B2B purchasing roles, order limits and order approval for company accounts

src/Business/Grand.Business.Checkout/Commands/Handlers/Orders/CheckOrderStatusCommandHandler.cs

@@ -27,6 +27,10 @@ public async Task<bool> Handle(CheckOrderStatusCommand request, CancellationToke
     {
         ArgumentNullException.ThrowIfNull(request.Order);
 
+        //an order waiting for an approval stays as it is until it is decided
+        if (request.Order.OrderStatusId == (int)OrderStatusSystem.AwaitingApproval)
+            return true;
+
         if (request.Order.PaymentStatusId == PaymentStatus.Paid && !request.Order.PaidDateUtc.HasValue)
         {
             //ensure that paid date is set

src/Business/Grand.Business.Checkout/Commands/Handlers/Orders/OrderNotificationCommandHandler.cs

@@ -43,55 +43,59 @@ public async Task Handle(OrderNotificationCommand request, CancellationToken can
 
         try
         {
-            if (request.OriginalCustomerIfImpersonated != null)
+            if (request.OriginalCustomerIfImpersonated != null && request.AddOrderPlacedNote)
                 //this order is placed by a store administrator impersonating a customer
                 await _orderService.InsertOrderNote(new OrderNote {
                     Note =
                         $"Order placed by a store owner ('{request.OriginalCustomerIfImpersonated.Email}'. ID = {request.OriginalCustomerIfImpersonated.Id}) impersonating the customer.",
                     DisplayToCustomer = false,
                     OrderId = request.Order.Id
                 });
-            else
+            else if (request.AddOrderPlacedNote)
                 await _orderService.InsertOrderNote(new OrderNote {
                     Note = "Order placed",
                     DisplayToCustomer = false,
                     OrderId = request.Order.Id
                 });
 
             //send email notifications
-            await _orderMessageProviderService.SendOrderPlacedStoreOwnerMessage(request.Order, request.Customer,
-                _languageSettings.DefaultAdminLanguageId, request.Host);
+            if (request.NotifyStoreOwnerAndVendors)
+                await _orderMessageProviderService.SendOrderPlacedStoreOwnerMessage(request.Order, request.Customer,
+                    _languageSettings.DefaultAdminLanguageId, request.Host);
 
-            string orderPlacedAttachmentFilePath = string.Empty, orderPlacedAttachmentFileName = string.Empty;
-            var orderPlacedAttachments = new List<string>();
-
-            try
-            {
-                orderPlacedAttachmentFilePath =
-                    _orderSettings.AttachPdfInvoiceToOrderPlacedEmail && !_orderSettings.AttachPdfInvoiceToBinary
-                        ? await _pdfService.PrintOrderToPdf(request.Order, request.Order.CustomerLanguageId)
-                        : null;
-                orderPlacedAttachmentFileName =
-                    _orderSettings.AttachPdfInvoiceToOrderPlacedEmail && !_orderSettings.AttachPdfInvoiceToBinary
-                        ? "order.pdf"
-                        : null;
-                orderPlacedAttachments = _orderSettings.AttachPdfInvoiceToOrderPlacedEmail &&
-                                         _orderSettings.AttachPdfInvoiceToBinary
-                    ? [
-                        await _pdfService.SaveOrderToBinary(request.Order, request.Order.CustomerLanguageId)
-                    ]
-                    : [];
-            }
-            catch (Exception ex)
+            if (request.NotifyCustomer)
             {
-                _logger.LogError(ex, "Error - order placed attachment file {OrderOrderNumber}", request.Order.OrderNumber);
-            }
+                string orderPlacedAttachmentFilePath = string.Empty, orderPlacedAttachmentFileName = string.Empty;
+                var orderPlacedAttachments = new List<string>();
+
+                try
+                {
+                    orderPlacedAttachmentFilePath =
+                        _orderSettings.AttachPdfInvoiceToOrderPlacedEmail && !_orderSettings.AttachPdfInvoiceToBinary
+                            ? await _pdfService.PrintOrderToPdf(request.Order, request.Order.CustomerLanguageId)
+                            : null;
+                    orderPlacedAttachmentFileName =
+                        _orderSettings.AttachPdfInvoiceToOrderPlacedEmail && !_orderSettings.AttachPdfInvoiceToBinary
+                            ? "order.pdf"
+                            : null;
+                    orderPlacedAttachments = _orderSettings.AttachPdfInvoiceToOrderPlacedEmail &&
+                                             _orderSettings.AttachPdfInvoiceToBinary
+                        ? [
+                            await _pdfService.SaveOrderToBinary(request.Order, request.Order.CustomerLanguageId)
+                        ]
+                        : [];
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogError(ex, "Error - order placed attachment file {OrderOrderNumber}", request.Order.OrderNumber);
+                }
 
