ORAFOL MDF Portal — Deep System Analysis

0Executive Summary

Verdict

Missio is a mature multi-tenant Laravel SaaS with strong payments (Stripe, PayPal, Square, Authorize.Net, Razorpay, Mollie, Flutterwave, PayFast, Paystack), abandoned-cart recovery, multi-guard auth, and a theme engine. Three areas blocking ORAFOL UAT: (1) parent/child company hierarchy (only customer-groups have parent_id), (2) ORAFOL BE ERP connector (does not exist), (3) multi-location inventory (single stock field today). The 25+ ORAFOL skeleton routes need their backend logic written.

1Current System Architecture

1.1 Stack & Structure

1.2 Modules & Responsibilities

1.3 Tightly Coupled Components & Custom Logic

1.4 Data Flow — Current Order Lifecycle

2Feature Mapping — Magento → Missio

2.1 Account & User

2.2 Catalog & Pricing

2.3 Inventory

2.4 Payments & Credits

2.5 Shipping & Fulfillment

2.6 Integrations & Operations

3Frontend Features & Login Architecture

3.1 Frontend Shop — What customers see

3.2 Login Types on Frontend — CRITICAL

The platform has 4 distinct authentication guards. Mapping them and clarifying the ORAFOL deployment use is essential before kickoff.

What ORAFOL distributors will need

• Single login URL — portal.orafol.com/signin goes to customer guard
• Username OR email login — already supported in MemberController::authentication()
• 2FA on customer guard — currently only on web/admin guard. EXTEND
• Email verification — supported via email_verified_at + token route
• Password reset — /member/forget-password exists
• Magic link / OTP — not present, build if requested
• SSO / OKTA — not present; ORAFOL employees may want this for admin login
• Invite-only signup — /invitation/{code} exists; needs sub-account flow on top
• Role/account switcher after login — if a single user belongs to multiple ORAFOL distributors, they need a context picker. BUILD

3.3 Theme System

29 themes under themes/frontend/. ORAFOL will need either a custom theme or a fork of shop / radiant. Theme is selected per-company. Customizable: header, product cards, checkout form fields, color scheme, language files (54+ via laravel-lang/lang).

4Payment Integrations — All Gateways

Missio already has 9 production-grade payment gateways, far more than most Magento installs run. The PDF requirement (PayPal + purchase orders + bank transfers) is fully covered by what exists.

4.1 Magento gateways NOT in Missio (parity check)

4.2 ORAFOL-specific payment requirements (from SOW)

53rd-Party Integrations — Complete Inventory

5.1 What's installed (composer.json + helpers)

5.2 Integration risk profile

6Technical Debt Analysis

6.1 Fragile / hardcoded logic

6.2 Performance bottlenecks & scaling risks

• No search index. 7,000 SKU target needs Meilisearch or Algolia (Laravel Scout). Current LIKE-based queries will not scale.
• No DB indexes confirmed on OrderCart.cart_id, products.sku, customer_groups.parent_id. Audit indexes during Phase 1.
• Pricing accessor on every product render reads auth guard. Hydrating a 50-product page = 50 auth calls. Cache or batch.
• No HTTP caching layer (Cloudflare / Varnish). Magento has built-in FPC. Plan CDN + cache for catalog pages.
• Single-stock field = race conditions on concurrent checkout. Move to reservation pattern with row-level locks or Redis counters.
• Job queue unclear. No Horizon visible; check if abandoned-cart job runs on supervisor or cron+work.

6.3 Duplicate logic

• Pricing logic duplicated between Product::getPriceAttribute() and ProductVariant::getPriceAttribute().
• Three contact-route files: contacts.php, contacts_old.php — legacy not yet removed.
• Multiple mail providers configured (SendGrid, Mailgun, Postmark, SES) — pick one and remove others or document tenant choice.

7Migration Strategy — Magento → Missio

7.1 What we REUSE from Missio

7.2 What we REBUILD (in Missio)

7.3 What we REPLACE with SaaS / 3rd-party

7.4 What we REMOVE / hide for ORAFOL tenant

• Donations, donors, donation-pages, P2P, pledges, grants, RFPs, video interviews, donation events — HIDE via tenant module flags
• Recruitment module, gallery, forum, channels — HIDE
• 27 of 29 themes (keep ORAFOL custom + shop base) — PRUNE from tenant
• contacts_old.php route file — DELETE

8Recommended Target Architecture

Per the SOW, Missio is delivered as three layers. Here's how to align the Laravel codebase to that model.

8.1 Event-driven design

Use Laravel events for cross-layer hooks. Examples:

OrderPlaced       → ERP outbound + HubSpot deal + email + inventory reserve
OrderShipped      → Customer email + ERP update + tracking webhook
InventoryAdjusted → ERP outbound + low-stock alert if threshold
CustomerCreated   → HubSpot contact + welcome email
PaymentCaptured   → QuickBooks invoice + gateway webhook log

8.2 Data ownership

9Gap Analysis — Master Table

10Risk Assessment

10.1 Migration risks

10.2 Data risks

• Customer data dual-source. If HubSpot and Missio both let users edit a customer, conflict resolution rules must be defined.
• Inventory truth source. ORAFOL BE is master, but during outage the portal must show last-known with timestamp + degraded indicator.
• Pricing drift. If catalog prices are master in BE but admins also edit in Missio, customers see inconsistencies.
• PII handling. Distributor company info, addresses, payment methods. Confirm SOC 2 / GDPR posture for ORAFOL legal review.

10.3 Integration risks

• Cascading failures. ERP outage should not block checkout. Build queue-and-retry pattern; never sync orders inline.
• Webhook replay attacks. Audit all 9 payment-gateway webhook signature verifications.
• Rate limits. HubSpot, Shippo, Avalara all rate-limit. Design batch + backoff.

10.4 Business continuity

• Cutover strategy. Hard cutover or parallel-run with Magento? Recommend 2-week parallel run with traffic split.
• Rollback plan. Keep Magento read-only for 90 days post-launch.
• SLA target 99.9% per SOW = 43 min downtime/month. Realistic with Sentry + uptime monitoring + Horizon.
• Distributor training. 14–16 weeks is tight for a 7K SKU catalog launch. Schedule training weeks 12–14 with at least 2 sessions.

11Prioritized Execution Plan

11.1 First 2 weeks (foundation + de-risk)

1. Day 1–3: Replace GetCompanyId() == 100 with feature flag features('orafol_b2b'). Hide unused modules for ORAFOL tenant. Standardize Stripe creds path.
2. Day 3–5: Kickoff calls — ORAFOL BE API docs request, Kathy's facility discovery, tax engine decision (Avalara vs. TaxJar vs. zone), Magento export audit.
3. Week 2: Add companies.parent_company_id migration. Build multi-warehouse schema. Spike Meilisearch + Scout with 100 SKUs. Build ERP connector base class with mock implementation.

11.2 Phased plan vs. SOW timeline

11.3 Highest-risk items (start earliest)

1. ORAFOL BE connector — XL, spec unknown, blocks order flow
2. Kathy's facility connector — L, spec entirely unknown
3. Multi-warehouse inventory — L, blocks Kathy + BE inventory sync
4. 7K SKU catalog import + search — L, performance unknown
5. Tax engine decision — M, may need change order

11.4 Fastest ROI items (quick wins)

1. Replace tenant ID hardcode with feature flag — S
2. Implement my_orders.blade.php + reorder — S
3. 2FA on customer guard — S
4. Quick-order SKU pad — S — high distributor delight
5. Bulk UPS tracking import — S — immediate ops time savings
6. Issuu embed — S