* For anonymous users, show only available gifts

store/views.py

@@ -187,11 +187,17 @@ class PromoCodeAPI(mixins.CreateModelMixin, generics.GenericAPIView):
 
 
 class GiftAPI(viewsets.ModelViewSet):
-    queryset = Gift.objects.all()
     serializer_class = GiftSerializer
     permission_classes = [IsAuthenticated | ReadOnly]
     filterset_class = GiftFilter
 
+    def get_queryset(self):
+        if self.request.user.is_authenticated or settings.DISABLE_PERMISSIONS:
+            return Gift.objects.all()
+
+        # For anonymous users, show only available gifts
+        return Gift.objects.filter(available_count__gt=0)
+
 
 class StatisticsAPI(viewsets.GenericViewSet):
     def get_queryset(self):