I have some at-based types whose objects are typically non-public (viewable for members of an associated group only, but visible for anyone, because non-members might want to order access to them for some amount).
Thus, I'd like to have attributes like brochure (a file attachment) which are public, even if the object is not.
Can this be done somehow?
For thumbnail images (same problem) I solved this by creating the thumbnail image in the file system when the object is changed; a getThumbnailPath method does the scaling, if necessary, and returns a /++thumbnail++/(uid) string which is understood by apache. Thus, for search result lists, that path can be taken from the metadata, and any permission checking is bypassed.
For file attachments, I could do something like this as well; I can as well imagine a solution which involves references to published file objects stored elsewhere; but this sounds a little cumbersome to me.
And yes, one day I'll lift all my data to dexterity, but this won't be the case before 2019; first I need to reorganize my project to make it testable and thus upgradable.
For Plone, an object is "viewable" (i.e. "View" permission granted), if the object can be found via searches and web object navigation. Non viewable objects are almost inaccessible (you must provide special view to present those objects).
Thus, maybe, you should look differently on your "non public" objects: make them public but protect sensible attributes by special permissions (this, Archetypes supports).
If you want to stay with your current model: you need special views to make your objects accessible and those can also ensure that only public attributes are made visible..