Fix CI token revocation bypass for collection access changes

[cursor]

Summary

• Added a runtime guard for CI token usage to ensure the token creator still has active access to the target collection.
• Updated /api/ci/file to validate creator access (owner, collection creator, or current direct grant) before returning decrypted content.
• Added unit tests covering allowed and revoked creator-access scenarios.

Validation

• npm run test -- src/server/access/access-token-runtime.test.ts src/lib/access-token-hash.test.ts
• npm run typecheck

Impact

This prevents a revoked user from continuing to read secrets via a previously issued CI token.

  

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @vitaliimelnychuk
  Earned XP: 15⭐
  Check Your Progress