order tracking concerns

This message was sent from: Development
http://forums.oscommerce.com/viewtopic.php?p=180146#180146
----------------------------------------------------------------

Hi all,

I've been working on a custom programming job for a client that runs osC and needs a mass-import of some specific reports. While most of it is simple SQL joins/queries, I was wondering if someone could help me clarify the following.

1 - Just to make sure I've got this straight: The orders_total table tracks formatting and actual values for individual order ids to output an invoice/receipt, but then the values are deleted upon setting the status of the order to "Completed"? The problem for me becomes a matter of manually recalculating the order subtotal, figuring out the tax zone and appropriate sales tax, and apparently I am up the creek as far as shipping method/payment. Why not keep order totals around, or change the schema for the orders table to include such charges? Am I missing something?

2 - Most of the payment modules seem to just dump a line into the OT table after authorization of, say, a credit card. I've only looked at the source for the modules as I'm not set up with any merchant accounts myself, but I believe I'm interpreting the process correctly. Again, this is an issues, as you know the merchant responses may include CVS authorization checks / output, and it'd be handy to have a place to stick this without having to modify table schemas. 

3 - Why is there no separate contact information for the payee and addressee? I may have a customer who signs up with their personal information but wishes to make orders on behalf of a company or ship to one, and probably wouldn't appreciate the only contact information being their home telephone number.

4 - This is a bit outside the scope of my order tracking problem, but shouldn't you reconsider giving anyone with access to the admin directory carte blanche to the backend? I assume a knowledgeable admin in a production environment would put a .htaccess file for apache or similar protection running IIS, but has anyone considered an admin account capability? HTTP auth, or something? SSL would not help a clever intruder on a poorly protected system.

All of the order issues should really be handled in the orders table. As it stands I am doing multiple joins between the orders and customers tables to extrapolate at best incomplete information for each order. And concerning merchant accounts / payment modules - shouldn't we be able to standardize, somewhat, a record for payment information after the transaction? Finally - the shipping information should really be saved somewhere, and should definitely not risk deletion simply because the order is marked "completed."

I apologize if I sound too critical - osC is very cleanly written and I applaud your work thus far. Plus, if you're agreeable, I'd love to help actually implement the stuff I suggest rather than just complain. :) 

Thanks in advance.