GetCrossWorkspaceBacklinks returns inbound `[[ws::REF]]` backlinks pointing at the queried target (`targetWorkspaceID`, `targetRef`) from EVERY OTHER

GetMemberCollectionAccess returns the collection IDs a member has been explicitly granted access to (only meaningful when collection_access = "specifi

InsertMCPAuditEntry persists one audit row. Called from the audit middleware's async writer; the caller owns the buffered channel + the ordering, so t

IsConfigured reports whether the client has an explicit global connection configuration, either from config.toml or an environment/flag override.

NewDispatcher creates a Dispatcher with the given store. The delivery client enforces the SSRF guard at connect time, not just at parse time: its dia

NormalizeItemLinkType canonicalizes supported link types and returns an error for unknown values.

ValidateSession hashes the provided token, looks it up, checks expiry, and returns the session info including the associated user and binding metadata

VisibleCollectionIDs returns the set of collection IDs a member can see. Returns nil if the member has "all" access (meaning no filtering needed). Sys

bootstrapAccountDeleteUser creates the first admin user, sets a Stripe customer ID on them, and returns (userID, sessionToken). Used by the handleDele

deleteAccountReq issues the delete-account request from a client IP that differs from the loopback address bootstrap ran on. The session-IP-change mid

executeRequest builds + serves + packages a single HTTP request against the wrapped handler. Pulled out of Dispatch so the special-case methods (dispa

goAsync spawns fn in a goroutine that's tracked by s.bg, so Stop() can wait for in-flight background work to finish. Use this for any fire-and-forget

mustSeedWorkspaceWithRole is a test helper that creates a workspace + adds the user as a member with the given role. Centralized here because TASK-952

Tests for the OAuth 2.1 storage layer (PLAN-943 TASK-951 sub-PR A). The store layer is fosite-agnostic by design — sub-PR B introduces the fosite impo

passThrough returns an ActionFn that forwards the input verbatim to the given cmdPath via env.Dispatch. The vast majority of catalog actions use this

AddConnectionWorkspace inserts a (request_id, workspace_id) row in the allow-list join table. Idempotent: re-adding an existing pair is a no-op (INSER

ExtractWikiLinks scans `content` for [[...]] occurrences OUTSIDE any fenced or inline code region, parses each into a WikiLinkRef, and returns them in

GetOAuthConnectionAccess is the hot-path projection used by the MCP introspection middleware. Runs at most two cheap indexed queries (one PK lookup, o

Put writes the blob from r into the backend, addressable by hash. The implementation MUST verify that the bytes streamed from r hash to the supplied h

SetUserPlan updates a user's billing plan.

SetWorkspaceTool returns the (Tool, Handler) pair for the built-in pad_set_workspace tool. The handler updates state in place. Exposed as a construct

Subscribe registers a new subscriber for the given workspace. Returns a buffered channel that will receive events for that workspace.

ValidateUpload combines the sniff result, the client-supplied MIME header, and the filename's extension to produce one of: - (entry, "", nil) — accep

Exported context-key helpers for callers that need to synthesize an authenticated request without going through the auth middleware chain (e.g. the in

actorNameFromRequest returns the authenticated user's display name, or empty string.

childLinkTypeSQL returns a SQL IN clause fragment like "'parent','implements'" for filtering item_links by child relationship types.

collectionSchemaJSONFromFlags resolves the --schema and --fields flags into a marshaled CollectionSchema JSON string. Exactly one of schemaInput or f

Mutation-endpoint tests for /api/v1/connected-apps/{id}/... routes (PLAN-1519 / TASK-1524 / IDEA-1517 §3). What's covered (per endpoint): - PATCH /n

getOnlyAttachmentID returns the ID of the single live attachment row in a workspace — the test infrastructure uploads at most one blob per call, so th

mcpEnabledTestServer builds a Server with cloud mode + a stub streamable-HTTP transport so tests targeting auth / discovery / routing don't need to dr

newTestConfig points DataDir at a fresh tmp dir and BrowserURL at the given test server. Most tests want both wired up together.

runHelp invokes the help command with the given args and returns (stdout, stderr, error).

CreateActivityDebounced creates a new activity or updates an existing one if a matching activity (same document, same user, same action) was recorded

DeriveClaimCode produces the 6-digit code for the given (user, workspace) at the given wall-clock time. Exported so the Phase E "Connect project" moda

EnsureServer checks if the pad server is running; if not, starts it in the background.

GetItemLinks returns links where the given item is either source or target. Links pointing to or from soft-deleted items are filtered out so callers (

GetOAuthClient looks up a registered client by ID. Returns ErrOAuthNotFound if no row matches.

