Confirmed orders generate confirmation record or flag
Why it matters
If the only record of order confirmation is the status field flipping to 'confirmed', there is no queryable timestamp for 'orders confirmed in the last 7 days', no display value for 'Confirmed on March 12' in the customer order detail view, and no audit anchor distinct from subsequent status changes. CWE-841 covers workflows where the state machine advances correctly but the associated data capture is incomplete. A confirmedAt timestamp is a lightweight addition with disproportionate operational value — it powers fulfillment metrics, SLA tracking, and customer-facing order timelines.
Severity rationale
Low because the order flow itself is not broken — the missing metadata only becomes a problem when querying, reporting, or displaying confirmation timing.
Remediation
Add a nullable confirmedAt column to the orders table in prisma/schema.prisma and populate it during the confirmation transition in lib/orders/state-machine.ts.
// prisma/schema.prisma addition:
// confirmedAt DateTime?
// In transitionOrder (lib/orders/state-machine.ts):
const extraFields: Partial<Order> = {}
if (newStatus === 'confirmed') extraFields.confirmedAt = new Date()
await db.orders.update({
where: { id: orderId },
data: { status: newStatus, ...extraFields },
})
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Order Management Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-841 — Improper Enforcement of Behavioral Workflow
- iso-25010:2011 · functional-correctness — Functional Correctness
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ecommerce-order-management·automated