RFC 8707 ("Resource Indicators for OAuth 2.0") audience-binding hook for pad's authorization server (PLAN-943 TASK-951 sub-PR B). fosite has no nativ

NormalizeMIME strips parameters and lowercases the type/subtype. We match strictly against the allowlist after normalization so callers can pass an ht

Ping verifies the database connection is alive.

PublicLinkBaseURL returns the URL the server should embed in emailed links (password reset, invites, share links, admin invitations). Resolution order

RemovePadEntry deletes mcpServers.pad while leaving other servers + top-level keys intact. Returns (true, nil) when an entry was removed, (false, nil)

Resize returns a new image with the longer edge fitted to maxLong, preserving aspect ratio. Images already within maxLong are returned unchanged so ca

RevokeAccessToken mirrors RevokeRefreshToken for access tokens. fosite calls these in pairs when revoking a grant (the unified "revoke the whole famil

RevokeUserOAuthConnection invalidates every token in the OAuth grant chain identified by requestID, after verifying the chain belongs to userID. Impl

RotateAPIToken generates a new secret for an existing token, preserving all metadata (name, scopes, workspace, user, expiry). The old token is invalid

SetAttachments wires the attachment storage Registry that the upload and download handlers use. Pass maxBytes = 0 to keep the defaultAttachmentMaxByte

OAuth 2.1 authorization-server HTTP handlers (PLAN-943 TASK-951). Sub-PR C built the /register, /authorize, /authorize/decide and token endpoints + th

SetSSELimits configures global and per-workspace SSE connection limits. A value of 0 means unlimited.

SetTokenReaperConfig overrides the default sweep interval (1h). Pass 0 to keep the package default. Must be called before StartTokenReaper; calling af

SetToolSurfaceHandler wires the MCP catalog→JSON serializer onto the server (PLAN-1888 / TASK-1891). Called once at startup by cmd/pad/main.go with mc

SetUserRole updates a user's role (admin or member). When demoting an admin to member, the update is conditional: it only proceeds if at least one oth

StartTokenReaper kicks off the periodic sweep that deletes expired/used email-verification tokens, password-reset tokens, sessions, and CLI-auth sessi

StatusColor returns a *color.Color appropriate for the given status string.

Subscribe registers a subscriber for the given item and returns a buffered channel of OpEvents. Caller is responsible for calling Unsubscribe (typical

Uninstall removes the pad entry from the named agent's config. Idempotent: a missing file or missing entry is not an error and returns (path, false, n

UpdateItemWithParentLink is UpdateItemWithPreCheck plus an OPTIONAL parent-link mutation applied inside the same transaction (BUG-2013). When parentLi

UserHasGrantsInWorkspace checks if a user has any active collection or item grants in a workspace (even though they are not a member). Used to detect

ValidateWebhookURL checks that a webhook URL is safe to call. It rejects non-HTTP(S) schemes, URLs with credentials, private/reserved IPs (loopback, l

WithMCPTokenIdentity stashes the bearer-token identity so the MCP audit middleware can record which connection drove the call. kind is the discrimina

asOpenChildrenGuardError unwraps a store-layer error that may carry an openChildrenGuardError sentinel. Returns the sanitized details and true when th

MCP audit middleware tests (PLAN-943 TASK-960). What's covered: - A successful tool call writes one audit row with the right tool_name + args_hash +

--- Auto-create Workspace (TASK-432) --- autoCreateWorkspace creates a default workspace for a new user in cloud mode. Called after user creation in r

buildBootstrapURL constructs the /setup URL the operator should open. setup_method dispatch (kept in sync with handleSessionCheck in internal/server/

buildChildrenDoneExpr compiles a set of per-collection done filters into a single SQL boolean expression plus ordered args. `itemAlias` is the item-ta

buildDashboardResponse is the canonical dashboard-assembly path. The HTTP handler (handleGetDashboard) is now a thin wrapper around it, and the bootst

buildReconcileFindings returns the reconcile findings for the given item. The item argument MUST be non-nil — the production caller (reconcileItem) an

===================================================================== Helpers ===================================================================== by

callWorkspaceViaOAuth simulates an MCP-driven workspace API call by going through MCPBearerAuth's OAuth path. The MCP transport stub the test harness

clearCSRFCookie removes the CSRF cookie (e.g. on logout). Must clear both prefixed and unprefixed names to handle upgrades cleanly.

computeSSEVisibility resolves the caller's current visibility snapshot. Safe to call repeatedly on a live SSE connection — each call fetches the lates

counterValue is a tiny helper that pulls the float value out of a Prometheus counter.

createChildItem creates a test item and wires it as a child of parentID via SetParentLink — the same path the HTTP handler takes in production (handle

dialWSSince is the resume-cursor variant: appends `?since=<id>` to the WS URL so the test exercises the TASK-1319 force_refresh path.

doAuthedDeleteWithCSRF issues a DELETE with both the session cookie + the CSRF double-submit pair. The session-cookie code path requires CSRF on every

doHeadlessBootstrap is the shared core of the non-interactive (agent) admin bootstrap introduced by BUG-988. Both setupCmd and padInitCmd funnel throu

emailUnverifiedBlocked is the central predicate for PLAN-1933 DR-4's email-verification gate. It reports whether a request carrying `user` must be rej

