TL;DR

Got Salesforce customised by an external company, took over the code and wanted to cry.

So my company decided to get a new crm for sales with contract generation and a whole lot of fluff. Specs included an easy to implement API to connect to our in-house software and an easy to adjust contract Wizard.

After month of checking various companies the CEO finally settled on...
Drumroll
The cheapest German based company.
Turns out the only part that is based in Germany is the sales department, development is based in Poland which made for interesting times during implementation because of the language barrier that comes with non native english speakers.

We as in our development department for told that we wouldn't need to worry about the solution because it would all be developed and maintained by the new company. As we are fairly small that was more then welcome.

Fast forward to integration day. No docs for the API available, contract Wizard is hardcoded, bunch of errors and inconsistencies. Get tickets for them.
Ok we can deal with this. Just tell the ticket writer he needs to address the problems with the external. Yep, doesn't work. External fixes bugs and introduces then elsewhere.
Fml. Ok I'll take a look into the code. Ugh, Java, I hate that shit but at least I don't need to worry about all the fluff, just the code, so it's ok.
No repository present, code is developed in the Dev environment and pushed to prod. Ugly but works. Code comes with a lot of functions but only one real class called "CommonUtilities" ... even the web API is defined in there. Meanwhile my colleague throws out the need for the API because we will just directly tie to SOQL. I'll let's check what's going on here, nice you reused Lead/Account/Contact for the branch offices of companies as well...
Is not like Salesforce has a bunch of logic tied to these objects...
Nice the required implementation of an automatic holiday import is not even there, just a custom object populated with this year's data...

Tell CEO how badly all of this was handled. Nice note this dumpster fire is our new in-house project because CEO cancelled the contract with the external.

Ok we can deal with this, let's set up a repo, define the CI/CD and get the extensions for vscode. Nice now this all makes sense. Fix all bugs and reimplement the contract Wizard using custom objects that sales can change so the contract is actually easily customizable by a non dev. Implement branches as their own object to avoid opportunities, triggers and the likes to be executed for them.
Took a whole day. Why did these 2000 lines of code that was shipped to us take 3 month to implement?

Lesson learned: never trust an external to just do a good job.
New rule implemented by company to always have a Dev check in regular intervals on projects handled by externals for standards and overall logic

10k down the drain for what amounted to 2 weeks tops (one dev) if we had handled the implementation of Salesforce and all the requirements in-house

Why do people design web apis where the way you submit your authorization is via a custom header?

Especially when the authorization is literally a token?

Am I ingesting something special?