Method guestResourceFilter

internal/server/server.go:2587–2589

guestResourceFilter returns the full-collection IDs and granted item IDs for the current user if they need item-level grant filtering. Returns nil/nil for: - unauthenticated users - admin users - members with "all" collection access (grants should merge, not replace) For guests: returns direct colle

(r *http.Request, workspaceID string)

// + direct collection grants as fullCollIDs, plus item grants as grantedItemIDs.
// This ensures item grants are additive to the member's existing access.
func (s *Server) guestResourceFilter(r *http.Request, workspaceID string) (fullCollIDs, grantedItemIDs []string, err error) {
	return s.guestResourceFilterCore(r, workspaceID, false)
}

// guestResourceFilterIncludeDeletedItems is the delta-sync variant
// of guestResourceFilter. It uses GuestVisibleResourcesIncludeDeleted