tokenAllowedWorkspaceMatches reports whether the OAuth token's workspace allow-list (set at consent time, TASK-952) permits the given workspace slug.

tokenScopeAllows checks if the token's scopes permit the given HTTP method and path. Scopes are stored as a JSON array of strings. Supported scopes (

uniqueSlug generates a unique slug within a scope by appending -2, -3, etc.

withLocalFetcher replaces the package-level fetcher with one that allows loopback dials so httptest.NewServer addresses (127.0.0.1) can be reached. Re

CheckUserLimit checks a user-level limit (not workspace-scoped), such as total workspace count or total API tokens.

Cleanup removes the process-wide template database, if one was built. Call it from TestMain after m.Run() so a lazily-built template file doesn't ling

============================================================ Authorization codes (handler/oauth2/storage.go AuthorizeCodeStorage) ====================

CreatePatch computes a compact patch that transforms oldText into newText. The patch can be applied with ApplyPatch to recover newText from oldText.

CreateReversePatch computes a patch that transforms newText back into oldText. Used for reverse-diff version storage: current doc has latest content,

CreateView adds a new saved view.

EncryptWebhookSecretsAtRest encrypts plaintext webhook HMAC secrets (BUG-2057). Called on startup when an encryption key is configured. It handles two

ExportWorkspace exports all data for a workspace into a portable format.

FTSRank returns the column/expression for full-text relevance ranking. SQLite: rank (built-in FTS5 column) — consumes ZERO args. PostgreSQL: ts_rank b

FindAgent returns the matching Agent for a name or alias. Names are case-insensitive (Claude / claude / CLAUDE all resolve).

--- Username backfill --- GenerateUsername derives a URL-safe username from a display name. Falls back to the email local part if the name produces an

GetChildItemsForParents returns the live child items for each of the given parent item IDs, grouped by parent ID, in ONE query — collapsing the per-pa

GetDeletedWorkspaceBySlug returns a SOFT-DELETED workspace by slug (deleted_at IS NOT NULL), including its owner_id, or nil when no such row exists (l

GetInvitationByCode retrieves a pending invitation by its join code. Looks up by SHA-256 hash first (new invitations), then falls back to plaintext lo

GetUserByUsername retrieves a user by username (case-insensitive).

GetView returns a single view by ID.

GetWebhook retrieves a single webhook by ID.

GroupTemplatesByCategory returns the visible workspace templates grouped by category in the canonical CategoryOrder. Categories with no visible templa

HasEncryptionKey reports whether an encryption key is configured.

IsDiffSmaller returns true if storing a diff would be meaningfully smaller than storing the full content. Returns false for near-complete rewrites whe

IsWorkspaceMember checks if a user is a member of a workspace.

--- Agent Roles --- ListAgentRoles returns all agent roles for a workspace.

ListCollectionsMinimal returns collection rows populated with just the fields needed for done-detection context and slug lookups: ID, Slug, Schema, Se

--- Workspace Members --- ListWorkspaceMembers returns all members of a workspace.

LookupEmailVerification performs a read-only validation of a verification token and returns the associated user WITHOUT consuming the token. Mirrors L

LookupMIME returns the entry for a MIME type if it is on the allowlist, or (zero, false) if rejected.

MCPTokenIdentityFromContext returns (kind, ref) attached by WithMCPTokenIdentity, or ("", "") if none was set. The audit middleware uses this to popul

MetricsMiddleware returns a chi middleware that records Prometheus metrics for every HTTP request: count, duration, and response size. Path labels us

NewInstrumentedBus wraps an EventBus with Prometheus instrumentation.

NewPostgres creates a Store backed by PostgreSQL. The connStr should be a PostgreSQL connection string (e.g. "postgres://user:pass@host/db").

RFC 8707 ("Resource Indicators for OAuth 2.0") audience-binding hook for pad's authorization server (PLAN-943 TASK-951 sub-PR B). fosite has no nativ

NormalizeMIME strips parameters and lowercases the type/subtype. We match strictly against the allowlist after normalization so callers can pass an ht

Ping verifies the database connection is alive.

PublicLinkBaseURL returns the URL the server should embed in emailed links (password reset, invites, share links, admin invitations). Resolution order

RemovePadEntry deletes mcpServers.pad while leaving other servers + top-level keys intact. Returns (true, nil) when an entry was removed, (false, nil)

Resize returns a new image with the longer edge fitted to maxLong, preserving aspect ratio. Images already within maxLong are returned unchanged so ca

RevokeAccessToken mirrors RevokeRefreshToken for access tokens. fosite calls these in pairs when revoking a grant (the unified "revoke the whole famil

RevokeUserOAuthConnection invalidates every token in the OAuth grant chain identified by requestID, after verifying the chain belongs to userID. Impl

RotateAPIToken generates a new secret for an existing token, preserving all metadata (name, scopes, workspace, user, expiry). The old token is invalid

SetAttachments wires the attachment storage Registry that the upload and download handlers use. Pass maxBytes = 0 to keep the defaultAttachmentMaxByte

SetEventBus attaches an event bus for real-time SSE streaming.

