Versioning on folderish content types are not fully supported/thought

Start with plone.app.versioningbehavior.subscribers.create_version_on_save and trace the reorder path through plone.restapi.deserializer.mixins.handle_ordering to CMFEditions.CopyModifyMergeRepositoryTool.save. Reproduce the non-manager reorder scenario and determine the intended authorization and versioning behavior; done means reordering folderish content no longer produces the reported Unauthorized failure.

Scenario:

Folderish content type, versioning behavior enabled. If you try to reorder the content inside, it triggers a modified event, since you are changing it (PiP) then it triggers the creation of a version.

If you are not manager, somehow the permission check fails (I still don't get why):

2022-03-22 12:15:03,292 ERROR   [Zope.SiteErrorLog:22][waitress-0] Unauthorized: https://xxx/PATCH_application_json_
Traceback (innermost last):
  Module ZPublisher.WSGIPublisher, line 162, in transaction_pubevents
  Module ZPublisher.WSGIPublisher, line 371, in publish_module
  Module ZPublisher.WSGIPublisher, line 266, in publish
  Module ZPublisher.mapply, line 85, in mapply
  Module ZPublisher.WSGIPublisher, line 63, in call_object
  Module plone.rest.service, line 22, in __call__
  Module plone.restapi.services, line 19, in render
  Module plone.restapi.services.content.update, line 32, in reply
  Module plone.restapi.deserializer.dxcontent, line 69, in __call__
  Module plone.restapi.deserializer.mixins, line 20, in handle_ordering
  Module plone.restapi.deserializer.mixins, line 49, in reorderItems
  Module plone.folder.default, line 101, in moveObjectsByDelta
  Module zope.container.contained, line 342, in notifyContainerModified
  Module zope.event, line 32, in notify
  Module zope.component.event, line 27, in dispatch
  Module zope.component._api, line 134, in subscribers
  Module zope.interface.registry, line 448, in subscribers
  Module zope.interface.adapter, line 899, in subscribers
  Module zope.component.event, line 36, in objectEventNotify
  Module zope.component._api, line 134, in subscribers
  Module zope.interface.registry, line 448, in subscribers
  Module zope.interface.adapter, line 899, in subscribers
  Module plone.app.multilingual.dx.subscriber, line 49, in __call__
  Module plone.app.multilingual.dx.subscriber, line 88, in handle_modified
  Module plone.app.multilingual.dx.subscriber, line 105, in reindex_translation
  Module zope.event, line 32, in notify
  Module zope.component.event, line 27, in dispatch
  Module zope.component._api, line 134, in subscribers
  Module zope.interface.registry, line 448, in subscribers
  Module zope.interface.adapter, line 899, in subscribers
  Module zope.component.event, line 36, in objectEventNotify
  Module zope.component._api, line 134, in subscribers
  Module zope.interface.registry, line 448, in subscribers
  Module zope.interface.adapter, line 899, in subscribers
  Module plone.app.versioningbehavior.subscribers, line 62, in create_version_on_save
  Module Products.CMFEditions.CopyModifyMergeRepositoryTool, line 329, in save
  Module Products.CMFEditions.CopyModifyMergeRepositoryTool, line 483, in _assertAuthorized
zExceptions.unauthorized.Unauthorized: You are not allowed to access 'save' in this context