Moderate Comments control panel should not be visible if plone.app.discussion is not installed

[ericof]

Describe the bug
The Moderate Comments control panel should not be visible if the Discussion Support add-on (plone.app.discussion) is not installed.

To Reproduce
Steps to reproduce the behavior:

1. Go to 'Site Setup'(Demo.plone.org)[https://demo.plone.org/controlpanel]
2. Click on 'Add-ons', and "Discussion Support" is under "Available" (meaning it is not installed)
3. Go back to 'Site Setup'
4. "Moderate Comments" is available under "Content"

Expected behavior
The "Moderate Comments" control panel should only be available IF Discussion Support add-on (plone.app.discussion) is installed.

Screenshots

Software (please complete the following information):

• OS: [e.g. iOS]
• Browser [e.g. firefox, chrome, safari]
• Volto Version [e.g. 18.4.0]: 18.x, 19.x
• Plone Version [e.g. 6.1.0] 6.1.3
• Plone REST API Version [e.g. 9.1.0]: 9.15.3

Additional context
Probably related to #1898

[pratyush07-hub]

I checked both issues #7786 and #1898 and this does not look like a Volto issue.

The problem is on the backend side. The moderate-comments control panel endpoint is still available even when plone.app.discussion is not installed, and it does not check for authorization.

Because there is no unauthorized check, the backend returns 200 OK with empty data instead of an error. When Volto calls this endpoint, it gets an empty response, so it shows an empty page instead of blocking access.

This control panel should only be available when plone.app.discussion is installed, and the backend should return an unauthorized error when the user is not allowed. This can be handled through the plone.restapi backend.
This seems to be the same backend issue discussed in #1898.

[Shyam-Raghuwanshi]

Hi @pratyush07-hub it's not the backend side problem, the moderate-comments is hardcorded here https://github.com/plone/volto/blob/main/packages/volto/src/components/manage/Controlpanels/Controlpanels.jsx#L54

[pratyush07-hub]

@Shyam-Raghuwanshi, Initially, I thought this was a backend problem, because the endpoint returns empty data instead of an error. However, it’s now clear that the real cause is in Volto: the panel is hardcoded in Controlpanels.jsx, so it is always rendered.