-            await _orderMessageProviderService.SendOrderPlacedCustomerMessage(request.Order, request.Customer,
-                request.Order.CustomerLanguageId, orderPlacedAttachmentFilePath, orderPlacedAttachmentFileName,
-                orderPlacedAttachments, request.Host);
+                await _orderMessageProviderService.SendOrderPlacedCustomerMessage(request.Order, request.Customer,
+                    request.Order.CustomerLanguageId, orderPlacedAttachmentFilePath, orderPlacedAttachmentFileName,
+                    orderPlacedAttachments, request.Host);
+            }
 
-            if (request.Order.OrderItems.Any(x => !string.IsNullOrEmpty(x.VendorId)))
+            if (request.NotifyStoreOwnerAndVendors && request.Order.OrderItems.Any(x => !string.IsNullOrEmpty(x.VendorId)))
             {
                 var vendors = await _mediator.Send(new GetVendorsInOrderQuery { Order = request.Order });
                 foreach (var vendor in vendors)

src/Business/Grand.Business.Checkout/Commands/Handlers/Orders/PlaceOrderCommandHandler.cs

@@ -47,6 +47,8 @@ public class PlaceOrderCommandHandler : IRequestHandler<PlaceOrderCommand, Place
     private readonly ILanguageService _languageService;
     private readonly ILogger<PlaceOrderCommandHandler> _logger;
     private readonly IMediator _mediator;
+    private readonly IOrderApprovalService _orderApprovalService;
+    private readonly ITranslationService _translationService;
     private readonly ICatalogMessageProviderService _catalogMessageProviderService;
     private readonly IOrderService _orderService;
     private readonly OrderSettings _orderSettings;
@@ -100,6 +102,8 @@ public PlaceOrderCommandHandler(
         IAuctionService auctionService,
         ICountryService countryService,
         IShoppingCartValidator shoppingCartValidator,
+        IOrderApprovalService orderApprovalService,
+        ITranslationService translationService,
         ShippingSettings shippingSettings,
         ShoppingCartSettings shoppingCartSettings,
         PaymentSettings paymentSettings,
@@ -136,6 +140,8 @@ public PlaceOrderCommandHandler(
         _auctionService = auctionService;
         _countryService = countryService;
         _shoppingCartValidator = shoppingCartValidator;
+        _orderApprovalService = orderApprovalService;
+        _translationService = translationService;
         _shippingSettings = shippingSettings;
         _shoppingCartSettings = shoppingCartSettings;
         _paymentSettings = paymentSettings;
@@ -163,6 +169,16 @@ public async Task<PlaceOrderResult> Handle(PlaceOrderCommand command, Cancellati
             if (result.Errors.Any())
                 return result;
 
+            //an order over the customer's limit is placed awaiting an approval, with an allowed payment method only
+            var approval = await _orderApprovalService.RequiresApproval(details.Cart, details.Context);
+            details.ApprovalRequired = approval.Required;
+            if (details.ApprovalRequired && !_orderApprovalService.IsPaymentMethodAllowed(details.PaymentMethodSystemName))
+            {
+                result.AddError(_translationService.GetResource("Checkout.OrderApproval.PaymentMethodNotAllowed",
+                    command.Language.Id));
+                return result;
+            }
+
             #region Payment workflow
 
             var processPayment = await PrepareProcessPayment(details);
@@ -194,7 +210,8 @@ await _mediator.Send(new OrderNotificationCommand {
                     Order = result.PlacedOrder,
                     Customer = details.Customer,
                     OriginalCustomerIfImpersonated = command.OriginalCustomerIfImpersonated,
-                    Host = command.Host
+                    Host = command.Host,
+                    NotifyStoreOwnerAndVendors = !details.ApprovalRequired
                 }, cancellationToken);
 
