partial implementation of protocol v6: GET with additional filters, POST not done

17 files changed, 308 insertions, 741 deletions

diff --git a/src/backend/taler-merchant-httpd_config.c b/src/backend/taler-merchant-httpd_config.c
index f1075ff5..448b3dec 100644
--- a/src/backend/taler-merchant-httpd_config.c
+++ b/src/backend/taler-merchant-httpd_config.c
@@ -1,6 +1,6 @@
 /*
   This file is part of TALER
-  (C) 2019, 2020, 2021 Taler Systems SA
+  (C) 2019, 2020, 2021, 2023 Taler Systems SA
 
   TALER is free software; you can redistribute it and/or modify it under the
   terms of the GNU Affero General Public License as published by the Free Software
@@ -42,7 +42,7 @@
  * #MERCHANT_PROTOCOL_CURRENT and #MERCHANT_PROTOCOL_AGE in
  * merchant_api_config.c!
  */
-#define MERCHANT_PROTOCOL_VERSION "5:0:1"
+#define MERCHANT_PROTOCOL_VERSION "6:0:2"
 
 
 MHD_RESULT
diff --git a/src/backend/taler-merchant-httpd_private-get-orders.c b/src/backend/taler-merchant-httpd_private-get-orders.c
index b55a5552..e4f120f4 100644
--- a/src/backend/taler-merchant-httpd_private-get-orders.c
+++ b/src/backend/taler-merchant-httpd_private-get-orders.c
@@ -809,6 +809,14 @@ TMH_private_get_orders (const struct TMH_RequestHandler *rh,
       }
     }
   }
+  po->of.session_id
+    = MHD_lookup_connection_value (connection,
+                                   MHD_GET_ARGUMENT_KIND,
+                                   "session_id");
+  po->of.fulfillment_url
+    = MHD_lookup_connection_value (connection,
+                                   MHD_GET_ARGUMENT_KIND,
+                                   "fulfillment_url");
   TALER_MHD_parse_request_timeout (connection,
                                    &po->long_poll_timeout);
   if (GNUNET_TIME_absolute_is_never (po->long_poll_timeout))
diff --git a/src/backend/taler-merchant-httpd_private-post-orders.c b/src/backend/taler-merchant-httpd_private-post-orders.c
index 11b9abcd..31b99536 100644
--- a/src/backend/taler-merchant-httpd_private-post-orders.c
+++ b/src/backend/taler-merchant-httpd_private-post-orders.c
@@ -462,6 +462,7 @@ execute_transaction (struct OrderContext *oc)
   qs = TMH_db->insert_order (TMH_db->cls,
                              oc->hc->instance->settings.id,
                              oc->order_id,
+                             NULL /* session ID! FIXME: protocol v6! */,
                              &oc->h_post_data,
                              oc->pay_deadline,
                              &oc->claim_token,
diff --git a/src/backenddb/Makefile.am b/src/backenddb/Makefile.am
index 258ddb75..339d59af 100644
--- a/src/backenddb/Makefile.am
+++ b/src/backenddb/Makefile.am
@@ -48,7 +48,7 @@ libtalermerchantdb_la_LIBADD = \
 
 libtalermerchantdb_la_LDFLAGS = \
   $(POSTGRESQL_LDFLAGS) \
-  -version-info 2:0:0 \
+  -version-info 3:0:1 \
   -no-undefined
 
 libtaler_plugin_merchantdb_postgres_la_SOURCES = \
diff --git a/src/backenddb/drop.sql b/src/backenddb/drop.sql
index f2d4096c..1d79544d 100644
--- a/src/backenddb/drop.sql
+++ b/src/backenddb/drop.sql
@@ -24,6 +24,7 @@ BEGIN;
 -- latest requirements for dropping tables.
 
 SELECT _v.unregister_patch('merchant-0001');
+SELECT _v.unregister_patch('merchant-0002');
 
 
 DROP SCHEMA merchant CASCADE;
diff --git a/src/backenddb/merchant-0002.sql b/src/backenddb/merchant-0002.sql
index ef5642f8..d063ce64 100644
--- a/src/backenddb/merchant-0002.sql
+++ b/src/backenddb/merchant-0002.sql
@@ -1,6 +1,6 @@
 --
 -- This file is part of TALER
--- Copyright (C) 2021 Taler Systems SA
+-- Copyright (C) 2023 Taler Systems SA
 --
 -- TALER is free software; you can redistribute it and/or modify it under the
 -- terms of the GNU General Public License as published by the Free Software
@@ -18,9 +18,27 @@
 BEGIN;
 
 -- Check patch versioning is in place.
--- SELECT _v.register_patch('merchant-0002', NULL, NULL);
+SELECT _v.register_patch('merchant-0002', NULL, NULL);
 
 SET search_path TO merchant;
 
