newRootCmd constructs the pad CLI's root cobra command tree. Extracted from main() so tests can use the real tree (golden snapshots, schema validatio

newWebhookTestWorkspace creates a user + workspace so webhook FK constraints are satisfied, and returns the workspace ID.

normalizeCollectionSlug maps common singular/short forms to actual collection slugs. Thin wrapper around the shared collections.NormalizeSlug so the C

observeOAuthFlowDuration records the elapsed time since `start` for the given stage. Designed to be `defer`'d at the top of each OAuth flow handler so

* Open the workspace's IDB database for the given user, creating * object stores on first run. Cached so subsequent calls reuse the * connection. Re

parseFieldKVP normalizes the --field flag's various wire shapes (single string, []string, []any) into a `key→value` map. Empty / invalid entries are s

pathFor returns the full on-disk path for a given hash. Callers MUST have already validated the hash via validHash — this function does not re-check,

percentile returns the linearly-interpolated p-quantile (p in [0,1]) of vals, rounded to 1 decimal. 0 for an empty sample. Computed in Go so the same

postOAuthLogin fires a cloud-secret-authenticated oauth-login request and returns the recorder. The cloud secret rides the JSON body (the same channel

publishEventWithName publishes a real-time event with actor name.

* Recompute and apply the desired inert set from scratch. This is the ONLY * mutator: release doesn't undo its own writes, it re-derives the truth fr

recordMCPAuthzDenial bumps the pad_mcp_authz_denials_total counter when the request originated from the MCP surface. The discriminator is the presence

remoteCfg builds a Config wired to point at the given test server URL.

remoteHeadlessCfg builds a Config wired to point at the given httptest server URL in Remote mode. Remote mode makes EnsureServer a no-op.

renderItemsGroupedByCollectionMarkdown is the markdown counterpart of printItemsGroupedByCollection (#898): one `## Icon Name (N)` heading per collect

requireCommentVisible checks that a comment's underlying item is in a visible collection. Writes a 404 and returns false if not.

resolveAttachmentParentItem loads and validates the parent item of an attachment row that has ALREADY been established as live and belonging to the re

resolveRoleSlug rewrites a `--role <slug>` input into `agent_role_id <uuid>` by hitting the agent-roles endpoint and finding a matching role. Mirrors

retryOnParentSetChanged runs fn, retrying (up to maxParentLockRetries) while it returns errParentSetChanged. fn MUST open and own its own transaction

scanUser scans a user row into a User struct. Note: does NOT decrypt the TOTP secret — call store.decryptUserTOTP() after scanning if you need the pla

seedAccess inserts an access-token row in the chain identified by requestID. ts is the requested_at timestamp; sessionData + scopes land on the row. R

seedClient creates an oauth_clients row so chains have something to FK against. Returns the client ID.

seedGrantChain inserts one access-token row in a chain. Returns the request_id so tests can revoke / list / audit by it.

seedWorkspaceForConn creates a workspace and returns its ID — the join table stores workspace IDs, so tests need a real row.

setSourceContent rewrites the source item's body — the attacker's own legitimate edit of an item they hold, which is the whole vector.

setupEnsureWorkspaceTest produces a clean tempdir, points HOME at a tempdir (so credential/config writes don't leak), chdirs into the project so cli.D

softDeleteWorkspaceAt stamps a workspace's deleted_at to a specific time so the sweep's age cutoff can be exercised deterministically — there's no API

sseSubscriberStillHasAccess re-runs the workspace access check for an already-subscribed SSE client. Returns false when the caller can no longer see t

tokenScopeAllows checks if the token's scopes permit the given HTTP method and path. Scopes are stored as a JSON array of strings. Supported scopes (

A touch pointer event, dispatched on the IMAGE by default (the painted-image hit).

variantRow looks up a derived variant of parentID. GetAttachmentVariant is workspace-scoped (PLAN-2391 DR-16), so the scope is read back off the paren

withLocalFetcher replaces the package-level fetcher with one that allows loopback dials so httptest.NewServer addresses (127.0.0.1) can be reached. Re

CheckUserLimit checks a user-level limit (not workspace-scoped), such as total workspace count or total API tokens.

Cleanup removes the process-wide template database, if one was built. Call it from TestMain after m.Run() so a lazily-built template file doesn't ling

CopyCommitted reports whether err is a post-commit reporting failure — the copy happened, only its result was lost. Callers must not present these as

CopyItemPreflight runs the DRY RUN. It mutates nothing in the copy's own domain, so it is safe to call repeatedly and safe to retry. Returns the deco

============================================================ Authorization codes (handler/oauth2/storage.go AuthorizeCodeStorage) ====================

CreatePatch computes a compact patch that transforms oldText into newText. The patch can be applied with ApplyPatch to recover newText from oldText.

CreateReversePatch computes a patch that transforms newText back into oldText. Used for reverse-diff version storage: current doc has latest content,

CreateView adds a new saved view.

