SetMemberCollectionAccess updates a member's collection_access mode and replaces their specific collection grants atomically.

isCollectionVisible checks if a collection ID is in the visible set. If visibleIDs is nil, all collections are visible.

refOf builds a PREFIX-NUMBER string from a fresh item — used by the integration tests since the canonical ref isn't on the model directly. ItemNumber

Driver returns the driver type.

errorHandler fails the test if invoked. Used to assert that a code path doesn't hit the handler at all.

DB returns the underlying *sql.DB (for use in migrations/testing).

Set adds or replaces the credential for the given server URL. The canonical URL is mirrored into the value's ServerURL field so a caller reading the c

liveCmdhelpDoc returns a minimal cmdhelp.Document with every command path the read-only catalog references. Lighter than re-running pad's full cobra e

New creates a new Metrics instance with a custom registry and registers all application metrics plus Go runtime and process collectors.

cloudAdminReq is a small helper that builds a request with optional JSON body and the caller-chosen headers.

newCollabTestServer wires up an httptest server whose only handler upgrades the inbound WS, registers it with the manager, and waits for the session t

GetWorkspaceMember retrieves a single membership record.

New creates a Store backed by SQLite at the given path. The DSN is configured for safe concurrent use under Go's connection pool: - `_pragma=busy_ti

doAuthedRequest is like doRequest but with a session cookie + the matching User-Agent attached (SessionAuth UA-binding, see middleware_auth.go:186).

IsEmailVerified returns true if the user's email address has been verified. Mirrors IsDisabled: a non-empty EmailVerifiedAt timestamp means verified,

New creates a new in-memory EventBus with default replay buffer settings.

classifyHTTPStatus is the legacy entry point preserved for callers that don't know their resource kind. New callers should use classifyHTTPStatusKind

BoolToInt converts a Go bool to a query parameter value. SQLite: 0/1 (integers) PostgreSQL: true/false (native booleans)

BuildCLIArgs translates an MCP tool call's JSON arguments into the CLI argument list that should be appended after the command path. Pure function — n

DeleteItem soft-deletes the item by stamping deleted_at and bumping the workspace-scoped seq so delta-sync clients see the tombstone. The seq bump use

NewErrorResult packages an ErrorPayload as an MCP CallToolResult with IsError=true. Both the JSON envelope and a human-readable summary are returned:

actorFromRequest derives actor and source from the request's auth context. Actor is "user" or "agent" (determined by X-Pad-Agent header). Source is "w

buildSyntheticTree returns a small cobra tree exercising the shapes the emitter has to handle: subgroups, leaf commands with positional args, flags of

--- Collection Grants --- CreateCollectionGrant creates a direct grant on a collection for a user.

--- Item Links ---

============================================================ Clients (RFC 7591 — Dynamic Client Registration) ========================================

NewSession constructs a Session with the given subject (pad user ID). Returns a non-nil DefaultSession so the embedded methods don't panic on a zero-v

Resolve returns the store responsible for key, or an error if no matching backend is registered. The key format is "<prefix>:<rest>".

logAuditEvent logs a non-workspace audit event (e.g. login, logout). Best-effort: errors are silently ignored.

workspaceIDForSlug looks up the internal UUID for a slug — used by tests that synthesize attachment rows directly via the store (bypassing the upload

BaseURL returns the configured base URL.

CreateOAuthConnection inserts a new connection row. Idempotent in the sense that callers should INSERT once per /authorize/decide; if the same request

GetAttachment returns the attachment with the given id, or (nil, nil) if no such row exists. Soft-deleted rows ARE returned (so download handlers can

LoadStore reads the credentials file and returns a usable CredentialStore. Returns an empty (but non-nil) store if the file doesn't exist — that's not

───────────────────────────────────────────────────────────────────── Helpers for non-HTTP error paths (TASK-1077 — replace plain-string NewToolResult

Encode serializes an Artifact to its portable on-disk form: --- <yaml frontmatter> --- <body> Output is deterministic: two Encode calls on the

Rebind converts a query with "?" placeholders to the dialect's format. For SQLite this is a no-op. For PostgreSQL, "?" becomes "$1", "$2", etc.

clientIP extracts the client IP from RemoteAddr. This is safe because TrustedProxyRealIP runs earlier in the chain and — when a trusted proxy is confi

Connected-apps handler tests (PLAN-943 TASK-954). What's covered: - GET /api/v1/connected-apps requires cloud mode (404 outside). - List returns onl

equalSlice is a small helper for stable []string comparison; kept here so test files across the package can share it. catalog_test.go has equalString

logAuditEventForUser logs an audit event with an explicit user ID. Use this when the user isn't (yet) in the request context, e.g. after a successful

--- Helpers ---

requireEditPermission checks if the user has edit access to the given item. For regular members (editor/owner), this uses the standard role check. For

sessionCookieName returns the session cookie name. When running over TLS (secureCookies=true), the __Host- prefix is used to prevent subdomain cookie

GetPlatformSetting returns a single platform setting value, or empty string if not set.