+ALTER TABLE merchant_orders
+   ADD COLUMN fulfillment_url TEXT DEFAULT NULL
+  ,ADD COLUMN session_id TEXT DEFAULT '' NOT NULL;
+
+
+CREATE INDEX IF NOT EXISTS merchant_orders_by_merchant_and_session
+  ON merchant_orders
+  (merchant_serial,session_id);
+
+CREATE INDEX IF NOT EXISTS merchant_orders_by_merchant_and_fullfilment_and_session
+  ON merchant_orders
+  (merchant_serial,fulfillment_url,session_id);
+
+CREATE INDEX IF NOT EXISTS merchant_contract_terms_by_merchant_and_session
+  ON merchant_contract_terms
+  (merchant_serial,session_id);
+
+
 -- Complete transaction
 COMMIT;
diff --git a/src/backenddb/merchantdb-postgres.conf b/src/backenddb/merchantdb-postgres.conf
index db4763b9..33b4b838 100644
--- a/src/backenddb/merchantdb-postgres.conf
+++ b/src/backenddb/merchantdb-postgres.conf
@@ -3,4 +3,4 @@ CONFIG = "postgres:///talermerchant"
 
 # Where are the SQL files to setup our tables?
 # Important: this MUST end with a "/"!
-SQL_DIR = $DATADIR/sql/merchant/
+SQL_DIR = ${DATADIR}sql/merchant/
diff --git a/src/backenddb/pg_insert_order.c b/src/backenddb/pg_insert_order.c
index 7c7ad486..867fdec8 100644
--- a/src/backenddb/pg_insert_order.c
+++ b/src/backenddb/pg_insert_order.c
@@ -1,6 +1,6 @@
 /*
    This file is part of TALER
-   Copyright (C) 2022 Taler Systems SA
+   Copyright (C) 2022, 2023 Taler Systems SA
 
    TALER is free software; you can redistribute it and/or modify it under the
    terms of the GNU General Public License as published by the Free Software
@@ -17,6 +17,7 @@
  * @file backenddb/pg_insert_order.c
  * @brief Implementation of the insert_order function for Postgres
  * @author Iván Ávalos
+ * @author Christian Grothoff
  */
 #include "platform.h"
 #include <taler/taler_error_codes.h>
@@ -29,6 +30,7 @@ enum GNUNET_DB_QueryStatus
 TMH_PG_insert_order (void *cls,
                      const char *instance_id,
                      const char *order_id,
+                     const char *session_id,
                      const struct TALER_MerchantPostDataHashP *h_post_data,
                      struct GNUNET_TIME_Timestamp pay_deadline,
                      const struct TALER_ClaimTokenP *claim_token,
@@ -39,6 +41,9 @@ TMH_PG_insert_order (void *cls,
   struct PostgresClosure *pg = cls;
   struct GNUNET_TIME_Timestamp now;
   uint32_t pos32 = (uint32_t) pos_algorithm;
+  const char *fulfillment_url
+    = json_string_value (json_object_get (contract_terms,
+                                          "fulfillment_url"));
   struct GNUNET_PQ_QueryParam params[] = {
     GNUNET_PQ_query_param_string (instance_id),
     GNUNET_PQ_query_param_string (order_id),
@@ -51,6 +56,12 @@ TMH_PG_insert_order (void *cls,
     ? GNUNET_PQ_query_param_null ()
     : GNUNET_PQ_query_param_string (pos_key),
     GNUNET_PQ_query_param_uint32 (&pos32),
+    (NULL == session_id)
+    ? GNUNET_PQ_query_param_string ("")
+    : GNUNET_PQ_query_param_string (session_id),
+    (NULL == fulfillment_url)
+    ? GNUNET_PQ_query_param_null ()
+    : GNUNET_PQ_query_param_string (fulfillment_url),
     GNUNET_PQ_query_param_end
   };
 
@@ -71,9 +82,11 @@ TMH_PG_insert_order (void *cls,
            ",creation_time"
            ",contract_terms"
            ",pos_key"
-           ",pos_algorithm)"
+           ",pos_algorithm"
+           ",session_id"
+           ",fulfillment_url)"
            " SELECT merchant_serial,"
-           " $2, $3, $4, $5, $6, $7, $8, $9"
+           " $2, $3, $4, $5, $6, $7, $8, $9, $10, $11"
            " FROM merchant_instances"
            " WHERE merchant_id=$1");
   return GNUNET_PQ_eval_prepared_non_select (pg->conn,
diff --git a/src/backenddb/pg_insert_order.h b/src/backenddb/pg_insert_order.h
index 297d9bdf..d8c41533 100644
--- a/src/backenddb/pg_insert_order.h
+++ b/src/backenddb/pg_insert_order.h
@@ -1,6 +1,6 @@
 /*
    This file is part of TALER
-   Copyright (C) 2022 Taler Systems SA
+   Copyright (C) 2022, 2023 Taler Systems SA
 
