Get returns the current session workspace, or empty string when none has been set.

IsConnectionWorkspaceAllowed reports whether workspace_id appears in the connection's allow-list. Used internally by GetOAuthConnectionAccess when cal

IsDisabled returns true if the user account has been disabled.

ListMCPAuditByUser returns the user's most recent audit rows in reverse-chronological order. limit caps the page; offset paginates. Caller must enforc

NewSQLite returns a *store.Store backed by a fresh SQLite file in t.TempDir(), fully migrated. See the package doc for the template+copy mechanism. St

Provider returns the fosite.OAuth2Provider that sub-PR C's HTTP handlers will call (NewAuthorizeRequest, NewAccessRequest, WriteAuthorizeResponse, etc

PruneSweep finds every item whose ENTIRE op-log is older than `minAge` and prunes the whole op-log for those items under the per-item lock. Returns a

RelativeTime returns a human-readable relative time string.

SubscriberCount returns the number of active subscribers for the given item. Useful for room-manager TTL accounting (TASK-1255 — when the count hits 0

adminBillingReq fires GET /api/v1/admin/billing-stats with the cookie from a logged-in user. Returns the recorder so callers can inspect status + body

buildPlainShell builds the plain-text body for transactional emails. Self-hosted output is byte-equivalent to the prior templates. Cloud output adds a

buildQuery returns the URL-encoded query string for the mapping (without the leading '?'). Empty mapping → empty string. Numbers from JSON arrive as

cancelInit is the canonical exit path for both Ctrl+C and explicit "Cancel" actions during pad init / pad workspace init. It prints a brief message to

checkItemVisible is the context-free visibility decision. Returns (true, nil) when the (user, role) pair can see `item` under the same rules `requireI

decodeEnvelope helper extracts the ErrorEnvelope from an MCP error result. Uses textOf (the shared helper in catalog_test.go) to retrieve the JSON bod

dispatchWebhook fires a webhook event if a dispatcher is configured.

doClaim issues a POST /api/v1/oauth/claim with Bearer PAT auth. extraReqID, if non-empty, attaches a WithMCPTokenIdentity context override to simulate

encrypt encrypts plaintext using AES-256-GCM and returns a base64-encoded ciphertext prefixed with "enc:" to distinguish from plaintext values.

enrichItemsWithParent batch-populates parent link info on a slice of items. Used by list endpoints where calling enrichItemForResponse per-item is too

── Shared helpers ──────────────────────────────────────────────────────────── ensureWorkspace checks if the current directory is linked to a workspac

findFieldOptions returns the Options slice for the named field on a collection's schema, or nil if the field is missing.

--- helpers ---

getWorkspace returns the full workspace object resolved by middleware. Falls back to direct resolution for routes without RequireWorkspaceAccess.

hopTransitions returns only the "real" status hops — excluding the create-time "entered initial status" seed row (id prefix "create_") that every crea

isCancellation reports whether err represents a user-initiated abort from any interactive init prompt. Init RunEs use this to convert the sentinel int

isolateHome redirects HOME to a temp dir and chdirs to a fresh temp project dir so credential writes and .pad.toml detection don't leak into the real

itemPrefetchHandler routes /api/v1/workspaces/{ws}/items/{ref} GETs to a static map keyed by ref so each link-test can declare just the items it needs

readControlWithin reads frames off the conn within d, drains payload (binary) frames, and returns the FIRST TextMessage parsed as a ControlMessage. Te

seedGrantee creates a throwaway user to be the recipient of a grant, for tests that need a real grant/link ID on a hidden or visible resource (BUG-192

stopMCPSessionTracker signals the sweeper to exit. Called from Server.Stop. Idempotent.

tokenWorkspaceID returns the workspace ID set by the TokenAuth middleware, or an empty string if no token was used.

AllowedAudience returns the canonical resource URL the server is configured to accept. Sub-PR C's /authorize handler reads this to reject mismatched `

ApplyPatch applies a patch to baseText to produce the target text. Returns an error if the patch cannot be applied cleanly.

CloudMode reports whether the marketing footer is currently enabled. Templates read it through getCloudMode() so they pick up the same snapshot for th

ComputeRef sets the Ref field from CollectionPrefix and ItemNumber. Call this after populating the item from a database query.

ConvertGeneric converts an HTML document into markdown by first running go-readability to strip chrome, navigation, and ads, then piping the cleaned H

DeleteUserSessions destroys all sessions for a user (logout everywhere).

DetectTools returns the tools that appear to be in use, based on any of: a project-local directory, a home-directory install, or a binary on PATH.

