isBearerAuth reports whether the request was authenticated via an Authorization: Bearer header rather than a browser session cookie. True for: PATs on

===================================================================== mcp ↔ OAuth integration (sub-PR E, TASK-1027) ==================================

newRequest creates an http.Request with auth and agent headers set.

postFormWithCookie POSTs an x-www-form-urlencoded body with both a session cookie and the matching CSRF cookie set, plus the session-bound User-Agent.

BackfillOAuthConnections walks every distinct grant chain found in oauth_access_tokens and oauth_refresh_tokens, parses the newest chain row's session

Close shuts down the event bus and cleans up resources.

CreateShareLink creates a new share link and returns it with the raw token. The raw token is only available in this response — it is not stored.

GetCrossWorkspaceBacklinks returns inbound `[[ws::REF]]` backlinks pointing at the queried target (`targetWorkspaceID`, `targetRef`) from EVERY OTHER

GetMemberCollectionAccess returns the collection IDs a member has been explicitly granted access to (only meaningful when collection_access = "specifi

InsertMCPAuditEntry persists one audit row. Called from the audit middleware's async writer; the caller owns the buffered channel + the ordering, so t

IsConfigured reports whether the client has an explicit global connection configuration, either from config.toml or an environment/flag override.

NewDispatcher creates a Dispatcher with the given store. The delivery client enforces the SSRF guard at connect time, not just at parse time: its dia

NormalizeItemLinkType canonicalizes supported link types and returns an error for unknown values.

Unsubscribe removes a subscriber and closes its channel. Safe to call with an already-removed channel — no-op in that case.

ValidateSession hashes the provided token, looks it up, checks expiry, and returns the session info including the associated user and binding metadata

VisibleCollectionIDs returns the set of collection IDs a member can see. Returns nil if the member has "all" access (meaning no filtering needed). Sys

actorNameFromRequest returns the authenticated user's display name, or empty string.

bootstrapAccountDeleteUser creates the first admin user, sets a Stripe customer ID on them, and returns (userID, sessionToken). Used by the handleDele

deleteAccountReq issues the delete-account request from a client IP that differs from the loopback address bootstrap ran on. The session-IP-change mid

executeRequest builds + serves + packages a single HTTP request against the wrapped handler. Pulled out of Dispatch so the special-case methods (dispa

goAsync spawns fn in a goroutine that's tracked by s.bg, so Stop() can wait for in-flight background work to finish. Use this for any fire-and-forget

mustSeedWorkspaceWithRole is a test helper that creates a workspace + adds the user as a member with the given role. Centralized here because TASK-952

Tests for the OAuth 2.1 storage layer (PLAN-943 TASK-951 sub-PR A). The store layer is fosite-agnostic by design — sub-PR B introduces the fosite impo

passThrough returns an ActionFn that forwards the input verbatim to the given cmdPath via env.Dispatch. The vast majority of catalog actions use this

AddConnectionWorkspace inserts a (request_id, workspace_id) row in the allow-list join table. Idempotent: re-adding an existing pair is a no-op (INSER

ExtractWikiLinks scans `content` for [[...]] occurrences OUTSIDE any fenced or inline code region, parses each into a WikiLinkRef, and returns them in

ForceRefreshRoom makes items.content the canonical source for an item's collab state: it runs `commit` under the per-item lock (so the caller can atom

GetOAuthConnectionAccess is the hot-path projection used by the MCP introspection middleware. Runs at most two cheap indexed queries (one PK lookup, o

Publish broadcasts an event to every subscriber whose itemID matches event.ItemID. Non-blocking: full subscriber channels drop the event with a warnin

Put writes the blob from r into the backend, addressable by hash. The implementation MUST verify that the bytes streamed from r hash to the supplied h

SetUserPlan updates a user's billing plan.

SetWorkspaceTool returns the (Tool, Handler) pair for the built-in pad_set_workspace tool. The handler updates state in place. Exposed as a construct

Subscribe registers a new subscriber for the given workspace. Returns a buffered channel that will receive events for that workspace.

