Order Monitor

The store sells digital product keys, which makes it an attractive target for fraud: a stolen account or a bot can place many orders in minutes, and “Pay by Invoice” orders deliver the product before any money arrives. The Magento shop could not be touched — no extensions, database access, API calls or cron jobs on the shop server — customer data had to stay protected with least privilege everywhere, and the whole thing had to run on ordinary shared hosting.

The shop already sent a copy of every invoice email to a shared Microsoft 365 mailbox, so that became the event stream. The app authenticates to Microsoft Graph with a certificate and is limited by Exchange Online RBAC for Applications to that one mailbox, using only read requests. A crash-safe delta sync saves its cursor only after messages are committed, a label-driven parser handles invoices in five languages and three currencies, and an email only counts as an order when it comes from a known sender and passes DMARC. Alert rules run over sliding windows, and overlapping windows merge into a single incident instead of a flood of duplicates.

The monitor sees every order without any connection to Magento, runs on standard shared hosting with a single cron entry, and is covered by a Pest test suite spanning sync, parsing, alert windows, DMARC verification and access rules.

Feature tests with Pest

87

Invoice languages parsed

5

Changes to the Magento shop

0

• 01Live dashboard with orders today, sales per currency, activity chart and sync health badge
• 02Order burst alerts over sliding windows (default 10 orders in 10 minutes)
• 03Pay by Invoice value alerts tracked per currency, with no guessed exchange rates
• 04Alert workflow to acknowledge, investigate, resolve and reopen, with an audit log
• 05Orders page with search, date, currency and payment-method filters
• 06Admin settings for rule thresholds, mailbox status and certificate expiry
• 07Invite-only accounts with required two-factor authentication
• 08No customer names, addresses or emails sent to the browser

1. 01

   Step 1: Sync

   Every minute, a Microsoft Graph delta query fetches only new messages from the shared mailbox, recovering from expired tokens and following Retry-After on throttling.

2. 02

   Step 2: Parse

   Invoice emails in German, English, French, Italian and Spanish become orders in EUR, CHF or USD, stored as integer minor units; reminders and other mail are set aside.

3. 03

   Step 3: Evaluate

   Each new order is checked against the window before it, so an alert fires as soon as a threshold is crossed, and overlapping windows extend one incident.