Raise Unauthorized when the user has no permission to create the content

Author: ale-rt

src/plone/api/content.py

@@ -1,5 +1,6 @@
 """Module that provides functionality for content manipulation."""
 
+from AccessControl import Unauthorized
 from copy import copy as _copy
 from plone.api import portal
 from plone.api.exc import InvalidParameterError
@@ -13,9 +14,9 @@
 from plone.uuid.interfaces import IUUID
 from Products.CMFCore.DynamicType import DynamicType
 from Products.CMFCore.WorkflowCore import WorkflowException
-from zope.component import ComponentLookupError
 from Products.CMFPlone.interfaces import IConstrainTypes
 from zExceptions import BadRequest
+from zope.component import ComponentLookupError
 from zope.component import getMultiAdapter
 from zope.component import getSiteManager
 from zope.container.interfaces import INameChooser
@@ -76,7 +77,7 @@ def create(
             # For dexterity objects we want to not use the invokeFactory
             # method because we want to have the id generated by the name chooser
             if not fti.isConstructionAllowed(container):
-                raise ValueError(f"Cannot create {type}")
+                raise Unauthorized(f"Cannot create {type}")
 
             container_fti = container.getTypeInfo()
             if container_fti is not None and not container_fti.allowType(type):

src/plone/api/tests/test_content.py

@@ -387,6 +387,18 @@ def test_create_with_not_lowercase_id(self):
         )
         self.assertEqual(obj.id, "Doc1")
 
+    def test_create_anonymous_unauthorized(self):
+        from AccessControl import Unauthorized
+        from plone.app.testing import logout
+
+        logout()
+        with self.assertRaises(Unauthorized):
+            api.content.create(
+                container=self.portal,
+                type="Dexterity Item",
+                id="foo",
+            )
+
     def test_create_raises_unicodedecodeerror(self):
         """Test that the create method raises UnicodeDecodeErrors correctly."""
         site = getGlobalSiteManager()