NewFetcher returns a Fetcher with production defaults applied.

Publish broadcasts an event to every subscriber whose itemID matches event.ItemID. Non-blocking: full subscriber channels drop the event with a warnin

Save writes the persisted Pad config to disk.

SetEncryptionKey configures the store's AES-256 encryption key for encrypting sensitive fields (e.g., TOTP secrets) at rest. The key must be exactly 3

--- TOTP 2FA --- SetTOTPSecret stores the TOTP secret for a user (before 2FA is verified). The secret is encrypted at rest if an encryption key is con

StarItem stars an item for a user. Idempotent — re-starring is a no-op.

Unsubscribe removes a subscriber and closes its channel.

── test helpers ── callToolRequest builds an mcp.CallToolRequest with the given input arguments — the public constructor isn't exposed by mcp-go so we

containsToolText looks for substr in any TextContent block of res. MCP results can carry multiple content blocks; checking all of them keeps the asser

helper: create a "blocks" link from source to target

makeFanOutHandler returns the ToolHandlerFunc that mcp-go invokes when the tool is called. Reads `action` from the input, looks up the handler, and fo

makeTestImage returns a freshly-allocated NRGBA image filled with a distinguishable pattern so transformation tests can assert on specific pixels. Wid

requireRole checks if the user's workspace role meets the minimum required level. Role hierarchy: owner > editor > viewer.

testServerWithCollab wires a RoomManager onto a fresh test server so the collab handler answers 200/101 on the happy path. Tests that only assert on a

AddPadEntry reads (or creates) the JSON config at path, ensures mcpServers.pad points to `binary`, and writes the file back. Existing entries outside

Decode parses an artifact's portable on-disk form back into an Artifact. It splits a leading "---\n ... \n---" frontmatter block from the body, unmar

Delete removes the blob identified by key. Deleting a missing key is NOT an error — callers (e.g. the orphan GC) treat it as the success case.

DetectWorkspace walks up the directory tree from cwd looking for .pad.toml.

Dispatch sends the event payload to all matching active webhooks for the workspace. Each delivery runs in its own goroutine so the caller is never blo

GetItemIncludeDeleted finds an item by id including soft-deleted items. Used by code paths that need to act on records the user already owns even thou

ListUserOAuthConnections returns every OAuth connection the user has active. "Active" means at least one access OR refresh token in the chain still ha

RestoreItem un-archives a soft-deleted item and bumps the workspace-scoped seq so delta-sync clients re-materialize the row. Same lock + subquery shap

RunBrowserBootstrap walks the operator through the browser-based first- admin bootstrap. Returns nil on success (server has flipped to setup_required:

SetPlatformSetting upserts a platform setting.

append adds an event to the ring buffer, evicting the oldest if full.

appendToCatalog inserts def into Catalog. Called from catalog_<resource>.go init() functions. Keep this small + simple; validation happens at Register

configureBootstrapToken seeds a known token on the server so tests don't depend on the random generator. The on-disk file is created in a temp dir so

connectSSE connects to the SSE endpoint on a real test server and returns a channel of parsed events. Cancel the context to disconnect.

createBulkTestItem creates a task and returns it.

createTestWorkspace creates a workspace via API and returns its slug.

dialCollab opens a WebSocket against the test server's collab endpoint with the given itemID. Returns the connection and the HTTP response. The respon

doArtifactRequest posts a raw (non-JSON) body to an artifact-import endpoint.

filterAttention returns attention items of a given type.

helper: fetch the workspace graph and return the parsed response

mapItemCreate translates an `item create` MCP call into a POST to api/v1/workspaces/{ws}/collections/{coll}/items. The MCP tool schema (auto-generate

mustParseQueryFromPath extracts the query-string portion of path and parses it. Test-only — fails the test on malformed input.

BackfillOAuthConnections tests (PLAN-1519 / TASK-1522 / IDEA-1517 §2). What's covered: - Pre-TASK-952 session (no key) → all_current=1, no

OAuth connection store tests (PLAN-1519 / TASK-1520 — Phase A foundation). What's covered: - CreateOAuthConnection + GetOAuthConnection round-trip w

newPadServer stands up the same *server.Server that production uses, wired to a fast fixture SQLite store (storetest.NewSQLite, IDEA-1914). Mirrors te

newTestRequest builds an OAuthRequest with sensible defaults; tests override fields they care about. signature uniqueness is the caller's responsibili

renderMD is a small test helper that builds + renders the synthetic tree with a fixed clock and returns the markdown output as a string.

runOrphanGCSweep walks the orphaned-attachments query and reclaims rows past the grace period. Two reclamation paths: - DB row only. content_hash is