assertNotEmailBlocked asserts the response is NOT a verified-email 403 (it may legitimately be a 2xx, or a 4xx for an unrelated reason).

buildAllowSet returns nil for the "no token-level filter" cases (nil allow-list, or wildcard) and a slug-set otherwise. Matches the three return-shape

classifyHTTPStatusKind turns an HTTP error response into a structured envelope, using the dispatcher's known resource context to emit the right error

This file pins BUG-1925: handleSetMemberCollectionAccess gated only on requireRole(r, "owner"), with zero validation of the CALLER's own visibility. A

createUnverifiedUser makes a user whose email starts UNVERIFIED, so a consume can be observed flipping it verified. CreateUser's safe default is verif

decodeFields is a small test helper: parse an item's fields JSON into a map.

enrichItemForResponse populates derived closure and parent info on a single item. An optional visibleIDs slice filters related items so hidden-collect

errStructured wraps a Go error into the standard MCP tool-error envelope (TASK-1077) with a stable identifier prefix (e.g. "pad_item.link"). Local hel

fakeYjsRow constructs a single row for the fakeOpLog seeding helpers. The store assigns ids in production; tests don't depend on them.

fetchAsResource is the shared shell-out + wrap path. padArgs is the leading argument list (without root flags); rootArgs are appended so --url etc. su

fixtureDoc returns a small cmdhelp.Document with the items the catalog tests need most often. Catalog actions only require their own cmdPath to be pre

formatItemAsMarkdown turns the JSON body returned by `pad item show --format json` into a self-contained markdown document: heading with ref + title,

gaugeValueOrZero pulls the gauge value or returns 0 when the underlying metric hasn't been touched yet.

grantHiddenItemToOwner gives the fixture's restricted owner an item-level grant on the hidden item, independent of their collection_access restriction

isItemDone reports whether an item is in a terminal state for its collection's configured done field. Falls back to the default-terminal list against

isPublicAPIPath reports whether the given request path is an API endpoint that bypasses authentication entirely. These handlers must work even when th

makeIntegrationPNG returns a real PNG large enough that both thumb-sm (256px) and thumb-md (1024px) variants must scale down. Filled with a stripe pat

maskAPIKey returns the display form of a sensitive setting value. Keys longer than 8 chars show their first and last 4 chars (abcd...wxyz); shorter no

mintOAuthTokenForTest drives the consent → token exchange and returns the access token. Lightly customizable via the form arg so callers can vary the

BUG-1616 extended coverage — admin-via-bearer gate at the SSE and WebSocket-collab entry points that sit OUTSIDE RequireWorkspaceAccess. These endpoin

newRootCmd constructs the pad CLI's root cobra command tree. Extracted from main() so tests can use the real tree (golden snapshots, schema validatio

newWebhookTestWorkspace creates a user + workspace so webhook FK constraints are satisfied, and returns the workspace ID.

observeOAuthFlowDuration records the elapsed time since `start` for the given stage. Designed to be `defer`'d at the top of each OAuth flow handler so

* Open the workspace's IDB database for the given user, creating * object stores on first run. Cached so subsequent calls reuse the * connection. Re

parseFieldKVP normalizes the --field flag's various wire shapes (single string, []string, []any) into a `key→value` map. Empty / invalid entries are s

pathFor returns the full on-disk path for a given hash. Callers MUST have already validated the hash via validHash — this function does not re-check,

percentile returns the linearly-interpolated p-quantile (p in [0,1]) of vals, rounded to 1 decimal. 0 for an empty sample. Computed in Go so the same

postOAuthLogin fires a cloud-secret-authenticated oauth-login request and returns the recorder. The cloud secret rides the JSON body (the same channel

publishEventWithName publishes a real-time event with actor name.

publishItemEventWithName publishes a real-time event for item changes with actor name. `seq` is the item's workspace-scoped monotonic mutation cursor

remoteCfg builds a Config wired to point at the given test server URL.

remoteHeadlessCfg builds a Config wired to point at the given httptest server URL in Remote mode. Remote mode makes EnsureServer a no-op.

requireCommentVisible checks that a comment's underlying item is in a visible collection. Writes a 404 and returns false if not.

resolveRoleSlug rewrites a `--role <slug>` input into `agent_role_id <uuid>` by hitting the agent-roles endpoint and finding a matching role. Mirrors

resolveWorkspace resolves a workspace by slug or UUID, scoped to the authenticated user's accessible workspaces when a user context is present. Return

retryOnParentSetChanged runs fn, retrying (up to maxParentLockRetries) while it returns errParentSetChanged. fn MUST open and own its own transaction

scanAttachment scans a single row into a models.Attachment, handling nullables via *string / *int.

