Pay order only after it been placed and validated

Question

I need to create a following workflow for the store checkout:

• The user adds a product(s) to a cart.
• The user goes to checkout.
• During checkout, the user can register or authenticate on site. This is required and there is not possible to checkout as a guest.
• Then it goes to the pane with contact information and payment information (? not sure do I need it at this step).
• Then the user sees the last step of checkout — review.
• Then the order is placed.

What I need is to send this order to validation by the store manager to ensure the product can be crafted or already exists.

I thought about CheckoutFlow plugin at first, but this does not exactly solve the problem. If I set order state in onStepChange() differ from 'place' the order is messed. There is no order ID on complete step and order as well listed in cart.

I also thought about special CheckoutPane that blocks further checkout before the manager is change order status. But this also not looks like a good idea, and limit order numbers to the single.

The obvious solution here is let the user finish checkout as soon as possible, then he got the message that order is only set to validate now. And only after additional manual actions from the store manager, there will be possible to pay for the order (it can took days, so there will be additional emails).

I think I will use custom .workflows.yml for further order processing. When the manager is set status "validated" next to it will be a "payment" state. During this state, I want to show payment form on the user order page (entity.commerce_order.user_view) or maybe better create a special route with order_id and generate form there (in this case it also will be possible to send this link in the notification email).

Also, I will add EventListener for commerce_order.order.paid to change state from "payment" to "fulfillment".

Maybe there is a better solution and I don't see it? Did I choose the right direction to solve the issue? Are there any drawbacks to manage payments manually or behaviors I need to take into account?

UPD

I didn't mention in the original post but it seems to be very important in that case - the order can be edited after or during validation in some cases, so total amount will change and as I understand, previously authenticated payment with gateway will be invalid.

Answer 1

The standard approach here is to use the payment information to create an authorization for as much as you will need assuming the order is to be placed. If it's for $100 of custom merchandise, you authorize a $100 charge on the customer's credit card and then capture it after manual review. This is very typical and in many places a requirement - the idea being you can only authorize payment during checkout and capture it once the order has been shipped.

How the authorization + prior authorization capture flow works will depend on your payment gateway and the methods of payment you're accepting, but most should support this. (I don't have direct experience with Russian payment gateways if you're developing this for a Russian merchant, though.)

In your case, you might just include a message on the checkout form that the customer will see the payment authorization but will not have funds debited from their account until the order has been manually approved by an administrator. There is no automation that I'm aware of in Commerce 2.x core for capturing prior authorizations on specific state transitions, but that's something you should be able to include in your site's customizations module. Again, the exact process there will be very dependent on your payment gateway's API.