Order Process - Clarify Steps

[barrow_matt]

I have been looking at the order process in Zen Cart and would just like to check if my understanding is correct.

I've been looking in /includes/modules/checkout_process.php

The process seems to be to take the payment first, then create the order record in the database. Is that correct? The order id doesn't exist until after the payment is processed?

The reason I ask is I am looking at writing a mod to run a MaxMind fraud detection query before payment is taken so high risk customers can be rejected as the product is an automatic digital delivery once the order is completed.

Would it be a significant job to rearrange the code to write the order to the database first as pending so the query can be run then update the order status is payment is successful (Pending->Processed) then continue with the send_order email etc...

Are there any obvious problems that I might come across doing this?

Thanks,

Matt

[gjh42]

I can't speak to the technical issues, but the logical issue of not decreasing inventory in the db until the payment is made becomes irrelevant for downloadables. Thus, there should be no reason not to try this reorganization of the process *if* it is necessary for running the check.
The question is whether the information really needs to be in the database to run the check, vs in ZC variables.

[gjh42]

It is true that there would not be an order id until the order is written to the db, so if it is necessary to have a real db id for running the check, you would have to do the rearranging.

This would present the converse issue to the standard process in that if an order is denied, there would be a gap in the final order id sequence.

[barrow_matt]

This all takes place after the user has clicked confirm order and as you say the inventory isn't critical.

With inventory this would be replaced when a pending order was cancelled.

Something to bear in mind as the product is a unique code so it does have an inventory and he wouldn't want this to be out of stock due to a few fraudulent orders which get stuck pending.

If the order is refused I will have to look at the code to restock the inventory.

It's a good point to consider, which is the reason I made the post, thanks.

[gjh42]

The big question is, does there have to be a db-generated final order id for the check to be done?

[barrow_matt]

There is unless I modify the Maxmind module, which is an option.

Basically this module runs the fraud check then saves the data in the database linked to the order id, so when you are looking at orders in admin you can see the fraud risk scores, to do it without an order id might get a bit complicated as you would have to update this later.

As each check is charged you wouldn't want to run the check twice such as a pre check and post check for successful orders.

You need to see scores for all orders so you can adapt the rules over time with experience.

[Ajeh]

Did you look in the Free Add Ons ... I believe this is MaxMind ...
http://www.zen-cart.com/index.php?ma...roducts_id=447

[barrow_matt]

Did you look in the Free Add Ons ... I believe this is MaxMind ...
http://www.zen-cart.com/index.php?ma...roducts_id=447

Yes, that is the MaxMind module which I have installed.

The problem is it runs after the payment has been processed and then my clients site then sends a unique voucher code (which is the product) in the order confirmation email.

Logging in to find orders are high fraud risk is useless once the code has been sent so I need to rework the order process to allow the MaxMind check to run first and not to proceed if the risk is high.

I think the easiest way to do this is to write the order to the database first, run the MaxMind query then either continue or break depending on the result.

The purpose of my post was to see if I was missing anything in the way Zen works that would make this difficult. Inventory management as highlighted is a good point.

What I will do today is go through the order process code and see if there are any dependencies on one being run before the other. I'll also set up a test store on my server and see if it breaks when I change these steps around.

[Ajeh]

Could the code be sent in a second email when the checkout_success is reached rather than in the original orders email?

[barrow_matt]

It could but the problem then is you have taken payment and may decline to send the product. So the payment would need to be voided. The issue is the use of stolen credit card details, so payments process ok but get charged back by the CC company some time later.

I want to evaluate the risk before attempting to charge the card, if it scores high I will redirect to a 'Sorry your order can't be processed, please contact...' and payment will not be attempted.

My clients USP is instant delivery 24/7 so the system must make a decision whether or not to process the payment and deliver the product.