Method requireItemVisible

internal/server/server.go:1993–2004

requireItemVisible checks that the item's collection is visible to the requesting user. For guests with item-level grants, also verifies that the specific item is granted (not just the collection). Writes a 404 and returns false if not. Callers should invoke this immediately after resolving an item

(w http.ResponseWriter, r *http.Request, workspaceID string, item *models.Item)

// (e.g. handlers_ref_resolver.go) should use checkItemVisible directly with
// a manually-derived role.
func (s *Server) requireItemVisible(w http.ResponseWriter, r *http.Request, workspaceID string, item *models.Item) bool {
	visible, err := s.checkItemVisible(workspaceID, item, currentUser(r), workspaceRole(r), isBearerAuth(r))
	if err != nil {
		writeInternalError(w, err)
		return false
	}
	if !visible {
		writeError(w, http.StatusNotFound, "not_found", "Item not found")
		return false
	}
	return true
}

// checkItemVisible is the context-free visibility decision. Returns (true,
// nil) when the (user, role) pair can see `item` under the same rules