Fixes: OrderViewSet fixes

core/models.py

@@ -711,6 +711,8 @@ class Order(ExportModelOperationsMixin("order"), NiceModel):
                 self.save()
                 return self
             case "payment":
+                self.status = "PAYMENT"
+                self.save()
                 return Transaction.objects.create(
                     balance=self.user.payments_balance,
                     amount=amount,

core/signals.py

@@ -77,7 +77,7 @@ def process_order_changes(instance, created, **kwargs):
                         Order.objects.create(user=instance, status="PENDING", human_readable_id=human_readable_id)
                         break
 
-        if instance.status == "CREATED":
+        if instance.status in ["CREATED", "PAYMENT"]:
             if not instance.is_whole_digital:
                 send_order_created_email.delay(instance.uuid)
 

core/viewsets.py

@@ -2,6 +2,7 @@ from uuid import UUID
 
 from django.db.models import Q
 from django.http import Http404
+from django.shortcuts import get_object_or_404
 from django.utils.decorators import method_decorator
 from django.utils.translation import gettext_lazy as _
 from django_filters.rest_framework import DjangoFilterBackend
@@ -11,7 +12,6 @@ from drf_spectacular.utils import extend_schema_view
 from rest_framework import status
 from rest_framework.decorators import action
 from rest_framework.exceptions import PermissionDenied
-from rest_framework.generics import get_object_or_404
 from rest_framework.renderers import MultiPartRenderer
 from rest_framework.response import Response
 from rest_framework.viewsets import ModelViewSet
@@ -189,6 +189,12 @@ class ProductViewSet(EvibesViewSet):
     lookup_field = "lookup"
     lookup_url_kwarg = "lookup"
 
+    def get_queryset(self):
+        qs = super().get_queryset()
+        if self.request.user.has_perm("core.view_product"):
+            return qs
+        return qs.filter(is_active=True)
+
     def get_object(self):
         queryset = self.filter_queryset(self.get_queryset())
         lookup_value = self.kwargs[self.lookup_url_kwarg]