prevent add to cart for particular products

Thanks for the quick feeback!

I seem to be hitting several DX problems here.

I've found the hook hook_commerce_product_calculate_sell_price_line_item_alter(), which seems to be where you're saying I need to act.

Changing the metadata with the wrapper doesn't seem to work (that's more a problem with EntityAPI's sparse docs though). But altering the line item directly works and on form submission I'm told I can't add it to the cart:

  // Doesn't work, produces error message
  $line_item_wrapper->commerce_unit_price->set(NULL);

  // Doesn't work.
  $line_item_wrapper->commerce_unit_price->clear();
 
  // Does work.
  $line_item->commerce_unit_price['und'][0]['amount'] = NULL;

But AFAICT this hook only get invoked in commerce_cart_add_to_cart_form_submit(), so as you say, this isn't terribly good UX: the user is misled into submitting the form and only finds out they can't buy it once they've tried to.

So it seems to me I need to be altering the add to cart form.

The $context param is great, but I am wary of relying on the node in there, because an add to cart form can appear in Views AFAIK where presumably that could be empty.

Therefore, alter code has to look at the product(s) involved in the form. However, these are in a different structure depending on whether there's one or many. You can see from this code in commerce_stock that it's a bit awkward:

    // Check to see if product has options (multiple products using
    // the default dropdown)
    if(isset($form['product_id']['#options']) ){
      // Set validation
      $form['#validate'][] = 'commerce_stock_add_to_cart_validate';
      commerce_stock_cart_state_validate_options($form);
    }
    // A single product or uses attributes (like colour & size).
    elseif (isset($form['product_id']['#value'])) {
      // @todo new rules event for handling options - do we need it?
      // Add validation to the add to cart
      $form['#validate'][] = 'commerce_stock_add_to_cart_validate';
      // check if the add to cart form should be enabled (in stock)
      commerce_stock_cart_state_validate($form);
    }

My use case here is that I can operate on the node level, so I can just zap the whole form. But I want the API security too, just in case later on we add other pathways to purchase products.

So several places where DX could be improved here I think:

- make it easier to sniff the commerce_cart_add_to_cart_form to see which products it is listing
- have a single point where adding a product to the cart can be denied (which would then be called both by the the form, and the API function commerce_cart_product_add().