Registration amendments are now limited the products that the user is allowed to add.

registrasion/forms.py

@@ -1,3 +1,4 @@
+from registrasion.controllers.product import ProductController
 from registrasion.models import commerce
 from registrasion.models import inventory
 
@@ -349,16 +350,31 @@ class VoucherForm(forms.Form):
     )
 
 
-class StaffProductsForm(forms.Form):
+def staff_products_form_factory(user):
+    ''' Creates a StaffProductsForm that restricts the available products to
+    those that are available to a user. '''
+
+    products = inventory.Product.objects.all()
+    products = ProductController.available_products(user, products=products)
+
+    product_ids = [product.id for product in products]
+    product_set = inventory.Product.objects.filter(id__in=product_ids)
+
+    class StaffProductsForm(forms.Form):
         ''' Form for allowing staff to add an item to a user's cart. '''
 
         product = forms.ModelChoiceField(
             widget=forms.Select,
-        queryset=inventory.Product.objects.all(),
+            queryset=product_set,
         )
 
         quantity = forms.IntegerField(
             min_value=0,
         )
 
-StaffProductsFormSet = forms.formset_factory(StaffProductsForm)
+    return StaffProductsForm
+
+def staff_products_formset_factory(user):
+    ''' Creates a formset of StaffProductsForm for the given user. '''
+    form_type = staff_products_form_factory(user)
+    return forms.formset_factory(form_type)

registrasion/views.py

@@ -819,7 +819,8 @@ def amend_registration(request, user_id):
     ).select_related("product")
     initial = [{"product": i.product, "quantity": i.quantity} for i in items]
 
-    formset = forms.StaffProductsFormSet(
+    StaffProductsFormSet = forms.staff_products_formset_factory(user)
+    formset = StaffProductsFormSet(
         request.POST or None,
         initial=initial,
         prefix="products",