Restrict pizzas in API

website/pizzas/api/viewsets.py

@@ -21,7 +21,11 @@ class PizzaViewset(GenericViewSet, ListModelMixin):
     def list(self, request, *args, **kwargs):
         if (PizzaEvent.current() or
                 request.user.has_perm('pizzas.change_product')):
-            return super().list(request, *args, **kwargs)
+            queryset = self.get_queryset()
+            if not request.user.has_perm('pizzas.order_restricted_products'):
+                queryset = queryset.exclude(restricted=True)
+            serializer = serializers.PizzaSerializer(queryset, many=True)
+            return Response(serializer.data)
         raise PermissionDenied
 
     @list_route()