When you create an access token for a draft, that token is still accessible if the page revision is published then put into draft mode afterwards.
There should be an option to discard all active access tokens once a revision is published. This could be appropriate for a global setting as well as a per page setting.
1. Create a new node that has workflow options and can be placed into Draft or unpublished equivalent.
2. Create a new access token for that page.
3. View the link with the token to ensure it is working.
4. Publish the revision of the node.
5. Visit token link to ensure it does NOT work.
6. Create a new revision of the same node and place in Draft.
7. Visit token link. It should work and show the most recent revision.
Add either global or per-page option (or both) to discard all access tokens when the revision is published.
Would potentially add a checkbox/boolean field to the editing screen of a node, or the global configuration of the access_unpublished module.
Needs review
1.4
User interface
I have attached a patch that adds a global option to the settings form for Access Unpublished to clear tokens when a node is published.
Any tokens created while a node is unpublished will be deleted when that node is finally published.