Use Permissions.ViewContent for GetEndpoint

[infofromca]

fix #15785

[MikeAlhayek]

The Permissions.AccessContentApi permission is the valid check here and should not be changed. Checking for Permissions.ViewContent is done on line 41

[infofromca]

yes, on line 41 there is. so i think we should not need:
if (!await authorizationService.AuthorizeAsync(httpContext.User, Permissions.AccessContentApi))
{
return httpContext.ChallengeOrForbid("Api");
}
otherwise, for Anonymous , the will never hit line 41

[MikeAlhayek]

yes and they should not hit line 41 by default. If you want Anonymous role to do that, then grant Anonymous role permission to AccessContentApi

[infofromca]

but AccessContentApi were assgined to create and delete too.

[MikeAlhayek]

yes that is the idea. Granting them Anonymous to AccessContentApi is not a good idea. but if you want you can grant AccessContentApi to viewContent but not create, delete or publish this way they can only view content via API too.

[infofromca]

can we give out good default values for the site. especially if we need automatically set up the site.

[MikeAlhayek]

you can control the default values in your recipes. There isn't anything in OC that should be change here