From 9d5b4fee90fc963d32198b314248c0eb2d9229eb Mon Sep 17 00:00:00 2001
From: Egor fureunoir Gorbunov <contact@fureunoir.com>
Date: Mon, 16 Feb 2026 19:43:09 +0300
Subject: [PATCH] fix(models, viewsets): filter inactive records in queries

ensure only active records are considered in `models.py` and `viewsets.py` by adding `is_active=True` filters. improves data integrity and prevents processing inactive entities.
---
 engine/core/models.py   | 12 +++++++++---
 engine/core/viewsets.py | 18 ++++++++++--------
 2 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/engine/core/models.py b/engine/core/models.py
index 0ad745aa..55218d23 100644
--- a/engine/core/models.py
+++ b/engine/core/models.py
@@ -402,7 +402,8 @@ class Category(ExportModelOperationsMixin("category"), NiceModel, MPTTModel):
     @cached_property
     def filterable_attributes(self) -> list[FilterableAttribute]:
         rows = (
-            AttributeValue.objects.annotate(value_length=Length("value"))
+            AttributeValue.objects.filter(is_active=True)
+            .annotate(value_length=Length("value"))
             .filter(
                 product__is_active=True,
                 product__category=self,
@@ -726,12 +727,17 @@ class Product(ExportModelOperationsMixin("product"), NiceModel):
 
     @property
     def price(self: Self) -> float:
-        stock = self.stocks.only("price").order_by("-price").first()
+        stock = (
+            self.stocks.filter(is_active=True).only("price").order_by("-price").first()
+        )
         return round(stock.price, 2) if stock else 0.0
 
     @cached_property
     def quantity(self) -> int:
-        return self.stocks.aggregate(total=Sum("quantity"))["total"] or 0
+        return (
+            self.stocks.filter(is_active=True).aggregate(total=Sum("quantity"))["total"]
+            or 0
+        )
 
     @property
     def total_orders(self):
diff --git a/engine/core/viewsets.py b/engine/core/viewsets.py
index d0519a17..c783dd0c 100644
--- a/engine/core/viewsets.py
+++ b/engine/core/viewsets.py
@@ -383,16 +383,18 @@ class BrandViewSet(SchonViewSet):
         return obj
 
     def get_queryset(self):
-        queryset = Brand.objects.all()
-
-        if self.request.user.has_perm("view_category"):  # ty:ignore[possibly-missing-attribute]
-            queryset = queryset.prefetch_related("categories")
-        else:
-            queryset = queryset.prefetch_related(
+        qs = super().get_queryset()
+        if self.request.user.has_perm("core.view_brand"):  # ty:ignore[possibly-missing-attribute]
+            if self.request.user.has_perm("core.view_brand"):  # ty:ignore[possibly-missing-attribute]
+                return qs.prefetch_related("categories")
+            return qs.prefetch_related(
                 Prefetch("categories", queryset=Category.objects.filter(is_active=True))
             )
-
-        return queryset
+        if self.request.user.has_perm("core.view_category"):  # ty:ignore[possibly-missing-attribute]
+            return qs.filter(is_active=True).prefetch_related("categories")
+        return qs.filter(is_active=True).prefetch_related(
+            Prefetch("categories", queryset=Category.objects.filter(is_active=True))
+        )
 
     # noinspection PyUnusedLocal
     @action(