_type`, `cc_exp_month`, `cc_exp_year` in webhook payload | S3 | `src/Model/OrderDataBuilder.php` |

---

## MEDIUM

| # | Task | Finding | Evidence |
|---|------|---------|----------|
| M1 | Correct `extra.bootstrap` in `composer.json` — change `PortalPeople\\NgaugeBackupSql\\Module` to `PortalPeople\\OrderWebhook\\Module` or remove if unused | F2 | `composer.json` |
| M2 | Correct `src/README.md` — `order_updated` fires only on status → `processing`, not on "processing, complete, or shipped" | F3 | `src/README.md`, `src/Observer/OrderSaveAfter.php` |
| M3 | Align version strings — `composer.json` (v1.0.15) and `module.xml` (`setup_version="1.0.0"`) | F5 | `composer.json`, `src/etc/module.xml` |
| M4 | Add explicit try/catch around `EncryptorInterface::decrypt()` in `WebhookSender::sendRequest()` with a clear log message on failure | S4 | `src/Model/WebhookSender.php` |

---

## LOW

| # | Task | Finding | Evidence |
|---|------|---------|----------|
| L1 | Replace deprecated `Magento\Framework\Registry` in `NgaugeFields` block with layout argument injection | F6 / S5 | `src/Block/Adminhtml/Order/NgaugeFields.php` |
| L2 | Add PHPUnit test suite — cover `WebhookSender` retry/re-entrancy, `OrderDataBuilder` payload structure, `OrderPlaceAfter` admin-skip logic, `OrderSaveAfter` status-change condition | F7 | `composer.json` |
| L3 | Confirm whether magento-deliverydates is a required dependency; add soft module dependency in `module.xml` if so; otherwise add null-guard in `OrderDataBuilder` | — | `src/Model/OrderDataBuilder.php`, `src/etc/module.xml` |
| L4 | Confirm `extra.bootstrap` purpose and document it in `docs/WORKFLOW.md` | F2 | `composer.json` |

---

## UNKNOWNS — Requires Owner Clarification

| # | Question | Impact if Unresolved |
|---|----------|---------------------|
| U1 | What is the canonical module version? | Cannot align version strings without agreement |
| U2 | Is `comment_only` mode active in production? | Determines whether `ngauge_order_id` is ever written; affects resend button behaviour |
| U3 | Is `magento-deliverydates` installed in all environments? | Payload `shipping_date`/`shipping_message` may be null unexpectedly |
| U4 | Is the admin resend button being intentionally hidden after first sync? | Determines if force-resend UI feature is required |
| U5 | Full NGauge API response schema? | Required to verify field mapping in `WebhookSender::setNgaugeResponseFields()` |
| U6 | Has GDPR legal basis been established for DOB/gender transmission to NGauge? | Legal compliance blocker |
| U7 | Has a DPA been signed with NGauge? | Legal compliance blocker |
| U8 | PCI-DSS scope for partial card data? | Compliance blocker |
| U9 | What log channel does the PSR-3 logger write to? | Needed to verify log observability in production |
| U10 | Is there a staging NGauge environment? | Needed for safe testing without affecting production data |

---

## DOCS

| # | Task |
|---|------|
| D1 | Add ADRs documenting resolution of ObjectManager removal, GDPR decisions, and version alignment |
| D2 | Update `docs/DATA_OWNERSHIP.md` once GDPR legal basis and DPA status are confirmed |
| D3 | Update `docs/API.md` with confirmed NGauge response schema once obtained |
| D4 | Update `docs/BOUNDARIES.md` once magento-deliverydates dependency decision is made |
