Require password to purchase product?

Question

Is there a way to password protect a single product in Magento 1? We have a product that should only be able to be purchased by customers who know the password.

It could be accessible to others, as long as they can't purchase without the password, so any coupon code or special attribute field might work, just can't think of how one might go about that.

Answer 1

Security through obscurity is frowned upon and you shouldn't rely on tactics like this for restriction.

Somebody could bypass it if they were able to find the product id by pasting the add to cart info into the URL, for example, thus bypassing your requirement:

/checkout/cart/add/uenc/blahblah/product/{product_id}/form_key/{formkey}

Another potential pitfall would be if the password was compromised, you'd need to have it updated and contact all of the customers which should have access in order to furnish them with the updated password, which would be time consuming and give a poor impression of your website's security measures.

As opposed to this route, I'd recommend the following three-step approach:

1. Create a new customer group
2. Create a new product attribute
3. Add an event-observer module which would observe the add to cart event, and throw an error unless the session belongs to a customer in the appropriate customer group.

Step One: New Customer Group

Magento Admin → Customers → Customer Groups → Add New Customer Group (I called mine Fancy)

Take note of the new customer group ID (visible in the left-most column from the grid view), as you'll need this in your event-observer. (in my instance, the ID was 4)

Step Two: New Product Attribute

1. Magento Admin → Catalogue → Attributes → Manage Attributes → Add New Attribute
2. Set the attribute up as a "Yes/No" (I called mine restricted_to_fancy_customers)
3. Magento Admin → Catalogue → Attributes → Manage Attribute Sets
4. Add the newly created attribute to your default (or relevant) attribute set
5. Update the product(s) you wish to restrict to be set to "Yes" under the restricted attribute

Step Three: Event-Observer Logic

Read this guide on setting up your module:

How to Create a New Observer on the Event catalog_product_save_before

Instead of observing catalog_product_save_before, you'll be observing controller_action_predispatch_checkout_cart_add.

Your config.xml file would contain:

...
<controller_action_predispatch_checkout_cart_add>
  <observers>
     <yourmodule>
        <type>singleton</type>
        <class>Your_Module_Model_Observer</class>
        <method>restrictCart</method>
     </yourmodule>
  </observers>
</controller_action_predispatch_checkout_cart_add>
...

Your observer method would look like this:

public function restrictCart($observer){
    $product_id = Mage::app()->getRequest()->getParam('product', 0);
    $product = Mage::getModel('catalog/product')->load($product_id);
    if ($product->getData('restricted_to_fancy_customers')){
        $customer = Mage::getSingleton('customer/session')->getCustomer();
        if ($customer){
            if ($customer->getGroupId() != 4){ //replace 4 with whatever your customer group ID is
                Mage::getSingleton('core/session')->addError("This product is restricted to fancy customers"); 
                Mage::throwException("Non-fancy customer attempted to purchase restricted product");
            }
        }
        else{
            Mage::getSingleton('core/session')->addError("This product is restricted to fancy customers"); 
            Mage::throwException("Guest customer attempted to purchase restricted product");
        }
    }
}

This way, only logged-in customers belonging to the appropriate group are allowed to purchase the product. Guest customers, or customers not in the group will get an error (which you can customise & tailor to your liking).

The add-to-cart function is halted by the Mage::throwException() method.

Answer 2

I agree with Moose: Assigning the customer to a customer group is better than giving them a password. A solution without code that I've seen is to give the product a ridiculously high price and set up a price rule for the customer group.

Of course you could do the same with a coupon code instead of a customer group.