The @types endpoint is registered with the zope2.View permission, but inside its reply method it checks whether the user is anonymous and blocks them.
We could instead implement logic like:
- If the context
portal_type and the traversal path are the same, return the schema; otherwise, raise Unauthorized.
Blocking access to Anonymous breaks the Default view in volto, as documented in plone/volto#8426
The
@typesendpoint is registered with thezope2.Viewpermission, but inside itsreplymethod it checks whether the user is anonymous and blocks them.We could instead implement logic like:
portal_typeand the traversal path are the same, return the schema; otherwise, raiseUnauthorized.Blocking access to Anonymous breaks the Default view in
volto, as documented in plone/volto#8426