Method requireCollectionFullyVisible

internal/server/server.go:1991–2002

requireCollectionFullyVisible checks that the collection is visible to the requesting user under FULL-collection-access semantics (BUG-1920 — codex R2 follow-up). This is deliberately STRICTER than handleGetCollection's inline visibleCollectionIDs + isCollectionVisible check: VisibleCollectionIDs (w

(w http.ResponseWriter, r *http.Request, workspaceID string, coll *models.Collection)

// Writes a 404 and returns false if not visible; callers should invoke this
// immediately after resolving a collection by slug/ID.
func (s *Server) requireCollectionFullyVisible(w http.ResponseWriter, r *http.Request, workspaceID string, coll *models.Collection) bool {
	visible, err := s.checkCollectionFullyVisible(r, workspaceID, coll.ID)
	if err != nil {
		writeInternalError(w, err)
		return false
	}
	if !visible {
		writeError(w, http.StatusNotFound, "not_found", "Collection not found")
		return false
	}
	return true
}

// requireItemVisible checks that the item's collection is visible to the
// requesting user. For guests with item-level grants, also verifies that the