    TALER is free software; you can redistribute it and/or modify it under the
    terms of the GNU General Public License as published by the Free Software
@@ -17,6 +17,7 @@
  * @file backenddb/pg_insert_order.h
  * @brief implementation of the insert_order function for Postgres
  * @author Iván Ávalos
+ * @author Christian Grothoff
  */
 #ifndef PG_INSERT_ORDER_H
 #define PG_INSERT_ORDER_H
@@ -31,6 +32,7 @@
  * @param cls closure
  * @param instance_id identifies the instance responsible for the order
  * @param order_id alphanumeric string that uniquely identifies the proposal
+ * @param session_id session ID associated with the order, can be NULL
  * @param h_post_data hash of the POST data for idempotency checks
  * @param pay_deadline how long does the customer have to pay for the order
  * @param claim_token token to use for access control
@@ -43,6 +45,7 @@ enum GNUNET_DB_QueryStatus
 TMH_PG_insert_order (void *cls,
                      const char *instance_id,
                      const char *order_id,
+                     const char *session_id,
                      const struct TALER_MerchantPostDataHashP *h_post_data,
                      struct GNUNET_TIME_Timestamp pay_deadline,
                      const struct TALER_ClaimTokenP *claim_token,
diff --git a/src/backenddb/pg_lookup_orders.c b/src/backenddb/pg_lookup_orders.c
index 48f1514e..63494c3a 100644
--- a/src/backenddb/pg_lookup_orders.c
+++ b/src/backenddb/pg_lookup_orders.c
@@ -1,6 +1,6 @@
 /*
    This file is part of TALER
-   Copyright (C) 2022 Taler Systems SA
+   Copyright (C) 2022,2023 Taler Systems SA
 
    TALER is free software; you can redistribute it and/or modify it under the
    terms of the GNU General Public License as published by the Free Software
@@ -17,6 +17,7 @@
  * @file backenddb/pg_lookup_orders.c
  * @brief Implementation of the lookup_orders function for Postgres
  * @author Iván Ávalos
+ * @author Christian Grothoff
  */
 #include "platform.h"
 #include <taler/taler_error_codes.h>
@@ -108,520 +109,40 @@ TMH_PG_lookup_orders (void *cls,
     .cb_cls = cb_cls
   };
   uint64_t limit = (of->delta > 0) ? of->delta : -of->delta;
-  uint8_t paid;
-  uint8_t refunded;
-  uint8_t wired;
   struct GNUNET_PQ_QueryParam params[] = {
     GNUNET_PQ_query_param_string (instance_id),
     GNUNET_PQ_query_param_uint64 (&limit),
     GNUNET_PQ_query_param_uint64 (&of->start_row),
     GNUNET_PQ_query_param_timestamp (&of->date),
-    GNUNET_PQ_query_param_auto_from_type (&paid),
-    GNUNET_PQ_query_param_auto_from_type (&refunded),
-    GNUNET_PQ_query_param_auto_from_type (&wired),
+    GNUNET_PQ_query_param_bool ((TALER_EXCHANGE_YNA_ALL == of->paid)),
+    GNUNET_PQ_query_param_bool ((TALER_EXCHANGE_YNA_YES == of->paid)),
+    GNUNET_PQ_query_param_bool ((TALER_EXCHANGE_YNA_ALL == of->refunded)),
+    GNUNET_PQ_query_param_bool ((TALER_EXCHANGE_YNA_YES == of->refunded)),
+    GNUNET_PQ_query_param_bool ((TALER_EXCHANGE_YNA_ALL == of->wired)),
+    GNUNET_PQ_query_param_bool ((TALER_EXCHANGE_YNA_YES == of->wired)),
+    GNUNET_PQ_query_param_bool (NULL == of->session_id),
+    NULL == of->session_id
+    ? GNUNET_PQ_query_param_null ()
+    : GNUNET_PQ_query_param_string (of->session_id),
+    GNUNET_PQ_query_param_bool (NULL == of->fulfillment_url),
+    NULL == of->fulfillment_url
+    ? GNUNET_PQ_query_param_null ()
+    : GNUNET_PQ_query_param_string (of->fulfillment_url),
     GNUNET_PQ_query_param_end
   };
   enum GNUNET_DB_QueryStatus qs;
   char stmt[128];
 