OAuth 2.1 authorization-server HTTP handlers (PLAN-943 TASK-951). Sub-PR C built the /register, /authorize, /authorize/decide and token endpoints + th

SetRestoreBoundary records a restore boundary for itemID, keeping the stored value monotonically non-decreasing (a later restore always has a higher o

SetSSELimits configures global and per-workspace SSE connection limits. A value of 0 means unlimited.

SetTokenReaperConfig overrides the default sweep interval (1h). Pass 0 to keep the package default. Must be called before StartTokenReaper; calling af

SetToolSurfaceHandler wires the MCP catalog→JSON serializer onto the server (PLAN-1888 / TASK-1891). Called once at startup by cmd/pad/main.go with mc

SetUserRole updates a user's role (admin or member). When demoting an admin to member, the update is conditional: it only proceeds if at least one oth

StartTokenReaper kicks off the periodic sweep that deletes expired/used email-verification tokens, password-reset tokens, sessions, and CLI-auth sessi

StatusColor returns a *color.Color appropriate for the given status string.

TokenScopesFromContext returns the JSON-encoded scopes attached by WithTokenScopes, or "" if none. Empty maps to "unrestricted" in TokenScopeAllows (t

Uninstall removes the pad entry from the named agent's config. Idempotent: a missing file or missing entry is not an error and returns (path, false, n

UpdateItemWithParentLink is UpdateItemWithPreCheck plus an OPTIONAL parent-link mutation applied inside the same transaction (BUG-2013). When parentLi

ValidateWebhookURL checks that a webhook URL is safe to call. It rejects non-HTTP(S) schemes, URLs with credentials, private/reserved IPs (loopback, l

WithMCPTokenIdentity stashes the bearer-token identity so the MCP audit middleware can record which connection drove the call. kind is the discrimina

addConn registers a freshly-built roomConn with the room. Cancels any pending grace timer (a reconnect within the window keeps the Room alive) and ret

asOpenChildrenGuardError unwraps a store-layer error that may carry an openChildrenGuardError sentinel. Returns the sanitized details and true when th

MCP audit middleware tests (PLAN-943 TASK-960). What's covered: - A successful tool call writes one audit row with the right tool_name + args_hash +

--- Auto-create Workspace (TASK-432) --- autoCreateWorkspace creates a default workspace for a new user in cloud mode. Called after user creation in r

buildBootstrapURL constructs the /setup URL the operator should open. setup_method dispatch (kept in sync with handleSessionCheck in internal/server/

buildChildrenDoneExpr compiles a set of per-collection done filters into a single SQL boolean expression plus ordered args. `itemAlias` is the item-ta

buildDashboardResponse is the canonical dashboard-assembly path. The HTTP handler (handleGetDashboard) is now a thin wrapper around it, and the bootst

buildReconcileFindings returns the reconcile findings for the given item. The item argument MUST be non-nil — the production caller (reconcileItem) an

bumpStructuralLinkSourceTx advances the source row whenever a parent or implements edge changes. Callers must already hold the workspace seq lock on P

===================================================================== Helpers ===================================================================== by

callWorkspaceViaOAuth simulates an MCP-driven workspace API call by going through MCPBearerAuth's OAuth path. The MCP transport stub the test harness

clearCSRFCookie removes the CSRF cookie (e.g. on logout). Must clear both prefixed and unprefixed names to handle upgrades cleanly.

computeSSEVisibility resolves the caller's current visibility snapshot. Safe to call repeatedly on a live SSE connection — each call fetches the lates

counterValue is a tiny helper that pulls the float value out of a Prometheus counter.

createChildItem creates a test item and wires it as a child of parentID via SetParentLink — the same path the HTTP handler takes in production (handle

Current pane depth+ownership, read from SvelteKit `page.state`.

* Cursors are decimal-encoded `seq` values as opaque strings — but * "monotonic forward" needs a numeric compare, not lexicographic. * Treat empty /

dialWSSince is the resume-cursor variant: appends `?since=<id>` to the WS URL so the test exercises the TASK-1319 force_refresh path.

doAuthedDeleteWithCSRF issues a DELETE with both the session cookie + the CSRF double-submit pair. The session-cookie code path requires CSRF on every

doHeadlessBootstrap is the shared core of the non-interactive (agent) admin bootstrap introduced by BUG-988. Both setupCmd and padInitCmd funnel throu

emailUnverifiedBlocked is the central predicate for PLAN-1933 DR-4's email-verification gate. It reports whether a request carrying `user` must be rej

--- Plan Limit Enforcement --- enforcePlanLimit checks a workspace-scoped plan limit and writes a 403 error if the limit is exceeded. Returns true if

ensureRouter lazily initializes the router on first use, so all Set* configuration is applied before the middleware chain is built.

evict removes an entry. No-op on empty id or unknown id. Fires onChange only when an entry was actually removed. See touch's comment for why onChange