Automating order setup (via API call?)

[holybladder]

Hi folks, this might be a dumb question but I've searched the forums and Googled, and the developer's guide just seems to be mostly a giant list of classes (is there a user-friendly dev guide out there somewhere I'm missing?) - is it possible to set up an order "automatically" from the outside, I.E. send a user from an external webpage to the shop and their order is all set up for them in the cart? I've got some complicated customisable bundles (subscriptions) I want to sell and if possible I want to build an external page that takes them through step by step choosing the elements and then shoots them over to the shop to check it out.

[holybladder]

Finally realised it's called Webservice and it's documented for Prestashop but not for Thirty Bees specifically 🙂 Posting this here in case other people have the same question, docs here:

https://devdocs.prestashop.com/1.7/webservice/getting-started/

[datakick]

It will be a little bit complicated to make this kind of integration work, though.

Yes, you can use webservice to prepare a new cart. This one is quite simple. The problem will be with redirecting user to your store and associating this newly created cart to their session. 

There is a mechanism in place that allows you to recover cart by passing query parameters recover_cart=<cartId> and token_cart=<secret>. The problem is with the <secret> - that is based on _COOKIE_KEY_ constant, and it's not the best idea to share this information with third party store.

For those interested, the value of <secret>=md5(_COOKIE_KEY_.'recover_cart_'.<cartId>), if anyone is interested

[datakick]

That's correct, this is very sensitive information.

This mechanism not only recover and associate the cart with your session, but also authenticate the user -- if the cart belongs to some customer, you would be logged in as this customer. This could be quite dangerous -- anyone who knows cookie key can log in as anybody.

[holybladder]

That's really helpful to know, thank you :) So you might not want to share the cookie key around because it could be used to access other information? I'll be coding the external site myself from scratch, if that makes it any safer...

[holybladder]

Got you 😕 So there isn't really a secure/recommended way currently to set up a cart from an external site?

[datakick]

It should be safe to use this mechanism as long as you are in control of this external site.