-  paid = (TALER_EXCHANGE_YNA_YES == of->paid);
-  refunded = (TALER_EXCHANGE_YNA_YES == of->refunded);
-  wired = (TALER_EXCHANGE_YNA_YES == of->wired);
-  /* painfully many cases..., note that "_xxx" being present in 'stmt' merely
-     means that we filter by that variable, the value we filter for is
-     computed above */
   GNUNET_snprintf (stmt,
                    sizeof (stmt),
-                   "lookup_orders_%s%s%s%s",
-                   (of->delta > 0) ? "inc" : "dec",
-                   (TALER_EXCHANGE_YNA_ALL == of->paid) ? "" : "_paid",
-                   (TALER_EXCHANGE_YNA_ALL == of->refunded) ? "" :
-                   "_refunded",
-                   (TALER_EXCHANGE_YNA_ALL == of->wired) ? "" : "_wired");
-  PREPARE (pg,
-           "lookup_orders_inc",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_inc_paid",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    NOT CAST($5 as BOOL)" /* unclaimed orders are never paid */
-           "   AND"
-           "    order_serial NOT IN"
-           "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    BOOL($5) = paid"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_inc_refunded",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    NOT CAST($6 as BOOL)"/* unclaimed orders are never refunded */
-           "   AND"
-           "    order_serial NOT IN"
-           "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    CAST($6 as BOOL) = (order_serial IN"
-           "     (SELECT order_serial "
-           "      FROM merchant_refunds))"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_inc_wired",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    NOT CAST($7 as BOOL)" /* unclaimed orders are never wired */
-           "   AND"
-           "    order_serial NOT IN"
-           "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    BOOL($7) = wired"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_inc_paid_refunded",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    NOT CAST($5 as BOOL)" /* unclaimed orders are never paid */
-           "   AND"
-           "    NOT CAST($6 as BOOL)"/* unclaimed orders are never refunded */
-           "   AND"
-           "    order_serial NOT IN"
-           "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    BOOL($5) = paid"
-           "   AND"
-           "    BOOL($6) = (order_serial IN"
-           "     (SELECT order_serial "
-           "      FROM merchant_refunds))"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_inc_paid_wired",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    NOT CAST($5 as BOOL)" /* unclaimed orders are never paid */
-           "   AND"
-           "    NOT CAST($7 as BOOL)" /* unclaimed orders are never wired */
-           "   AND"
-           "    order_serial NOT IN"
-           "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    BOOL($5) = paid"
-           "   AND"
-           "    BOOL($7) = wired"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_inc_refunded_wired",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    NOT CAST($6 as BOOL)"/* unclaimed orders are never refunded */
-           "   AND"
-           "    NOT CAST($7 as BOOL)" /* unclaimed orders are never wired */
-           "   AND"
-           "    order_serial NOT IN"
-           "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    BOOL($6) = (order_serial IN"
-           "     (SELECT order_serial "
-           "      FROM merchant_refunds))"
-           "   AND"
-           "    BOOL($7) = wired"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_inc_paid_refunded_wired",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    NOT CAST($5 as BOOL)" /* unclaimed orders are never paid */
-           "   AND"
-           "    NOT CAST($6 as BOOL)"/* unclaimed orders are never refunded */
-           "   AND"
-           "    NOT CAST($7 as BOOL)" /* unclaimed orders are never wired */
-           "   AND"
-           "    order_serial NOT IN"
-           "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial > $3"
-           "   AND"
-           "    creation_time > $4"
-           "   AND"
-           "    BOOL($5) = paid"
-           "   AND"
-           "    BOOL($6) = (order_serial IN"
-           "     (SELECT order_serial "
-           "      FROM merchant_refunds))"
-           "   AND"
-           "    BOOL($7) = wired"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2)"
-           " ORDER BY order_serial ASC"
-           " LIMIT $2");
+                   "lookup_orders_%s",
+                   (of->delta > 0) ? "inc" : "dec");
   PREPARE (pg,
            "lookup_orders_dec",
            "(SELECT"
            " order_id"
            ",order_serial"
            ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2)"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_dec_paid",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           "   AND"
-           "    NOT CAST($5 as BOOL)" /* unclaimed orders are never paid */
-           "   AND"
-           "    order_serial NOT IN"
-           "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial DESC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           "   AND"
-           "    BOOL($5) = paid"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2)"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_dec_refunded",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
            " FROM merchant_orders"
            " WHERE merchant_orders.merchant_serial="
            "     (SELECT merchant_serial "
@@ -631,12 +152,20 @@ TMH_PG_lookup_orders (void *cls,
            "    order_serial < $3"
            "   AND"
            "    creation_time < $4"
-           "   AND"
-           "    NOT CAST($6 as BOOL)"/* unclaimed orders are never refunded */
+           "   AND ($5 OR "
+           "    NOT CAST($6 as BOOL))" /* unclaimed orders are never paid */
+           "   AND ($7 OR "
+           "    NOT CAST($8 as BOOL))"/* unclaimed orders are never refunded */
+           "   AND ($9 OR "
+           "    NOT CAST($10 as BOOL))" /* unclaimed orders are never wired */
            "   AND"
            "    order_serial NOT IN"
            "     (SELECT order_serial"
            "      FROM merchant_contract_terms)" /* only select unclaimed orders */
+           "   AND ($11 OR "
+           "     ($12 = session_id))"
+           "   AND ($13 OR "
+           "     ($14 = fulfillment_url))"
            " ORDER BY order_serial DESC"
            " LIMIT $2)"
            "UNION " /* union ensures elements are distinct! */
@@ -644,8 +173,6 @@ TMH_PG_lookup_orders (void *cls,
            " order_id"
            ",order_serial"
            ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
            " FROM merchant_contract_terms"
            " WHERE merchant_contract_terms.merchant_serial="
            "     (SELECT merchant_serial "
@@ -655,214 +182,25 @@ TMH_PG_lookup_orders (void *cls,
            "    order_serial < $3"
            "   AND"
            "    creation_time < $4"
-           "   AND"
-           "    BOOL($6) = (order_serial IN"
+           "   AND ($5 OR "
+           "    (BOOL($6) = paid))"
+           "   AND ($7 OR "
+           "    (BOOL($8) = (order_serial IN"
            "     (SELECT order_serial "
-           "      FROM merchant_refunds))"