GetReport computes the windowed project report for a workspace.

ResolveItemIncludeDeleted is like ResolveItem but includes soft-deleted items.

SetCloudSidecar installs the reverse pad → pad-cloud client. Called from cmd/pad/main.go when PAD_CLOUD_SIDECAR_URL + PAD_CLOUD_SECRET are set. When u

ValidateFields checks field values against the collection schema. It validates required fields are present, types are correct, and select values are w

dispatcherErrorResult wraps an internal dispatcher failure (build request, encode body, parse response, marshal merged fields, etc.) into the structur

Tests for the OAuth server constructor + audience strategy + storage adapter (PLAN-943 TASK-951 sub-PR B). Each layer is covered: - NewServer: requir

============================================================ Access tokens (handler/oauth2/storage.go AccessTokenStorage) ============================

GetOAuthConnection fetches the connection row by request_id. Returns ErrOAuthConnectionNotFound if no row exists; any other error is a real I/O failur

Publish sends an event to all subscribers for the event's workspace.

ResolveItem looks up an item by UUID, PREFIX-NUMBER ref (e.g. "IDEA-15"), or slug. UUID is tried first, then ref, then slug.

--- Phase Links --- SetParentLink sets the parent for an item. Since an item can belong to at most one parent, this deletes any existing parent link f

classifyExecError turns an exec.Cmd failure (err + stderr) into a structured envelope. lookup is optional — when supplied, no_workspace errors get ava

Close stops every active room AND blocks until every in-flight Join goroutine has returned. After Close, Join is undefined — callers must coordinate s

CreateAttachment inserts an attachment row. id and created_at are generated by the store. The caller is expected to have already written the blob via

--- Item Grants --- CreateItemGrant creates a direct grant on an item for a user.

GetTemplate returns the workspace template with the given name, or nil if no template with that name exists.

JSONExtractText returns SQL to extract a text value from a JSON column. SQLite: json_extract(col, '$.key') PostgreSQL: col->>'key'

NewProcessor returns the Processor compiled into this binary. Pure-Go build → pureGoProcessor. libvips build → vipsProcessor (Phase 2). Constructed o

SeedDefaultCollections rescues a workspace that ended up with zero collections by seeding it with the standard Software-shape Defaults(). It is intent

UserCount returns the total number of registered users.

postOAuthForm POSTs an x-www-form-urlencoded body without any auth (used for /oauth/revoke + /oauth/token, where client_id rides in the form for publi

runAuthCodeFlow drives a full /oauth/authorize/decide → /oauth/token exchange and returns the parsed token JSON. Each invocation needs a unique verifi

seedParentAndChildren creates a plan + N child tasks with the given statuses (one per child), returning the parent and the slice of child refs in crea

Apply walks doc and stamps EnumSource + resolved Enum values on matching args and flags. Resolution failures are silent: the document continues to adv

NewStorage wraps a *store.Store as a fosite-compatible adapter. The store must be a fully-initialized pad store (migrations applied); no validation he

SeedCollectionsFromTemplate seeds the workspace with collections from the named template. An empty template name materializes the default collections

SubscriberCount returns the number of active subscribers whose itemID matches. Used by the room manager to decide when the active peer count has dropp

doRequestWithBearer dispatches a request with an Authorization: Bearer header set. The existing test helpers in server_test.go don't take a token para

isBearerAuth reports whether the request was authenticated via an Authorization: Bearer header rather than a browser session cookie. True for: PATs on

===================================================================== mcp ↔ OAuth integration (sub-PR E, TASK-1027) ==================================

newRequest creates an http.Request with auth and agent headers set.

postFormWithCookie POSTs an x-www-form-urlencoded body with both a session cookie and the matching CSRF cookie set, plus the session-bound User-Agent.

BackfillOAuthConnections walks every distinct grant chain found in oauth_access_tokens and oauth_refresh_tokens, parses the newest chain row's session

Close shuts down the event bus and cleans up resources.

CreateShareLink creates a new share link and returns it with the raw token. The raw token is only available in this response — it is not stored.