                 //check order status
@@ -203,7 +220,8 @@ await _mediator.Send(new OrderNotificationCommand {
                 //raise event       
                 await _mediator.Publish(new OrderPlacedEvent(result.PlacedOrder), cancellationToken);
 
-                if (result.PlacedOrder.PaymentStatusId == PaymentStatus.Paid)
+                //an order awaiting approval is processed as paid once it is approved (store owner and vendors hear of it then)
+                if (!details.ApprovalRequired && result.PlacedOrder.PaymentStatusId == PaymentStatus.Paid)
                     await _mediator.Send(new ProcessOrderPaidCommand { Order = result.PlacedOrder }, cancellationToken);
 
                 #endregion
@@ -929,7 +947,9 @@ protected virtual Order PrepareOrderHeader(PaymentTransaction paymentTransaction
             CurrencyRate = details.CurrencyRate,
             Rate = details.Currency.Rate,
             AffiliateId = details.AffiliateId,
-            OrderStatusId = (int)OrderStatusSystem.Pending,
+            OrderStatusId = details.ApprovalRequired
+                ? (int)OrderStatusSystem.AwaitingApproval
+                : (int)OrderStatusSystem.Pending,
             PaymentMethodSystemName = paymentTransaction.PaymentMethodSystemName,
             PaymentOptionAttribute =
                 details.Customer.GetUserFieldFromEntity<string>(SystemCustomerFieldNames.PaymentOptionAttribute,

src/Business/Grand.Business.Checkout/Commands/Handlers/Orders/ProcessOrderPaidCommandHandler.cs

@@ -49,6 +49,10 @@ protected virtual async Task ProcessOrderPaid(Order order)
     {
         ArgumentNullException.ThrowIfNull(order);
 
+        //an order waiting for an approval is processed as paid once it is approved, not before
+        if (order.OrderStatusId == (int)OrderStatusSystem.AwaitingApproval)
+            return;
+
         //raise event
         await _mediator.Publish(new OrderPaidEvent(order));
 

src/Business/Grand.Business.Checkout/Events/Orders/OrderCancelledOrderApprovalHandler.cs

@@ -0,0 +1,46 @@
+using Grand.Business.Core.Events.Checkout.Orders;
+using Grand.Business.Core.Interfaces.Checkout.Orders;
+using Grand.Domain.Orders;
+using Grand.Mediator;
+using Microsoft.Extensions.Logging;
+
+namespace Grand.Business.Checkout.Events.Orders;
+
+/// <summary>
+///     Closes the approval request of an order cancelled before anyone decided it
+/// </summary>
+public class OrderCancelledOrderApprovalHandler : INotificationHandler<OrderCancelledEvent>
+{
+    private readonly ILogger<OrderCancelledOrderApprovalHandler> _logger;
+    private readonly IOrderApprovalService _orderApprovalService;
+
+    public OrderCancelledOrderApprovalHandler(IOrderApprovalService orderApprovalService,
+        ILogger<OrderCancelledOrderApprovalHandler> logger)
+    {
+        _orderApprovalService = orderApprovalService;
+        _logger = logger;
+    }
+
+    public async Task Handle(OrderCancelledEvent notification, CancellationToken cancellationToken)
+    {
+        var order = notification.Order;
+        try
+        {
+            // a decision or a withdrawal cancels the order first and then saves its own status over this one
+            var approval = await _orderApprovalService.GetByOrderId(order.Id);
+            if (approval is not { Status: OrderApprovalStatus.Pending })
+                return;
+
+            approval.Status = OrderApprovalStatus.Cancelled;
+            approval.DecidedOnUtc = DateTime.UtcNow;
+            await _orderApprovalService.Update(approval);
+        }
+        catch (Exception ex)
+        {
+            // the order is already cancelled: publishing must complete whatever happens here
+            _logger.LogError(ex,
+                "Order {OrderNumber} ({OrderId}) was cancelled but its approval request could not be closed",
+                order.OrderNumber, order.Id);
+        }
+    }
+}