StartTokenReaper kicks off the periodic sweep that deletes expired/used email-verification tokens, password-reset tokens, sessions, and CLI-auth sessi

StatusColor returns a *color.Color appropriate for the given status string.

TokenScopesFromContext returns the JSON-encoded scopes attached by WithTokenScopes, or "" if none. Empty maps to "unrestricted" in TokenScopeAllows (t

Uninstall removes the pad entry from the named agent's config. Idempotent: a missing file or missing entry is not an error and returns (path, false, n

UpdateItemWithParentLink is UpdateItemWithPreCheck plus an OPTIONAL parent-link mutation applied inside the same transaction (BUG-2013). When parentLi

ValidateWebhookURL checks that a webhook URL is safe to call. It rejects non-HTTP(S) schemes, URLs with credentials, private/reserved IPs (loopback, l

WithMCPTokenIdentity stashes the bearer-token identity so the MCP audit middleware can record which connection drove the call. kind is the discrimina

WorkspaceID is a nil-safe accessor for the resolved workspace's ID.

WorkspaceSlug is a nil-safe accessor for the resolved workspace's canonical slug — the value the token allow-list was tested against.

addConn registers a freshly-built roomConn with the room. Cancels any pending grace timer (a reconnect within the window keeps the Room alive) and ret

asOpenChildrenGuardError unwraps a store-layer error that may carry an openChildrenGuardError sentinel. Returns the sanitized details and true when th

assertDisclosesNothing checks a refusal body for anything that would confirm the source item exists or reveal the destination schema.

attachmentCallerIsRestricted reports whether the caller's access to the workspace is narrowed to specific collections or items rather than being full

attachmentItemID reads back the persisted item_id for an attachment, returning "" for a NULL association.

MCP audit middleware tests (PLAN-943 TASK-960). What's covered: - A successful tool call writes one audit row with the right tool_name + args_hash +

--- Auto-create Workspace (TASK-432) --- autoCreateWorkspace creates a default workspace for a new user in cloud mode. Called after user creation in r

buildBootstrapURL constructs the /setup URL the operator should open. setup_method dispatch (kept in sync with handleSessionCheck in internal/server/

buildChildrenDoneExpr compiles a set of per-collection done filters into a single SQL boolean expression plus ordered args. `itemAlias` is the item-ta

buildDashboardResponse is the canonical dashboard-assembly path. The HTTP handler (handleGetDashboard) is now a thin wrapper around it, and the bootst

buildReconcileFindings returns the reconcile findings for the given item. The item argument MUST be non-nil — the production caller (reconcileItem) an

bumpStructuralLinkSourceTx advances the source row whenever a parent or implements edge changes. Callers must already hold the workspace seq lock on P

===================================================================== Helpers ===================================================================== by

callWorkspaceViaOAuth simulates an MCP-driven workspace API call by going through MCPBearerAuth's OAuth path. The MCP transport stub the test harness

clearCSRFCookie removes the CSRF cookie (e.g. on logout). Must clear both prefixed and unprefixed names to handle upgrades cleanly.

computeSSEVisibility resolves the caller's current visibility snapshot. Safe to call repeatedly on a live SSE connection — each call fetches the lates

counterValue is a tiny helper that pulls the float value out of a Prometheus counter.

createChildItem creates a test item and wires it as a child of parentID via SetParentLink — the same path the HTTP handler takes in production (handle

Current pane depth+ownership, read from SvelteKit `page.state`.

