[FIX] website_sale: prevent adding archived products to cart

Prevents adding archived products to the cart.

TaskId-2925397

closes odoo/odoo#96483

X-original-commit: 623014802e643e19eb61966c5f639e2b04ff9e81
Signed-off-by: William Braeckman (wbr) <wbr@odoo.com>

addons/website_sale/models/product_product.py

@@ -93,7 +93,7 @@ class Product(models.Model):
 
     def _is_add_to_cart_allowed(self):
         self.ensure_one()
-        return self.user_has_groups('base.group_system') or (self.sale_ok and self.website_published)
+        return self.user_has_groups('base.group_system') or (self.active and self.sale_ok and self.website_published)
 
     def _get_contextual_price_tax_selection(self):
         self.ensure_one()

addons/website_sale/tests/test_website_sale_cart.py

@@ -47,3 +47,15 @@ class WebsiteSaleCart(TransactionCase):
         with self.assertRaises(UserError):
             with MockRequest(product.with_user(self.public_user).env, website=self.website.with_user(self.public_user)):
                 self.WebsiteSaleController.cart_update_json(product_id=product.id, add_qty=1)
+
+    def test_add_cart_archived_product(self):
+        # Try to add an archived product
+        product = self.env['product.product'].create({
+            'name': 'Test Product',
+            'sale_ok': True,
+        })
+        product.active = False
+
+        with self.assertRaises(UserError):
+            with MockRequest(product.with_user(self.public_user).env, website=self.website.with_user(self.public_user)):
+                self.WebsiteSaleController.cart_update_json(product_id=product.id, add_qty=1)