Method visibleCollectionIDs

internal/server/server.go:1925–1931

visibleCollectionIDs returns the set of collection IDs the current user can see in the given workspace. Returns nil if the user has "all" access (no filtering needed), or a non-nil slice for "specific" access. Unauthenticated users (fresh install) always get nil (all access), as do platform admins —

(r *http.Request, workspaceID string)

// handler, handleCreateItem's collection-visibility check, and every other
// direct caller) still granting a bearer admin an unrestricted view.
func (s *Server) visibleCollectionIDs(r *http.Request, workspaceID string) ([]string, error) {
	user := currentUser(r)
	if user == nil || (user.Role == "admin" && !isBearerAuth(r)) {
		return nil, nil // No filtering for admins (cookie session) or unauthenticated
	}
	return s.store.VisibleCollectionIDs(workspaceID, user.ID)
}

// requireCollectionFullyVisible checks that the collection is visible to the
// requesting user under FULL-collection-access semantics (BUG-1920 —