Platform Enhancements

This page documents specific architectural enhancements native to the Maho platform that extend the core capabilities inherited from its predecessors. These include advanced auditing via AdminActivityLog, external shipping integration through ShippingBridge, frontend performance optimization with SpeculationRules, and content safety via ContentVersion.

---

AdminActivityLog (Encrypted Audit Trail)

The Maho_AdminActivityLog module provides a comprehensive audit trail for administrative actions, designed with security and compliance in mind. To protect sensitive data, it leverages Maho's encryption system for the contents of log entries.

Implementation and Data Flow

The core of this module is an observer class that hooks into various model and authentication events to log relevant activity:

• The observer generates a unique action_group_id per request/session to group multiple data changes occurring in a single admin session:

  • This ID is derived from the session ID, current request URL, and request timestamp app/code/core/Maho/AdminActivityLog/Model/Observer.php29-46

• Authentication Events: The observer listens for admin login successes, failures, and logouts, logging these as special login activity records app/code/core/Maho/AdminActivityLog/Model/Observer.php48-97

• Model Data Changes:

  • Before a model save, the observer records the model's original data snapshot (getOrigData) app/code/core/Maho/AdminActivityLog/Model/Observer.php102-131
  • After save, it compares with the updated data and filters out ignored fields such as form_key, updated_at, and other non-informative fields.
  • The diff (only changed fields) is saved securely in the log app/code/core/Maho/AdminActivityLog/Model/Observer.php18-191

• All log entries are stored in dedicated database models and encrypted fields as needed.

Key Entities

Entity	Class	Responsibility
Activity Log Entry	Maho_AdminActivityLog_Model_Activity	Represents individual admin data modification entries.
Authentication Entry	Maho_AdminActivityLog_Model_Login	Tracks login/logout/failed admin authentication events.
Observer	Maho_AdminActivityLog_Model_Observer	Hooks and manages logging by subscribing to model and auth events.

---

ShippingBridge (External API Integration)

ShippingBridge serves as a flexible abstraction layer to integrate external shipping service providers using a unified carrier interface, simplifying shipping rate requests and data handling in Maho.

Architecture

The heart of the module is Maho_ShippingBridge_Model_Carrier, which extends the generic shipping carrier abstract class and implements the shipping carrier interface app/code/core/Maho/ShippingBridge/Model/Carrier.php13-15

• Rate Collection (collectRates):

  • Checks if the carrier is active.
  • Validates destination country eligibility.
  • Builds a detailed JSON payload representing the shipping request, including all cart items with extended attributes app/code/core/Maho/ShippingBridge/Model/Carrier.php23-77
  • Sends HTTP POST request to configured external API endpoint using Symfony\Component\HttpClient\HttpClient.
  • Supports multiple auth methods configurable in system settings: Bearer token and customizable headers app/code/core/Maho/ShippingBridge/Model/Carrier.php49-61
  • Logs request and response data in debug mode.
  • Parses response JSON into shipping rate methods, including support for descriptions and logos on the shipping options app/code/core/Maho/ShippingBridge/Model/Carrier.php100-124

• Extended Attributes Inclusion:

  • Additional product attributes used in the request payload can be configured (e.g., dimensions, color) via system config app/code/core/Maho/ShippingBridge/Model/Source/ProductAttribute.php17-35

• Frontend Integration:

  • Shipping method logos returned by the API are rendered in the checkout shipping method selection UI for enhanced visual confirmation app/design/frontend/base/default/template/checkout/onepage/shipping_method/available.phtml41-47

ShippingBridge Rate Request Flow

---

SpeculationRules (Browser Prefetch/Prerender Hints)

The SpeculationRules module introduces advanced frontend performance optimization by leveraging browser speculation rules, enabling browsers to prefetch or prerender pages based on user interaction patterns, thereby improving navigation speed.

Implementation Details

• Speculation hints are injected into the storefront as a <script type="speculationrules"> JSON blob by the block Maho_SpeculationRules_Block_Script configured in layout XML app/code/core/Maho/SpeculationRules/Block/Script.php10-40 app/code/core/Maho/SpeculationRules/etc/config.xml45-51

• The system supports three eagerness levels controlling when prefetch or prerender actions trigger on matched links:

  • Eager: Immediately after the page loads.
  • Moderate: After the user hovers on the link for 200ms.
  • Conservative: On mouse or touch down, just prior to clicking.

• Each eagerness level supports independent CSS selectors for both prefetch and prerender actions, configurable via admin system config app/code/core/Maho/SpeculationRules/etc/system.xml25-90

• By default, moderate prefetch selectors include common navigation links such as .nav-primary a, .breadcrumbs a, .product-name a, and .product-image a to capture typical navigation flows app/code/core/Maho/SpeculationRules/etc/config.xml57-63

Speculation Rules Configuration Data Flow

---

ContentVersion (CMS Content Versioning and Snapshots)

The Maho_ContentVersion module offers snapshot-based versioning for CMS Pages and Static Blocks, enabling administrators to track changes, maintain history, and revert content safely.

Data Management and Integration

• When CMS entities such as Mage_Cms_Model_Page or Mage_Cms_Model_Block are saved or updated, snapshots of their states are stored as version entries [related to admin activity log observer handling of config data] app/code/core/Maho/AdminActivityLog/Model/Observer.php118-124

• The module works synergistically with AdminActivityLog to provide a comprehensive audit trail associating version snapshots with the administrators who made changes.

ContentVersion Entity Mapping

---

Summary of Platform Settings and Security

• Sensitive configuration fields such as API keys and tokens are encrypted at rest using adminhtml/system_config_backend_encrypted backend models ensuring they are secure both in database and during runtime app/code/core/Maho/ShippingBridge/etc/system.xml37-54

• Each platform enhancement is encapsulated within its dedicated module (Maho_AdminActivityLog, Maho_ShippingBridge, Maho_SpeculationRules, Maho_ContentVersion), maintaining modularity and allowing independent updates and configuration.

---

References & Sources

• AdminActivityLog Observer: app/code/core/Maho/AdminActivityLog/Model/Observer.php12-191
• ShippingBridge Carrier: app/code/core/Maho/ShippingBridge/Model/Carrier.php13-135
• ShippingBridge System Config: app/code/core/Maho/ShippingBridge/etc/system.xml11-139
• ShippingBridge ProductAttribute Source: app/code/core/Maho/ShippingBridge/Model/Source/ProductAttribute.php13-41
• ShippingBridge AuthType Source: app/code/core/Maho/ShippingBridge/Model/Source/AuthType.php13-26
• Checkout Shipping Method Template: app/design/frontend/base/default/template/checkout/onepage/shipping_method/available.phtml41-47
• SpeculationRules Config XML: app/code/core/Maho/SpeculationRules/etc/config.xml13-68
• SpeculationRules System XML: app/code/core/Maho/SpeculationRules/etc/system.xml13-99
• SpeculationRules XML Layout: app/code/core/Maho/SpeculationRules/etc/config.xml45-51
• AdminActivityLog interaction with CMS Config Data: app/code/core/Maho/AdminActivityLog/Model/Observer.php118-124

---

This concludes the technical documentation for Maho's platform-level enhancements covering audit security, external shipping API integration, frontend speculation hints, and CMS content versioning.