VLT Actions (Footer, Site etc.) configureable from the LRF are not Workflow State Permission aware!

[acsr]

Issue

Unlike the classic Plone Actions you can add an Action in the VLT sidebar and assign a link pointing to a page that is not publicly visible and its link shows up still when the page is rendered.

This results in a "You are not authorized this resource" page error.

Solution

Render the VLT action links permission aware based on the accessibility (YES!) of the target forn the currently logged in user.

Note (with some rant smell)

It is not understandable why you do not use the classic actions and like before in VLT 6.x and just provide an interface for it.

It is understandable that the current UI in Volto / VLT sidebar is not allowing the complexity of the classic approach. It would be a clever move to fix that to meet our excellent USP to respect workflows and permissions strictly and confident. Take the challenge ;-)