slugify converts a string to a URL-friendly slug.

uploadHelper does a fresh upload and returns the parsed response.

waitForEvent reads from the event channel with a timeout.

withTempHome chroots ~/.pad to a fresh tempdir for the test. CredentialsPath resolves via os.UserHomeDir → $HOME, so a t.Setenv("HOME", ...) is enough

writeItemResolveError distinguishes a soft-deleted (archived) item from a genuinely-missing one for mutation handlers. An archived item still appears

CreateComment adds a new comment to an item. userID is the authenticated user authoring the comment (empty for agent/system comments); it's stored as

--- Invitations --- CreateInvitation creates a pending workspace invitation. Generates a 128-bit (16-byte) random code and stores only its SHA-256 has

EnsureEncryptionKey makes sure the server has a usable encryption key without requiring the operator to set one explicitly. Resolution order: 1. If c

EventsSince returns events for a workspace with IDs greater than sinceID. Used to replay missed events on SSE reconnect (Last-Event-ID). Returns nil i

FormatForTool takes the raw embedded skill content and formats it for a specific tool. Returns the appropriately formatted content with tool-specific

IsCloud reports whether the server is running in cloud mode.

MoveItem moves an item to a different collection within the same workspace. It updates the collection_id and fields JSON. The item_number is preserved

ParseTrustedProxyCIDRs parses a comma-separated list of CIDRs or bare IPs from the PAD_TRUSTED_PROXIES setting. Bare IPs get /32 (IPv4) or 128 (IPv6).

Send sends an email using the default from address/name.

SetBypassSetupToken wires the operator's PAD_BYPASS_SETUP_TOKEN choice into the Server. When true, handleBootstrap accepts a self-host first-admin POS

SetIPChangeEnforce controls how the auth middleware reacts when a session's binding (client IP OR User-Agent hash) changes mid-lifetime: - mode == "st

MCP transport state. Set at startup by cmd/pad/main.go via SetMCPTransport when the deployment is in cloud mode (PAD_MODE=cloud). Self-hosted deployme

TerminalValuesForDoneField returns the resolved done-field key and the list of terminal values for that field. If the resolved field has no terminal_o

ValidateExamples is the contractual mechanism by which cmdhelp v0.1 prevents documentation drift (spec §6, §11 Q5). For every example in every command

--- TOML config path (Codex) -------------------------------------------- Codex nests its MCP servers in a TOML `[mcp_servers.pad]` table, so the JSO

audienceMatchingStrategy returns a fosite.AudienceMatchingStrategy that enforces "every requested audience must equal the configured canonical audienc

createTaskWithFields is a small helper for the field-patch/OCC tests: POST a task with the given fields JSON and return the created item.

csrfCookieName returns the CSRF cookie name. Uses the same __Host- prefix strategy as the session cookie.

decrypt decrypts a value that was encrypted with encrypt(). If the value doesn't have the "enc:" prefix, it's treated as plaintext (backward compatibi

doJSONReq drives a JSON request through srv and returns the recorder. Mirrors the local pattern in internal/server/server_test.go::doRequest, kept pac

doRequestWithHeadersFromAddr lets us combine arbitrary headers with a non-loopback remote-addr. Existing helpers cover one or the other but not both.

docWith constructs a minimal Document with two commands sharing a `collection` arg (caching test) and one `role` flag.

fakeSessionServer returns an httptest.Server whose /api/v1/auth/session handler responds with the SessionResponse produced by `gen` (called once per r

mapCollectionUpdate dispatches `pad collection update <slug> [--name ...] [--icon ...] [--description ...] [--prefix ...] [--schema ...] [--fields ...

newMCPSessionTracker constructs a tracker with the given TTL and optional onChange callback. ttl <= 0 falls back to the default; onChange may be nil (

newStub starts a test HTTP server and returns a CloudClient pointed at it. Callers supply the handler to control the response.

readBinaryWithin reads a single binary frame within d. Returns the payload bytes or fails the test on timeout.

seedBackfillClient mirrors seedClient in connected_apps_test.go but stays internal to this file so the backfill suite can run in isolation when other

seedConnectedAppForMutations creates a user + workspace + an oauth_connections row directly so the mutation handlers have something to mutate. Returns

Phase 2 permission test suite (TASK-488). Tests collection-level visibility, system collection exemptions, and the VisibleCollectionIDs resolution log

* Read a string param. Absent (undefined/null) returns undefined — not an * error, matching strArray's absent-vs-malformed line. A present value of a

validatePasswordStrength enforces length + strength. It rejects weak passwords at registration / rotation / reset so top-of-breach-list entries like "

workspaceRole returns the user's role in the current workspace, as set by RequireWorkspaceAccess. Returns empty string if not set.

AllowedWorkspaces returns the workspace allow-list stored in session.Extra at consent time (TASK-952). Three return shapes matter to callers: - nil —

ApplyExternalContent routes an external content update through a designated applier when an active room exists. Returns nil on successful ack; one of

============================================================ Refresh tokens (handler/oauth2/storage.go RefreshTokenStorage) ==========================

DoneFieldKey resolves which field on a collection's schema represents "is this item done?". The resolution is: 1. If CollectionSettings.BoardGroupBy

EncryptionKeyFile returns the on-disk path where an auto-generated encryption key is persisted. Operator-provided keys (PAD_ENCRYPTION_KEY env, encryp

Fetch performs a GET against rawURL, re-validating every redirect hop and aborting if the response exceeds the size cap. Returns a wrapped error suita

GetComment returns a single comment by ID.

