# TODO — magento-shippingfields

> **Last updated:** 2026-05-01 (Europe/London)
> **Source:** Current code review + prior audit findings
> **Owner:** Engineering

---

## Security Priorities (Open)

| # | Priority | Task | Evidence |
|---|----------|------|----------|
| S1 | HIGH | Lock down `/V1/carts/mine/save-shipping-fields` from `anonymous` to authenticated customer scope (`self`) | `src/etc/webapi.xml` |
| S2 | HIGH | Remove PII from logs (`shipping_message`, raw request payloads, stack traces with payload context) | `src/Model/ShippingFieldsManagement.php`, `src/Plugin/ShippingInformationManagementPlugin.php` |
| S3 | MEDIUM | Remove frontend console logging of shipping field values in production mixins/actions | `src/view/frontend/web/js/action/*.js`, `src/view/frontend/web/js/model/*.js`, `src/view/frontend/web/js/view/*.js` |
| S4 | MEDIUM | Remove direct `ObjectManager::getInstance()` fallbacks and inject dependencies explicitly | `src/Plugin/*RepositoryPlugin.php`, `src/Plugin/ShippingInformationManagementPlugin.php`, `src/Block/Adminhtml/Order/*.php` |
| S5 | MEDIUM | Add stricter server-side input constraints (length/format) for `shipping_w3w` and `shipping_message` at write boundary | `src/Model/ShippingFieldsManagement.php`, `src/Controller/Adminhtml/Order/Update.php` |

---

## Architecture / Maintenance (Open)

| # | Priority | Task | Evidence |
|---|----------|------|----------|
| A1 | MEDIUM | Decide authoritative save path and remove redundant implementation (`ShippingFieldsManagement` vs `ShippingInformationManagementPlugin`) | `src/Model/ShippingFieldsManagement.php`, `src/Plugin/ShippingInformationManagementPlugin.php` |
| A2 | MEDIUM | Decide authoritative quote→order transfer path and remove redundancy (`Observer` vs `QuoteToOrderPlugin`) | `src/Observer/QuoteSubmitBefore.php`, `src/Plugin/QuoteToOrderPlugin.php` |
| A3 | LOW | Align `setup_version` with latest release versioning strategy | `src/etc/module.xml`, `composer.json` |
| A4 | LOW | Add PHPUnit coverage for service + observer + plugin paths | module test suite |

---

## Resolved / Stale Items (Closed)

| # | Status | Notes |
|---|--------|-------|
| C1 | CLOSED | Synchronous AJAX (`async: false`) removed from `place-order-mixin.js` (handled in v1.0.19) |
| C2 | CLOSED | Legacy backup/stray files listed in old TODO are no longer present |
| C3 | CLOSED | Admin update ACL check exists via `_isAllowed()` with `Magento_Sales::actions_edit` in controller |

---

## Clarifications Needed

| # | Question | Owner |
|---|----------|-------|
| Q1 | Is `portalpeople/magento-disableddates` mandatory in all environments? | Product/Platform |
| Q2 | What retention policy applies to `shipping_message` and `shipping_w3w` data? | Compliance |
| Q3 | Should frontend shipping logs be fully removed or gated behind debug config? | Engineering |

---

## Docs Follow-up

| # | Task |
|---|------|
| D1 | Update API docs after webapi resource lock-down (`anonymous` → `self`) |
| D2 | Add ADR documenting final save-path and transfer-path decisions |
| D3 | Update data-handling docs with retention + logging policy |