EmitJSON walks the command tree below `target`, builds a cmdhelp v0.1 Document, and writes it to w as indented JSON terminated by a newline. `root` M

EnableTOTP atomically enables 2FA for a user and stores hashed recovery codes. The expectedSecret is the plaintext secret — it's compared against the

EnsureBootstrapToken generates a fresh first-run bootstrap token (or loads the existing one if a valid file is already present). Returns the token str

GetAccessToken hydrates an access token by its HMAC signature. Returns ErrOAuthInactiveToken if the row exists but has been revoked / rotated out, Err

GetBillingMetrics fetches an aggregated Stripe-derived snapshot from pad-cloud's /admin/metrics/billing endpoint (active subs, MRR, ARR, churn, cancel

===================================================================== fosite.ClientManager ===========================================================

GetRefreshToken hydrates a refresh token. Returns ErrOAuthInactiveToken when active=false, which fosite uses to trigger family revocation on the match

HasOAuthProvider returns true if the user has linked the given provider.

InstallForTool writes the skill content to the appropriate location for a tool.

IsExpired reports whether an invitation is past its expiration window. Invitations created before the expires_at migration (nil ExpiresAt) are treated

IsItemStarred checks whether a specific item is starred by a user.

ListAuditLog returns activities matching the given audit log filters. Supports filtering by action, actor, workspace, and date range.

NewRoomManagerWithConfig is the explicit-config form. Empty config fields fall back to package defaults.

NewSender creates a new email sender.

NormalizeSlug maps the common singular / shorthand collection-name forms users actually type ("task", "idea", "doc", etc.) to the canonical plural slu

PlaybookLibrary returns all pre-defined playbook categories with their playbooks. As of PLAN-1397's invokable-first overhaul (TASK-1403), the library

PromptBody returns the canonical body text for a registered prompt. Exported so tests can assert lockstep with SKILL.md without duplicating the litera

Register installs store under prefix (e.g. "fs", "s3"). The prefix MUST NOT contain a colon — Resolve splits keys on the first colon, so a prefix with

RemoveWorkspaceMember removes a user from a workspace.

RenderMarkdown writes a Document as markdown matching cmdhelp v0.1 §6. Useful for tests that build a Document manually and want to render it without r

RenewSessionIfStale implements sliding-window expiration. When a session is past its renewal threshold (less than half its renewal window remaining) i

ResolveTool finds an AgentTool by name or alias. Returns nil if not found.

RevokeAccessTokenFamily mirrors RevokeRefreshTokenFamily for access tokens. fosite calls these in pairs when revoking by request_id (the unified Revok

SetEmailSender attaches a transactional email sender. The apiKey is stored separately for deriving the unsubscribe HMAC secret. If the server is alre

SetOpLogGCConfig overrides the default sweep interval (1h) and minimum row age (24h). Pass 0 for either to keep the package default. Must be called be

SetSpawn injects the goroutine spawner used for deliveries. Passing the server's tracked-goroutine helper (Server.goAsync) makes Server.Stop() wait fo

SetUserPlanOverrides updates per-user limit overrides (JSON string).

StartOpLogGC kicks off the periodic prune-sweep loop. Idempotent — calling twice silently no-ops. Must be called AFTER SetCollabRoomManager; the loop

Subscribe registers a subscriber for itemID and returns a buffered channel of size subscriberBufSize.

TouchUserWrite updates last_write_at for a user, throttled to avoid write amplification. Only writes if the stored value is older than 5 minutes. Best

UnmarkStripeEventProcessed deletes a row from stripe_processed_events, allowing Stripe retries of the same event ID to be handled again (TASK-736). Us

Unsubscribe removes a subscriber and closes its channel. Safe to call with an already-removed channel — no-op in that case.

UpdateUser updates mutable user fields.

ValidatePartialFields validates ONLY the keys present in `patch` against the schema (TASK-2022, field-level PATCH / IDEA-1480). Unlike ValidateFields

ValidatePassword checks an email/password combination. Returns the user if valid, nil if the credentials are wrong (not an error).

ValidateToken hashes the provided plaintext token, looks it up in the database, checks expiry, and updates last_used_at. Returns nil if the token is i

VerifyClaimCode returns true if code matches the derived code for (userID, workspaceID) at the current OR previous time bucket — the sliding 5–10 minu

WorkspaceStorageUsage returns the total bytes consumed by non-deleted attachments in the workspace. Includes derived blobs (thumbnails) — those are re

WriteWorkspaceLink writes a .pad.toml in the given directory. serverURL is the base URL of the Pad server hosting this workspace. Pass the empty stri

acquireWorkspaceSeqLock takes a Postgres advisory transaction lock keyed on the workspace ID so concurrent seq-bumping mutations serialize. The lock a

apiRequest makes a JSON API request to the test server.

buildToolFromDef compiles a ToolDef into the mcp.Tool shape mcp-go expects. The schema is flat: `action` is required, every other parameter is optiona

conventionsCollection returns a Conventions collection scoped to the caller's domain. The trigger and scope select options are supplied by the caller

countIPChangeEvents returns the number of session_ip_changed rows in the audit log.

decryptUserTOTP decrypts the TOTP secret on a User struct in place.

displayWidth returns the visible column width of s: ANSI SGR escape sequences are stripped, then the remaining runes are counted. Every rune is approx