scanUser scans a user row into a User struct. Note: does NOT decrypt the TOTP secret — call store.decryptUserTOTP() after scanning if you need the pla

seedAccess inserts an access-token row in the chain identified by requestID. ts is the requested_at timestamp; sessionData + scopes land on the row. R

seedClient creates an oauth_clients row so chains have something to FK against. Returns the client ID.

seedGrantChain inserts one access-token row in a chain. Returns the request_id so tests can revoke / list / audit by it.

seedWorkspaceForConn creates a workspace and returns its ID — the join table stores workspace IDs, so tests need a real row.

setupEnsureWorkspaceTest produces a clean tempdir, points HOME at a tempdir (so credential/config writes don't leak), chdirs into the project so cli.D

softDeleteWorkspaceAt stamps a workspace's deleted_at to a specific time so the sweep's age cutoff can be exercised deterministically — there's no API

sseSubscriberStillHasAccess re-runs the workspace access check for an already-subscribed SSE client. Returns false when the caller can no longer see t

testStorePostgres creates an isolated test database on the PostgreSQL server. It connects to the base URL, creates a randomly-named database, runs mig

uniqueSlug generates a unique slug within a scope by appending -2, -3, etc.

withLocalFetcher replaces the package-level fetcher with one that allows loopback dials so httptest.NewServer addresses (127.0.0.1) can be reached. Re

CheckUserLimit checks a user-level limit (not workspace-scoped), such as total workspace count or total API tokens.

Cleanup removes the process-wide template database, if one was built. Call it from TestMain after m.Run() so a lazily-built template file doesn't ling

============================================================ Authorization codes (handler/oauth2/storage.go AuthorizeCodeStorage) ====================

CreatePatch computes a compact patch that transforms oldText into newText. The patch can be applied with ApplyPatch to recover newText from oldText.

CreateReversePatch computes a patch that transforms newText back into oldText. Used for reverse-diff version storage: current doc has latest content,

D returns the store's dialect for building backend-specific SQL.

EncryptWebhookSecretsAtRest encrypts plaintext webhook HMAC secrets (BUG-2057). Called on startup when an encryption key is configured. It handles two

ExportWorkspace exports all data for a workspace into a portable format.

FTSRank returns the column/expression for full-text relevance ranking. SQLite: rank (built-in FTS5 column) — consumes ZERO args. PostgreSQL: ts_rank b

FindAgent returns the matching Agent for a name or alias. Names are case-insensitive (Claude / claude / CLAUDE all resolve).

--- Username backfill --- GenerateUsername derives a URL-safe username from a display name. Falls back to the email local part if the name produces an

GetChildItemsForParents returns the live child items for each of the given parent item IDs, grouped by parent ID, in ONE query — collapsing the per-pa

GetInvitationByCode retrieves a pending invitation by its join code. Looks up by SHA-256 hash first (new invitations), then falls back to plaintext lo

GetUserByUsername retrieves a user by username (case-insensitive).

GroupTemplatesByCategory returns the visible workspace templates grouped by category in the canonical CategoryOrder. Categories with no visible templa

HasEncryptionKey reports whether an encryption key is configured.

IsDiffSmaller returns true if storing a diff would be meaningfully smaller than storing the full content. Returns false for near-complete rewrites whe

IsWorkspaceMember checks if a user is a member of a workspace.

--- Agent Roles --- ListAgentRoles returns all agent roles for a workspace.

ListCollectionsMinimal returns collection rows populated with just the fields needed for done-detection context and slug lookups: ID, Slug, Schema, Se

ListItemVersions returns all versions for an item.

ListItemVersionsResolved returns versions with full content (diffs resolved). Requires the current item content to reconstruct diff-based versions.

--- Workspace Members --- ListWorkspaceMembers returns all members of a workspace.

LookupEmailVerification performs a read-only validation of a verification token and returns the associated user WITHOUT consuming the token. Mirrors L

LookupMIME returns the entry for a MIME type if it is on the allowlist, or (zero, false) if rejected.

MCPTokenIdentityFromContext returns (kind, ref) attached by WithMCPTokenIdentity, or ("", "") if none was set. The audit middleware uses this to popul

MetricsMiddleware returns a chi middleware that records Prometheus metrics for every HTTP request: count, duration, and response size. Path labels us

NewInstrumentedBus wraps an EventBus with Prometheus instrumentation.