+           "      FROM merchant_refunds))))"
+           "   AND ($9 OR"
+           "     (BOOL($10) = wired))"
+           "   AND ($11 OR "
+           "     ($12 = session_id))"
+           "   AND ($13 OR "
+           "     ($14 = fulfillment_url))"
            " ORDER BY order_serial DESC"
            " LIMIT $2)"
            " ORDER BY order_serial DESC"
            " LIMIT $2");
+  
   PREPARE (pg,
-           "lookup_orders_dec_wired",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           "   AND"
-           "    NOT CAST($7 as BOOL)" /* unclaimed orders are never wired */
-           "   AND"
-           "    order_serial NOT IN"
-           "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial DESC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           "   AND"
-           "    BOOL($7) = wired"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2)"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_dec_paid_refunded",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           "   AND"
-           "    NOT CAST($5 as BOOL)" /* unclaimed orders are never paid */
-           "   AND"
-           "    NOT CAST($6 as BOOL)"/* unclaimed orders are never refunded */
-           "   AND"
-           "    order_serial NOT IN"
-           "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial DESC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($7 as BOOL)" /* otherwise $7 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           "   AND"
-           "    BOOL($5) = paid"
-           "   AND"
-           "    BOOL($6) = (order_serial IN"
-           "     (SELECT order_serial "
-           "      FROM merchant_refunds))"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2)"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_dec_paid_wired",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           "   AND"
-           "    NOT CAST($5 as BOOL)" /* unclaimed orders are never paid */
-           "   AND"
-           "    NOT CAST($7 as BOOL)" /* unclaimed orders are never wired */
-           "   AND"
-           "    order_serial NOT IN"
-           "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial DESC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($6 as BOOL)" /* otherwise $6 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           "   AND"
-           "    BOOL($5) = paid"
-           "   AND"
-           "    BOOL($7) = wired"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2)"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_dec_refunded_wired",
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           " FROM merchant_orders"
-           " WHERE merchant_orders.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           "   AND"
-           "    NOT CAST($6 as BOOL)"/* unclaimed orders are never refunded */
-           "   AND"
-           "    NOT CAST($7 as BOOL)" /* unclaimed orders are never wired */
-           "   AND"
-           "    order_serial NOT IN"
-           "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial DESC"
-           " LIMIT $2)"
-           "UNION " /* union ensures elements are distinct! */
-           "(SELECT"
-           " order_id"
-           ",order_serial"
-           ",creation_time"
-           ",CAST($5 as BOOL)" /* otherwise $5 is unused and Postgres unhappy */
-           " FROM merchant_contract_terms"
-           " WHERE merchant_contract_terms.merchant_serial="
-           "     (SELECT merchant_serial "
-           "        FROM merchant_instances"
-           "        WHERE merchant_id=$1)"
-           "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           "   AND"
-           "    BOOL($6) = (order_serial IN"
-           "     (SELECT order_serial "
-           "      FROM merchant_refunds))"
-           "   AND"
-           "    BOOL($7) = wired"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2)"
-           " ORDER BY order_serial DESC"
-           " LIMIT $2");
-  PREPARE (pg,
-           "lookup_orders_dec_paid_refunded_wired",
+           "lookup_orders_inc",
            "(SELECT"
            " order_id"
            ",order_serial"
@@ -873,20 +211,24 @@ TMH_PG_lookup_orders (void *cls,
            "        FROM merchant_instances"
            "        WHERE merchant_id=$1)"
            "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           "   AND"
-           "    NOT CAST($5 as BOOL)" /* unclaimed orders are never paid */
-           "   AND"
-           "    NOT CAST($6 as BOOL)"/* unclaimed orders are never refunded */
-           "   AND"
-           "    NOT CAST($7 as BOOL)" /* unclaimed orders are never wired */
+           "    order_serial > $3"
            "   AND"
-           "    order_serial NOT IN"
+           "    creation_time > $4"
+           "   AND ($5 OR "
+           "    NOT CAST($6 as BOOL))" /* unclaimed orders are never paid */
+           "   AND ($7 OR "
+           "    NOT CAST($8 as BOOL))"/* unclaimed orders are never refunded */
+           "   AND ($9 OR "
+           "    NOT CAST($10 as BOOL))" /* unclaimed orders are never wired */
+           "   AND"
+           "    (order_serial NOT IN"
            "     (SELECT order_serial"
-           "      FROM merchant_contract_terms)" /* only select unclaimed orders */
-           " ORDER BY order_serial DESC"
+           "      FROM merchant_contract_terms))" /* only select unclaimed orders */
+           "   AND ($11 OR "
+           "     ($12 = session_id))"
+           "   AND ($13 OR "
+           "     ($14 = fulfillment_url))"
+           " ORDER BY order_serial ASC"
            " LIMIT $2)"
            "UNION " /* union ensures elements are distinct! */
            "(SELECT"
@@ -899,22 +241,26 @@ TMH_PG_lookup_orders (void *cls,
            "        FROM merchant_instances"
            "        WHERE merchant_id=$1)"
            "   AND"
-           "    order_serial < $3"
-           "   AND"
-           "    creation_time < $4"
-           "   AND"
-           "    BOOL($5) = paid"
+           "    order_serial > $3"
            "   AND"
-           "    BOOL($6) = (order_serial IN"
+           "    creation_time > $4"
+           "   AND ($5 OR "
+           "    (BOOL($6) = paid))"
+           "   AND ($7 OR "
+           "    (BOOL($8) = (order_serial IN"
            "     (SELECT order_serial "
-
-           "      FROM merchant_refunds))"
-           "   AND"
-           "    BOOL($7) = wired"
-           " ORDER BY order_serial DESC"
+           "      FROM merchant_refunds))))"
+           "   AND ($9 OR"
+           "    (BOOL($10) = wired))"
+           "   AND ($11 OR "
+           "     ($12 = session_id))"
+           "   AND ($13 OR "
+           "     ($14 = fulfillment_url))"
+           " ORDER BY order_serial ASC"
            " LIMIT $2)"
-           " ORDER BY order_serial DESC"
+           " ORDER BY order_serial ASC"
            " LIMIT $2");
+  
   qs = GNUNET_PQ_eval_prepared_multi_select (pg->conn,
                                              stmt,
                                              params,
diff --git a/src/backenddb/test-merchantdb-postgres.conf b/src/backenddb/test-merchantdb-postgres.conf
index 03bbc35a..5ddb86d8 100644
--- a/src/backenddb/test-merchantdb-postgres.conf
+++ b/src/backenddb/test-merchantdb-postgres.conf
@@ -6,7 +6,7 @@ CONFIG = postgres:///talercheck
 