GetParentForItem returns the parent link for an item, or nil if it has no parent. A parent link pointing to a soft-deleted item is treated as no paren

Install adds (or refreshes) the pad entry in the named agent's config. Returns the resolved path + whether the file was actually modified (false on a

MigrateFields maps field values from a source schema to a target schema. Fields with matching keys and compatible types are transferred. Incompatible

NewRegistry returns an empty registry.

NewServer constructs an OAuth 2.1 authorization server backed by fosite v0.49.0. Compliance posture (PLAN-943 TASK-951): - PKCE required (S256 only)

ResolveAttachmentReferences scans `markdown` for `pad-attachment:UUID` references in standard markdown image/link syntax and replaces each with render

TrustedProxyRealIP returns middleware that rewrites r.RemoteAddr from X-Real-IP / X-Forwarded-For ONLY when the direct TCP peer is within one of the s

WithTokenAllowedWorkspaces returns ctx decorated with the OAuth token's workspace allow-list set at consent time (TASK-952). The list is either a set

WithTokenScopes returns ctx decorated with the API token's JSON-encoded scopes string (e.g. `["read"]`, `["*"]`). Stashed by the MCP Bearer middleware

applySQLiteMigration applies a single migration file atomically. Behavior (IDEA-1485): 1. PRAGMA statements are lifted out of the migration body (se

assertBlocked asserts the response is a 403 email_not_verified.

auditUser creates a user that subsequent audit rows can FK-reference. The schema requires user_id REFERENCES users(id), so we can't insert audit rows

buildFositeRequest produces a fully-populated *fosite.Request so adapter tests can drive Create*Session methods without depending on fosite's HTTP ent

buildHTMLShell wraps body HTML in the standard transactional-email chrome — header (Pad wordmark) + body + footer note + (Cloud only) marketing footer

doRequestWithCookieFrom is like doRequestWithCookie but lets the caller set the request RemoteAddr so tests can simulate a session jumping to a differ

expandPath substitutes {key} placeholders in template using input. Each placeholder must appear as a non-empty string in input; otherwise expandPath r

isItemVisibleToGuest checks if an item is visible given grant-based access, considering both full-collection grants and individual item grants. When f

logActivity is a helper that logs activity, ignoring errors (best-effort).

mapCollectionCreate dispatches `pad collection create <name> [--fields key:type[:opts]; ...] [--icon ...] [--description ...] [--layout ...] [--defaul

maybeInjectWorkspace defaults the `workspace` input from the dispatcher's WorkspaceLister when the caller didn't pass one explicitly (TASK-1076). The

Store-layer tests for the MCP audit log (PLAN-943 TASK-960). What's covered: - InsertMCPAuditEntry validates required fields and round-trips correct

packageJSONResult converts a CLI stdout string into an MCP tool result. JSON bodies surface as structuredContent; non-JSON falls back to text. Top-lev

packageStructuredResponse encodes payload to JSON, then decodes it back to a generic any so the StructuredContent surface matches the shape MCP client

parseExamplesFromLong extracts the indented invocation lines that follow an "Examples:" header in a cobra Long string. Returns nil when no such sectio

pickTemplateInteractive presents a numbered list of visible templates grouped by category and returns the chosen template's Name. Returns the default

postOAuthFormBearer POSTs an x-www-form-urlencoded body with a Bearer Authorization header (used for /oauth/introspect, where fosite v0.49 requires ei

requireCollectionFullyVisible checks that the collection is visible to the requesting user under FULL-collection-access semantics (BUG-1920 — codex R2

resolveAssignName rewrites a `--assign <name|email>` input into `assigned_user_id <uuid>` by hitting the workspace-members endpoint and finding a matc

size returns the current entry count. Used by tests and by startMCPSessionTracker's initial gauge prime.

touch inserts or refreshes an entry. No-op on empty id (defensive: callers pre-filter, but a missing header should never bump anything). Fires onChang

validateCloudSecret checks the cloud_secret field in a JSON request body against the server's configured cloud secret. Returns true if the secret matc

BrowserURL returns a URL suitable for displaying to humans in CLI prompts (e.g. "Or open the web UI at X"). It behaves like BaseURL except that when t

BuildMetaPayload returns the meta payload for the given pad runtime version. An empty padVersion falls back to FallbackVersion for the same reason ser

CheckSession returns the current auth status.

ConvertOpenAPI converts an OpenAPI 3.x specification into a human-readable markdown document. The output is organized as: - H1 with the API title - I

CountBacklinks returns the total number of same-workspace backlinks the requester would see for a given target, applying the same visibility filter as

CreateEmailVerification generates an email-verification token for the given user. Returns the plaintext token (to embed in the verification URL). The

CurrentUserFromContext returns the user attached by WithCurrentUser (or by the standard auth middleware), and a boolean signalling whether one was pre