SubscriberCount returns the number of active subscribers whose itemID matches. Used by the room manager to decide when the active peer count has dropp

ValidateUpload combines the sniff result, the client-supplied MIME header, and the filename's extension to produce one of: - (entry, "", nil) — accep

WithTokenScopes returns ctx decorated with the API token's JSON-encoded scopes string (e.g. `["read"]`, `["*"]`). Stashed by the MCP Bearer middleware

childLinkTypeSQL returns a SQL IN clause fragment like "'parent','implements'" for filtering item_links by child relationship types.

collectionSchemaJSONFromFlags resolves the --schema and --fields flags into a marshaled CollectionSchema JSON string. Exactly one of schemaInput or f

Mutation-endpoint tests for /api/v1/connected-apps/{id}/... routes (PLAN-1519 / TASK-1524 / IDEA-1517 §3). What's covered (per endpoint): - PATCH /n

getOnlyAttachmentID returns the ID of the single live attachment row in a workspace — the test infrastructure uploads at most one blob per call, so th

mcpEnabledTestServer builds a Server with cloud mode + a stub streamable-HTTP transport so tests targeting auth / discovery / routing don't need to dr

newTestConfig points DataDir at a fresh tmp dir and BrowserURL at the given test server. Most tests want both wired up together.

runHelp invokes the help command with the given args and returns (stdout, stderr, error).

CreateActivityDebounced creates a new activity or updates an existing one if a matching activity (same document, same user, same action) was recorded

DeriveClaimCode produces the 6-digit code for the given (user, workspace) at the given wall-clock time. Exported so the Phase E "Connect project" moda

EnsureServer checks if the pad server is running; if not, starts it in the background.

GetItemLinks returns links where the given item is either source or target. Links pointing to or from soft-deleted items are filtered out so callers (

GetOAuthClient looks up a registered client by ID. Returns ErrOAuthNotFound if no row matches.

NewFetcher returns a Fetcher with production defaults applied.

Save writes the persisted Pad config to disk.

SetEncryptionKey configures the store's AES-256 encryption key for encrypting sensitive fields (e.g., TOTP secrets) at rest. The key must be exactly 3

--- TOTP 2FA --- SetTOTPSecret stores the TOTP secret for a user (before 2FA is verified). The secret is encrypted at rest if an encryption key is con

StarItem stars an item for a user. Idempotent — re-starring is a no-op.

Subscribe registers a subscriber for the given item and returns a buffered channel of OpEvents. Caller is responsible for calling Unsubscribe (typical

Unsubscribe removes a subscriber and closes its channel.

WithTokenAllowedWorkspaces returns ctx decorated with the OAuth token's workspace allow-list set at consent time (TASK-952). The list is either a set

acquireWorkspaceSeqLock takes a Postgres advisory transaction lock keyed on the workspace ID so concurrent seq-bumping mutations serialize. The lock a

── test helpers ── callToolRequest builds an mcp.CallToolRequest with the given input arguments — the public constructor isn't exposed by mcp-go so we

containsToolText looks for substr in any TextContent block of res. MCP results can carry multiple content blocks; checking all of them keeps the asser

helper: create a "blocks" link from source to target

makeFanOutHandler returns the ToolHandlerFunc that mcp-go invokes when the tool is called. Reads `action` from the input, looks up the handler, and fo

makeTestImage returns a freshly-allocated NRGBA image filled with a distinguishable pattern so transformation tests can assert on specific pixels. Wid

mustParseQueryFromPath extracts the query-string portion of path and parses it. Test-only — fails the test on malformed input.

newHTTPResourceFetcher wires an HTTPResourceFetcher over a test mux with a fixed authenticated user, mirroring the dispatch_http_*_test.go setup. The

requireRole checks if the user's workspace role meets the minimum required level. Role hierarchy: owner > editor > viewer.

AddPadEntry reads (or creates) the JSON config at path, ensures mcpServers.pad points to `binary`, and writes the file back. Existing entries outside

Decode parses an artifact's portable on-disk form back into an Artifact. It splits a leading "---\n ... \n---" frontmatter block from the body, unmar

Delete removes the blob identified by key. Deleting a missing key is NOT an error — callers (e.g. the orphan GC) treat it as the success case.

DetectWorkspace walks up the directory tree from cwd looking for .pad.toml.

Dispatch sends the event payload to all matching active webhooks for the workspace. Each delivery runs in its own goroutine so the caller is never blo

GetItemIncludeDeleted finds an item by id including soft-deleted items. Used by code paths that need to act on records the user already owns even thou

ListUserOAuthConnections returns every OAuth connection the user has active. "Active" means at least one access OR refresh token in the chain still ha

RestoreItem un-archives a soft-deleted item and bumps the workspace-scoped seq so delta-sync clients re-materialize the row. Same lock + subquery shap

RunBrowserBootstrap walks the operator through the browser-based first- admin bootstrap. Returns nil on success (server has flipped to setup_required:

SetPlatformSetting upserts a platform setting.