 # Where are the SQL files to setup our tables?
 # Important: this MUST end with a "/"!
-SQL_DIR = $DATADIR/sql/merchant/
+SQL_DIR = ${DATADIR}sql/merchant/
 
 [taler]
 CURRENCY = "EUR"
\ No newline at end of file
diff --git a/src/backenddb/test_merchantdb.c b/src/backenddb/test_merchantdb.c
index 0ca3e57c..3cbe0467 100644
--- a/src/backenddb/test_merchantdb.c
+++ b/src/backenddb/test_merchantdb.c
@@ -1328,6 +1328,7 @@ test_insert_order (const struct InstanceData *instance,
                          plugin->insert_order (plugin->cls,
                                                instance->instance.id,
                                                order->id,
+                                               NULL, /* session_id */
                                                &h_post,
                                                order->pay_deadline,
                                                &order->claim_token,
diff --git a/src/include/taler_merchant_service.h b/src/include/taler_merchant_service.h
index 0abef2a8..e8aad3d0 100644
--- a/src/include/taler_merchant_service.h
+++ b/src/include/taler_merchant_service.h
@@ -29,6 +29,11 @@
 #include <gnunet/gnunet_curl_lib.h>
 #include <jansson.h>
 
+/**
+ * Library version (in hex) for compatibility tests.
+ */
+#define TALER_MERCHANT_SERVICE_VERSION 0x00090400
+
 
 /**
  * General information about the HTTP response we obtained
@@ -1979,6 +1984,43 @@ TALER_MERCHANT_orders_post2 (
 
 
 /**
+ * POST to /orders at the backend to setup an order and obtain
+ * the order ID (which may have been set by the front-end).
+ *
+ * @param ctx execution context
+ * @param backend_url URL of the backend
+ * @param order basic information about this purchase, to be extended by the backend
+ * @param session_id session ID to set for the order
+ * @param refund_delay how long can refunds happen for this order; 0 to use
+ *             absolute value from contract (or not allow refunds).
+ * @param payment_target desired payment target identifier (to select merchant bank details)
+ * @param inventory_products_length length of the @a inventory_products array
+ * @param inventory_products products to add to the order from the inventory
+ * @param uuids_length length of the @a uuids array
+ * @param uuids array of UUIDs with locks on @a inventory_products
+ * @param create_token whether to create a claim token
+ * @param cb the callback to call when a reply for this request is available
+ * @param cb_cls closure for @a cb
+ * @return a handle for this request, NULL on error
+ */
+struct TALER_MERCHANT_PostOrdersHandle *
+TALER_MERCHANT_orders_post3 (
+  struct GNUNET_CURL_Context *ctx,
+  const char *backend_url,
+  const json_t *order,
+  const char *session_id,
+  struct GNUNET_TIME_Relative refund_delay,
+  const char *payment_target,
+  unsigned int inventory_products_length,
+  const struct TALER_MERCHANT_InventoryProduct inventory_products[],
+  unsigned int uuids_length,
+  const char *uuids[static uuids_length],
+  bool create_token,
+  TALER_MERCHANT_PostOrdersCallback cb,
+  void *cb_cls);
+
+
+/**
  * Cancel a POST /orders request.  This function cannot be used
  * on a request handle if a response is already served for it.
  *
@@ -2138,6 +2180,43 @@ TALER_MERCHANT_orders_get2 (
 