* Cursors are decimal-encoded `seq` values as opaque strings — but * "monotonic forward" needs a numeric compare, not lexicographic. * Treat empty /

dialWSSince is the resume-cursor variant: appends `?since=<id>` to the WS URL so the test exercises the TASK-1319 force_refresh path.

doAuthedDeleteWithCSRF issues a DELETE with both the session cookie + the CSRF double-submit pair. The session-cookie code path requires CSRF on every

doHeadlessBootstrap is the shared core of the non-interactive (agent) admin bootstrap introduced by BUG-988. Both setupCmd and padInitCmd funnel throu

Press a finger down at (x, y); sends `touchStart` with the full active set.

drainSSE collects everything published to a workspace's channel, giving stragglers a short window to arrive.

drainWebhooks collects deliveries over one quiet window. The window is a wait for something that must NOT arrive in half these assertions, so it is ge

emailUnverifiedBlocked is the central predicate for PLAN-1933 DR-4's email-verification gate. It reports whether a request carrying `user` must be rej

--- Plan Limit Enforcement --- enforcePlanLimit checks a workspace-scoped plan limit and writes a 403 error if the limit is exceeded. Returns true if

ensureRouter lazily initializes the router on first use, so all Set* configuration is applied before the middleware chain is built.

evict removes an entry. No-op on empty id or unknown id. Fires onChange only when an entry was actually removed. See touch's comment for why onChange

forcePlainColor disables ANSI so width/content assertions are deterministic regardless of whether the test binary's stdout happens to be a TTY.

getItemTx is the in-transaction variant of GetItem. Used by UpdateItemWithPreCheck to re-read the parent under the workspace + parent-children locks s

guardSchemaAhead refuses to start when the database contains migrations this binary doesn't ship — i.e. the DB is AHEAD of the binary, the tell-tale o

handleCmdhelpCapabilitiesFallback scans args for the --cmdhelp-capabilities flag (cmdhelp v0.1 §8 fallback form). If found, it writes the capability b

handleCopyItem copies one item into another workspace, optionally archiving the source. See the file header for the full contract.

headlessTestServer builds an httptest.Server that speaks the minimal subset of the Pad API that the headless bootstrap path touches: - GET /api/v1/a

============================================================ Helpers — shared by the three "request-row" tables ======================================

isDeadlockError reports whether err is a genuine deadlock — Postgres' SQLSTATE 40P01. It deliberately does NOT match SQLite's "database is locked"; se

isSupportedOAuthProvider reports whether provider is one pad accepts.

itemCopyList renders a list of server-supplied strings. Every element is quoted, unconditionally — unlike itemCopyLine, which quotes only when it mus

itemRefOrSlug formats an item's issue ref (e.g. "TASK-5") when its collection prefix + item number are populated, falling back to its slug. Avoids pul

itoa is strconv.Itoa renamed to keep test bodies readable when they're already heavy on ref-formatting.

* Latch the permanent placeholder for a row the server says is * gone. Same end state as the deletion broadcast, reached by a * different rout

liveAttachmentCount counts the workspace's live, non-derived attachment rows — the quota-counted surface a refused transform must not grow.

mapRoleUpdate dispatches `pad role update <slug> [--name ...] [--slug ...] [--description ...] [--icon ...] [--tools ...] [--sort-order ...]`. PATCH

mkAdminCookieReq is the same shape minus the Authorization header. Simulates the cookie-session path where isBearerAuth must return false and the admi

mustCreatePATForTest creates a real PAT against a fresh user + workspace. Returns the raw token string suitable for the Authorization: Bearer header.

--- TASK-2369: the ACL filter must be visible, and must not leak ------- mustLegacyPlanLink writes an item_links row carrying the pre-rename "plan" li

mustWorkspaceID resolves a workspace slug to its internal ID via the store. Tests use it because they don't have access to the request context that ge

normalizeServerURL canonicalizes a server URL for use as a credential key. Trailing slash and surrounding whitespace are stripped; nothing else is tou

normalizeWebhookEvents canonicalizes a webhook's event filter to the JSON-array string the store + dispatcher expect. Returns (value, true) when a no

nthPositional returns pos[n] or "" when absent.

numericInput pulls an int64 out of a JSON-typed input value. JSON decoders deliver numbers as float64 (or json.Number when UseNumber()); we accept bot

oauthRequestToFositeRequest hydrates a stored row into a fresh fosite.Request, fetching the client by ID and unmarshalling the session bytes into the

Surface an upload failure to the user.

openBootstrapEnabled reports whether open-bootstrap is active for this server: bypass flag is set AND we're not in cloud mode. Cloud mode always wins