# TODO — magento-shippingfields

> **Last updated:** 2026-02-26 (Europe/London)
> **Source:** AUDIT.md findings + ADR-000 follow-up actions
> **Owner:** Engineering

---

## HIGH

| # | Task | Finding | Evidence |
|---|------|---------|----------|
| H1 | Replace synchronous AJAX (`async: false`) in `place-order-mixin.js` with async call using Promise/async-await | F1 / S1 | `src/view/frontend/web/js/action/place-order-mixin.js` |

---

## MEDIUM

| # | Task | Finding | Evidence |
|---|------|---------|----------|
| M1 | Add `portalpeople/magento-disableddates` to `composer.json` require block, or add null-guard in `DeliveryDateConfigProvider` if optional | F2 | `composer.json`, `src/Model/Checkout/DeliveryDateConfigProvider.php` |
| M2 | Confirm which save path is authoritative (REST API vs `ShippingInformationManagementPlugin`); remove or document the redundant path | F3 | `src/Model/ShippingFieldsManagement.php`, `src/Plugin/ShippingInformationManagementPlugin.php` |
| M3 | Confirm which transfer path is authoritative (observer vs `QuoteToOrderPlugin`); remove or document the redundant path | F4 | `src/Observer/QuoteSubmitBefore.php`, `src/Plugin/QuoteToOrderPlugin.php` |
| M4 | Confirm ACL resource on admin `Update` controller; add `acl.xml` entry if missing; document in `docs/API.md` | F5 / S3 | `src/Controller/Adminhtml/Order/Update.php` |
| M5 | Add server-side format validation for `shipping_date` in `ShippingFieldsManagement` | S5 | `src/Model/ShippingFieldsManagement.php` |
| M6 | Review `shipping_message` logging — redact or truncate value to avoid PII in logs | S4 | `src/Model/ShippingFieldsManagement.php`, `src/Observer/QuoteSubmitBefore.php` |

---

## LOW

| # | Task | Finding | Evidence |
|---|------|---------|----------|
| L1 | Align version strings — `composer.json` (v1.0.18) and `module.xml` (`setup_version="1.0.0"`) | F6 | `composer.json`, `src/etc/module.xml` |
| L2 | Remove backup files from repository: `sales_order_edit_index.xml.bak`, `place-order-mixin.js.bak`, `Untitled-1.html` | F7 | `src/view/adminhtml/layout/`, `src/view/frontend/web/js/action/`, `src/view/adminhtml/` |
| L3 | Replace emoji prefixes in log messages with standard text or structured context | F8 | `src/Model/ShippingFieldsManagement.php`, `src/Observer/QuoteSubmitBefore.php`, plugins |
| L4 | Remove `PaymentInformationManagementPlugin` if it only logs — or document its purpose | — | `src/Plugin/PaymentInformationManagementPlugin.php` |
| L5 | Add PHPUnit tests for `ShippingFieldsManagement`, `QuoteSubmitBefore`, and plugin conditions | F9 | `composer.json` |

---

## UNKNOWNS — Requires Owner Clarification

| # | Question | Impact if Unresolved |
|---|----------|---------------------|
| U1 | Is `portalpeople/magento-disableddates` required in all environments? | Cannot safely declare or guard without this answer |
| U2 | Which save path is authoritative (REST API vs plugin)? | Dual paths cause maintenance confusion |
| U3 | Which transfer path is authoritative (observer vs `QuoteToOrderPlugin`)? | Redundant code risk |
| U4 | What ACL resource protects the admin `Update` controller? | Security gap if unconfirmed |
| U5 | Is `shipping_date` required on the frontend? | Unclear whether checkout can proceed without it |
| U6 | Exact column types for `shipping_date` and `shipping_message`? | `DATA_OWNERSHIP.md` has `UNKNOWN` tokens |
| U7 | What log channel does the PSR-3 logger write to? | Cannot confirm log observability |
| U8 | Has GDPR assessment been done for `shipping_message` free-text? | Legal compliance risk |
| U9 | Does Magento enforce session ownership for `carts/mine` anonymous endpoint? | Security gap if unenforced |
| U10 | Is there a data retention policy for `shipping_date` and `shipping_message`? | GDPR retention compliance |

---

## DOCS

| # | Task |
|---|------|
| D1 | Update `DATA_OWNERSHIP.md` once exact column types are confirmed |
| D2 | Update `API.md` once ACL resource and date format are confirmed |
| D3 | Add ADRs documenting resolution of dual save path and dual transfer path decisions |
| D4 | Update `BOUNDARIES.md` once `magento-disableddates` dependency decision is made |