 
 /**
+ * Make a GET /orders request with more filters.
+ *
+ * @param ctx the context
+ * @param backend_url HTTP base URL for the backend
+ * @param paid filter on payment status
+ * @param refunded filter on refund status
+ * @param wired filter on wire transfer status
+ * @param session_id filter by session ID
+ * @param fulfillment_url filter by fulfillment URL
+ * @param date range limit by date
+ * @param start_row range limit by order table row
+ * @param delta range from which @a date and @a start_row apply, positive
+ *              to return delta items after the given limit(s), negative to
+ *              return delta items before the given limit(s)
+ * @param timeout how long to wait (long polling) of zero results match the query
+ * @param cb function to call with the backend's inventory information
+ * @param cb_cls closure for @a cb
+ * @return the request handle; NULL upon error
+ */
+struct TALER_MERCHANT_OrdersGetHandle *
+TALER_MERCHANT_orders_get3 (
+  struct GNUNET_CURL_Context *ctx,
+  const char *backend_url,
+  enum TALER_EXCHANGE_YesNoAll paid,
+  enum TALER_EXCHANGE_YesNoAll refunded,
+  enum TALER_EXCHANGE_YesNoAll wired,
+  const char *session_id,
+  const char *fulfillment_url,
+  struct GNUNET_TIME_Timestamp date,
+  uint64_t start_row,
+  int64_t delta,
+  struct GNUNET_TIME_Relative timeout,
+  TALER_MERCHANT_OrdersGetCallback cb,
+  void *cb_cls);
+
+
+/**
  * Cancel GET /orders operation.
  *
  * @param[in] pgh operation to cancel
diff --git a/src/include/taler_merchantdb_plugin.h b/src/include/taler_merchantdb_plugin.h
index 7d589123..8aea7aac 100644
--- a/src/include/taler_merchantdb_plugin.h
+++ b/src/include/taler_merchantdb_plugin.h
@@ -544,6 +544,16 @@ struct TALER_MERCHANTDB_PendingWebhookDetails
 struct TALER_MERCHANTDB_OrderFilter
 {
   /**
+   * Filter orders by this fulfillment URL.
+   */
+  const char *fulfillment_url;
+
+  /**
+   * Filter orders by this session ID.
+   */
+  const char *session_id;
+
+  /**
    * Filter by payment status.
    */
   enum TALER_EXCHANGE_YesNoAll paid;
@@ -1733,6 +1743,7 @@ struct TALER_MERCHANTDB_Plugin
    * @param cls closure
    * @param instance_id identifies the instance responsible for the order
    * @param order_id alphanumeric string that uniquely identifies the order
+   * @param session_id session ID for the order
    * @param h_post_data hash of the POST data for idempotency checks
    * @param pay_deadline how long does the customer have to pay for the order
    * @param claim_token token to use for access control
@@ -1745,6 +1756,7 @@ struct TALER_MERCHANTDB_Plugin
   (*insert_order)(void *cls,
                   const char *instance_id,
                   const char *order_id,
+                  const char *session_id,
                   const struct TALER_MerchantPostDataHashP *h_post_data,
                   struct GNUNET_TIME_Timestamp pay_deadline,
                   const struct TALER_ClaimTokenP *claim_token,
diff --git a/src/lib/merchant_api_get_config.c b/src/lib/merchant_api_get_config.c
index 93b7c863..1b289a9a 100644
--- a/src/lib/merchant_api_get_config.c
+++ b/src/lib/merchant_api_get_config.c
@@ -34,12 +34,12 @@
  * Which version of the Taler protocol is implemented
  * by this library?  Used to determine compatibility.
  */
-#define MERCHANT_PROTOCOL_CURRENT 5
+#define MERCHANT_PROTOCOL_CURRENT 6
 
 /**
- * How many configs are we backwards compatible with?
+ * How many configs are we backwards-compatible with?
  */
-#define MERCHANT_PROTOCOL_AGE 0
+#define MERCHANT_PROTOCOL_AGE 1
 