--- Plan Limit Enforcement --- enforcePlanLimit checks a workspace-scoped plan limit and writes a 403 error if the limit is exceeded. Returns true if

ensureRouter lazily initializes the router on first use, so all Set* configuration is applied before the middleware chain is built.

evict removes an entry. No-op on empty id or unknown id. Fires onChange only when an entry was actually removed. See touch's comment for why onChange

forcePlainColor disables ANSI so width/content assertions are deterministic regardless of whether the test binary's stdout happens to be a TTY.

guardSchemaAhead refuses to start when the database contains migrations this binary doesn't ship — i.e. the DB is AHEAD of the binary, the tell-tale o

handleCmdhelpCapabilitiesFallback scans args for the --cmdhelp-capabilities flag (cmdhelp v0.1 §8 fallback form). If found, it writes the capability b

headlessTestServer builds an httptest.Server that speaks the minimal subset of the Pad API that the headless bootstrap path touches: - GET /api/v1/a

============================================================ Helpers — shared by the three "request-row" tables ======================================

isSupportedOAuthProvider reports whether provider is one pad accepts.

itemLock returns the lazily-allocated mutex guarding setup-phase operations on itemID. Locks live in the manager for the lifetime of the process — for

itemRefOrSlug formats an item's issue ref (e.g. "TASK-5") when its collection prefix + item number are populated, falling back to its slug. Avoids pul

itoa is strconv.Itoa renamed to keep test bodies readable when they're already heavy on ref-formatting.

mapRoleUpdate dispatches `pad role update <slug> [--name ...] [--slug ...] [--description ...] [--icon ...] [--tools ...] [--sort-order ...]`. PATCH

mkAdminCookieReq is the same shape minus the Authorization header. Simulates the cookie-session path where isBearerAuth must return false and the admi

mustCreatePATForTest creates a real PAT against a fresh user + workspace. Returns the raw token string suitable for the Authorization: Bearer header.

mustWorkspaceID resolves a workspace slug to its internal ID via the store. Tests use it because they don't have access to the request context that ge

normalizeCollectionSlug maps common singular/short forms to actual collection slugs. Thin wrapper around the shared collections.NormalizeSlug so the C

normalizeServerURL canonicalizes a server URL for use as a credential key. Trailing slash and surrounding whitespace are stripped; nothing else is tou

normalizeWebhookEvents canonicalizes a webhook's event filter to the JSON-array string the store + dispatcher expect. Returns (value, true) when a no

numericInput pulls an int64 out of a JSON-typed input value. JSON decoders deliver numbers as float64 (or json.Number when UseNumber()); we accept bot

oauthRequestToFositeRequest hydrates a stored row into a fresh fosite.Request, fetching the client by ID and unmarshalling the session bytes into the

Surface an upload failure to the user.

openBootstrapEnabled reports whether open-bootstrap is active for this server: bypass flag is set AND we're not in cloud mode. Cloud mode always wins

parseCollectionFieldsDSL parses the CLI's --fields DSL into a {fields: [...]} map ready for json.Marshal. Empty input returns an empty Fields slice (t

publishCommentEvent publishes a real-time event for comment changes.

queryOAuthRequestRow reads a row by signature from the named table and returns (request, active, err). - For oauth_pkce_requests, active is always tr

rawPeerAddr returns the untampered TCP peer address captured by CapturePeerAddr, falling back to the current r.RemoteAddr if the middleware wasn't ins

readItem handles pad://workspace/{ws}/items/{ref}. Why JSON-then-format instead of `--format markdown`: pad's CLI `--format markdown` for `item show`

readMigrationNames returns sorted .sql filenames from an embedded FS directory.

Helpers ------------------------------------------------------------------

recordMCPAuthzDenial bumps the pad_mcp_authz_denials_total counter when the request originated from the MCP surface. The discriminator is the presence

recordMCPCallMetrics fans the audit-row data out to Prometheus. No-op when metrics aren't wired (selfhost / tests). Kept separate from MCPAuditLog so

recoverSweeper is the panic firewall for the long-running background sweeper loops (orphan GC, op-log GC, token reaper, workspace purge). Each of thos

--- helpers --- registerNonAdmin inserts a member-role user directly into the store and mints a session token for them. Bypasses the admin-registratio

replaceWikiLinks deletes prior wiki-link rows for `sourceItemID` and inserts fresh ones extracted from `content`. Resolution against the workspace's i

requireConnectionOwner is the per-mutation prologue. Returns the (currentUser, requestID, ok) triple. On `ok=false` the response has already been writ

requirePostgresForConcurrency skips a test unless a real PostgreSQL backend is configured. The parent-link TOCTOU races (BUG-2073) are Postgres-only:

respondWithConnection re-fetches + writes the connection DTO post- mutation so the page can re-render without a separate list refresh. Stats lookup is

rootFlagsToArgs converts a startup root-flags map into the pre-formatted CLI token list every fetch should append. Empty values are skipped (matching

run executes fn on the injected spawner, or a plain goroutine if none is set.