Order Process - Clarify Steps

[barrow_matt]

I have been looking at the order process in Zen Cart and would just like to check if my understanding is correct.

I've been looking in /includes/modules/checkout_process.php

The process seems to be to take the payment first, then create the order record in the database. Is that correct? The order id doesn't exist until after the payment is processed?

The reason I ask is I am looking at writing a mod to run a MaxMind fraud detection query before payment is taken so high risk customers can be rejected as the product is an automatic digital delivery once the order is completed.

Would it be a significant job to rearrange the code to write the order to the database first as pending so the query can be run then update the order status is payment is successful (Pending->Processed) then continue with the send_order email etc...

Are there any obvious problems that I might come across doing this?

Thanks,

Matt

[gjh42]

I can't speak to the technical issues, but the logical issue of not decreasing inventory in the db until the payment is made becomes irrelevant for downloadables. Thus, there should be no reason not to try this reorganization of the process *if* it is necessary for running the check.
The question is whether the information really needs to be in the database to run the check, vs in ZC variables.

[gjh42]

It is true that there would not be an order id until the order is written to the db, so if it is necessary to have a real db id for running the check, you would have to do the rearranging.

This would present the converse issue to the standard process in that if an order is denied, there would be a gap in the final order id sequence.

[barrow_matt]

This all takes place after the user has clicked confirm order and as you say the inventory isn't critical.

With inventory this would be replaced when a pending order was cancelled.

Something to bear in mind as the product is a unique code so it does have an inventory and he wouldn't want this to be out of stock due to a few fraudulent orders which get stuck pending.

If the order is refused I will have to look at the code to restock the inventory.

It's a good point to consider, which is the reason I made the post, thanks.

[gjh42]

The big question is, does there have to be a db-generated final order id for the check to be done?

[barrow_matt]

There is unless I modify the Maxmind module, which is an option.

Basically this module runs the fraud check then saves the data in the database linked to the order id, so when you are looking at orders in admin you can see the fraud risk scores, to do it without an order id might get a bit complicated as you would have to update this later.

As each check is charged you wouldn't want to run the check twice such as a pre check and post check for successful orders.

You need to see scores for all orders so you can adapt the rules over time with experience.