 
 /**
diff --git a/src/lib/merchant_api_get_orders.c b/src/lib/merchant_api_get_orders.c
index 966ecb15..f79821db 100644
--- a/src/lib/merchant_api_get_orders.c
+++ b/src/lib/merchant_api_get_orders.c
@@ -236,6 +236,39 @@ TALER_MERCHANT_orders_get2 (
   TALER_MERCHANT_OrdersGetCallback cb,
   void *cb_cls)
 {
+  return TALER_MERCHANT_orders_get3 (
+    ctx,
+    backend_url,
+    paid,
+    refunded,
+    wired,
+    NULL,
+    NULL,
+    date,
+    start_row,
+    delta,
+    timeout,
+    cb,
+    cb_cls);
+}
+
+
+struct TALER_MERCHANT_OrdersGetHandle *
+TALER_MERCHANT_orders_get3 (
+  struct GNUNET_CURL_Context *ctx,
+  const char *backend_url,
+  enum TALER_EXCHANGE_YesNoAll paid,
+  enum TALER_EXCHANGE_YesNoAll refunded,
+  enum TALER_EXCHANGE_YesNoAll wired,
+  const char *session_id,
+  const char *fulfillment_url,
+  struct GNUNET_TIME_Timestamp date,
+  uint64_t start_row,
+  int64_t delta,
+  struct GNUNET_TIME_Relative timeout,
+  TALER_MERCHANT_OrdersGetCallback cb,
+  void *cb_cls)
+{
   struct TALER_MERCHANT_OrdersGetHandle *ogh;
   CURL *eh;
   unsigned int timeout_ms = timeout.rel_value_us
@@ -255,6 +288,8 @@ TALER_MERCHANT_orders_get2 (
   /* build ogh->url with the various optional arguments */
   {
     char *dstr;
+    char *fec = NULL;
+    char *sid = NULL;
     bool have_date;
     bool have_srow;
     char cbuf[30];
@@ -273,6 +308,14 @@ TALER_MERCHANT_orders_get2 (
                      sizeof (cbuf),
                      "%llu",
                      (unsigned long long) start_row);
+    if (NULL != session_id)
+      (void) GNUNET_STRINGS_urlencode (session_id,
+                                       strlen (session_id),
+                                       &sid);
+    if (NULL != fulfillment_url)
+      (void) GNUNET_STRINGS_urlencode (fulfillment_url,
+                                       strlen (fulfillment_url),
+                                       &fec);
     dstr = GNUNET_strdup (GNUNET_TIME_timestamp2s (date));
     if (delta > 0)
     {
@@ -314,8 +357,14 @@ TALER_MERCHANT_orders_get2 (
                                (0 != timeout_ms)
                                ? tbuf
                                : NULL,
+                               "session_id",
+                               sid,
+                               "fulfillment_url",
+                               fec,
                                NULL);
     GNUNET_free (dstr);
+    GNUNET_free (sid);
+    GNUNET_free (fec);
   }
   if (NULL == ogh->url)
   {
diff --git a/src/lib/merchant_api_post_orders.c b/src/lib/merchant_api_post_orders.c
index fc37a439..56881133 100644
--- a/src/lib/merchant_api_post_orders.c
+++ b/src/lib/merchant_api_post_orders.c
@@ -139,6 +139,39 @@ TALER_MERCHANT_orders_post2 (
   TALER_MERCHANT_PostOrdersCallback cb,
   void *cb_cls)
 {
+  return TALER_MERCHANT_orders_post3 (
+    ctx,
+    backend_url,
+    order,
+    NULL, /* session ID */
+    refund_delay,
+    payment_target,
+    inventory_products_length,
+    inventory_products,
+    uuids_length,
+    uuids,
+    create_token,
+    cb,
+    cb_cls);
+}
+
+
+struct TALER_MERCHANT_PostOrdersHandle *
+TALER_MERCHANT_orders_post3 (
+  struct GNUNET_CURL_Context *ctx,
+  const char *backend_url,
+  const json_t *order,
+  const char *session_id,
+  struct GNUNET_TIME_Relative refund_delay,
+  const char *payment_target,
+  unsigned int inventory_products_length,
+  const struct TALER_MERCHANT_InventoryProduct inventory_products[],
+  unsigned int uuids_length,
+  const char *uuids[static uuids_length],
+  bool create_token,
+  TALER_MERCHANT_PostOrdersCallback cb,
+  void *cb_cls)
+{
   struct TALER_MERCHANT_PostOrdersHandle *po;
   json_t *req;
   CURL *eh;
@@ -154,6 +187,9 @@ TALER_MERCHANT_orders_post2 (
     GNUNET_JSON_pack_object_incref ("order",
                                     (json_t *) order),
     GNUNET_JSON_pack_allow_null (
+      GNUNET_JSON_pack_string ("session_id",
+                               session_id)),
+    GNUNET_JSON_pack_allow_null (
       GNUNET_JSON_pack_string ("payment_target",
                                payment_target)));
   if (0 != refund_delay.rel_value_us)