EncryptWebhookSecretsAtRest encrypts plaintext webhook HMAC secrets (BUG-2057). Called on startup when an encryption key is configured. It handles two

FTSRank returns the column/expression for full-text relevance ranking. SQLite: rank (built-in FTS5 column) — consumes ZERO args. PostgreSQL: ts_rank b

FindAgent returns the matching Agent for a name or alias. Names are case-insensitive (Claude / claude / CLAUDE all resolve).

--- Username backfill --- GenerateUsername derives a URL-safe username from a display name. Falls back to the email local part if the name produces an

GetChildItemsForParents returns the live child items for each of the given parent item IDs, grouped by parent ID, in ONE query — collapsing the per-pa

GetCollectionAnyState is GetCollection without the `deleted_at IS NULL` filter — used by the open-children guard (IDEA-1494 R3 P3) so a child still at

GetDeletedWorkspaceBySlug returns a SOFT-DELETED workspace by slug (deleted_at IS NOT NULL), including its owner_id, or nil when no such row exists (l

GetInvitationByCode retrieves a pending invitation by its join code. Looks up by SHA-256 hash first (new invitations), then falls back to plaintext lo

GetUserByUsername retrieves a user by username (case-insensitive).

GetView returns a single view by ID.

GetWebhook retrieves a single webhook by ID.

GroupTemplatesByCategory returns the visible workspace templates grouped by category in the canonical CategoryOrder. Categories with no visible templa

HasEncryptionKey reports whether an encryption key is configured.

IsDiffSmaller returns true if storing a diff would be meaningfully smaller than storing the full content. Returns false for near-complete rewrites whe

--- Agent Roles --- ListAgentRoles returns all agent roles for a workspace.

ListCollectionsMinimal returns collection rows populated with just the fields needed for done-detection context and slug lookups: ID, Slug, Schema, Se

ListItemsChangesSince returns the skinny-projection of items that have mutated (create / update / soft-delete / restore) since the given seq cursor, i

--- Workspace Members --- ListWorkspaceMembers returns all members of a workspace.

LookupEmailVerification performs a read-only validation of a verification token and returns the associated user WITHOUT consuming the token. Mirrors L

MCPTokenIdentityFromContext returns (kind, ref) attached by WithMCPTokenIdentity, or ("", "") if none was set. The audit middleware uses this to popul

MetricsMiddleware returns a chi middleware that records Prometheus metrics for every HTTP request: count, duration, and response size. Path labels us

NewInstrumentedBus wraps an EventBus with Prometheus instrumentation.

NewPostgres creates a Store backed by PostgreSQL. The connStr should be a PostgreSQL connection string (e.g. "postgres://user:pass@host/db").

RFC 8707 ("Resource Indicators for OAuth 2.0") audience-binding hook for pad's authorization server (PLAN-943 TASK-951 sub-PR B). fosite has no nativ

Ping verifies the database connection is alive.

PublicLinkBaseURL returns the URL the server should embed in emailed links (password reset, invites, share links, admin invitations). Resolution order

PurgeWorkspaceData hard-deletes every child row of a soft-deleted workspace and the workspace row itself, in a single transaction. Blob bytes are NOT

RemovePadEntry deletes mcpServers.pad while leaving other servers + top-level keys intact. Returns (true, nil) when an entry was removed, (false, nil)

Resize returns a new image with the longer edge fitted to maxLong, preserving aspect ratio. Images already within maxLong are returned unchanged so ca

ResolveUserPermission resolves the effective permission for a user on a specific item, following the permission resolution order from DOC-406: 1. Owne

RevokeAccessToken mirrors RevokeRefreshToken for access tokens. fosite calls these in pairs when revoking a grant (the unified "revoke the whole famil

RevokeUserOAuthConnection invalidates every token in the OAuth grant chain identified by requestID, after verifying the chain belongs to userID. Impl

RotateAPIToken generates a new secret for an existing token, preserving all metadata (name, scopes, workspace, user, expiry). The old token is invalid

SetImageProcessor wires the image processor that the upload handler uses to derive thumbnail variants (TASK-878). Optional — without it uploads still

OAuth 2.1 authorization-server HTTP handlers (PLAN-943 TASK-951). Sub-PR C built the /register, /authorize, /authorize/decide and token endpoints + th

SetRestoreBoundary records a restore boundary for itemID, keeping the stored value monotonically non-decreasing (a later restore always has a higher o

SetSSELimits configures global and per-workspace SSE connection limits. A value of 0 means unlimited.

SetTokenReaperConfig overrides the default sweep interval (1h). Pass 0 to keep the package default. Must be called before StartTokenReaper; calling af

SetToolSurfaceHandler wires the MCP catalog→JSON serializer onto the server (PLAN-1888 / TASK-1891). Called once at startup by cmd/pad/main.go with mc