runOrphanGCSweep walks the orphaned-attachments query and reclaims rows past the grace period. Two reclamation paths: - DB row only. content_hash is

slugify converts a string to a URL-friendly slug.

uploadHelper does a fresh upload and returns the parsed response.

variant creates a derived thumbnail row for parent, in ws.

waitForEvent reads from the event channel with a timeout.

withTempHome chroots ~/.pad to a fresh tempdir for the test. CredentialsPath resolves via os.UserHomeDir → $HOME, so a t.Setenv("HOME", ...) is enough

CreateComment adds a new comment to an item. userID is the authenticated user authoring the comment (empty for agent/system comments); it's stored as

--- Invitations --- CreateInvitation creates a pending workspace invitation. Generates a 128-bit (16-byte) random code and stores only its SHA-256 has

EnsureEncryptionKey makes sure the server has a usable encryption key without requiring the operator to set one explicitly. Resolution order: 1. If c

FormatForTool takes the raw embedded skill content and formats it for a specific tool. Returns the appropriately formatted content with tool-specific

IsCloud reports whether the server is running in cloud mode.

NewFSStore returns a store rooted at baseDir, creating the directory if it does not exist. baseDir is typically <DataDir>/attachments.

ParseTrustedProxyCIDRs parses a comma-separated list of CIDRs or bare IPs from the PAD_TRUSTED_PROXIES setting. Bare IPs get /32 (IPv4) or 128 (IPv6).

Publish assigns the Notification a monotonic ID, stores it in the replay buffer, and fans it out to every live Subscribe channel. ID assignment and bu

RenderItemMarkdown is the writer-taking core of PrintItemMarkdown. Columns mirror the table renderer's — Ref · Title · Status · Priority · Collection

RestoreBoundary returns the restore boundary recorded for itemID, or (0, false) when none has been set. The collab-snapshot PATCH handler consults it

Send sends an email using the default from address/name.

SetBypassSetupToken wires the operator's PAD_BYPASS_SETUP_TOKEN choice into the Server. When true, handleBootstrap accepts a self-host first-admin POS

SetIPChangeEnforce controls how the auth middleware reacts when a session's binding (client IP OR User-Agent hash) changes mid-lifetime: - mode == "st

MCP transport state. Set at startup by cmd/pad/main.go via SetMCPTransport when the deployment is in cloud mode (PAD_MODE=cloud). Self-hosted deployme

SetUserPlanOverrides updates per-user limit overrides (JSON string).

TerminalValuesForDoneField returns the resolved done-field key and the list of terminal values for that field. If the resolved field has no terminal_o

ValidateExamples is the contractual mechanism by which cmdhelp v0.1 prevents documentation drift (spec §6, §11 Q5). For every example in every command

--- TOML config path (Codex) -------------------------------------------- Codex nests its MCP servers in a TOML `[mcp_servers.pad]` table, so the JSO

append adds an event to the ring buffer, evicting the oldest if full.

audienceMatchingStrategy returns a fosite.AudienceMatchingStrategy that enforces "every requested audience must equal the configured canonical audienc

Tests for the mutating cross-workspace copy (PLAN-2357 / TASK-2365). The fixture is the PREFLIGHT's, deliberately and not for convenience: the headli

createTaskWithFields is a small helper for the field-patch/OCC tests: POST a task with the given fields JSON and return the created item.

csrfCookieName returns the CSRF cookie name. Uses the same __Host- prefix strategy as the session cookie.

doJSONReq drives a JSON request through srv and returns the recorder. Mirrors the local pattern in internal/server/server_test.go::doRequest, kept pac

doRequestWithHeadersFromAddr lets us combine arbitrary headers with a non-loopback remote-addr. Existing helpers cover one or the other but not both.

docWith constructs a minimal Document with two commands sharing a `collection` arg (caching test) and one `role` flag.

fakeSessionServer returns an httptest.Server whose /api/v1/auth/session handler responds with the SessionResponse produced by `gen` (called once per r

findFieldOptions returns the Options slice for the named field on a collection's schema, or nil if the field is missing.

isItemVisibleToGuest checks if an item is visible given grant-based access, considering both full-collection grants and individual item grants. When f

logActivity is a helper that logs activity, ignoring errors (best-effort).

makeIntegrationPNG returns a real PNG large enough that both thumb-sm (256px) and thumb-md (1024px) variants must scale down. Filled with a stripe pat

mapCollectionUpdate dispatches `pad collection update <slug> [--name ...] [--icon ...] [--description ...] [--prefix ...] [--schema ...] [--fields ...

newMCPSessionTracker constructs a tracker with the given TTL and optional onChange callback. ttl <= 0 falls back to the default; onChange may be nil (

newStub starts a test HTTP server and returns a CloudClient pointed at it. Callers supply the handler to control the response.

readBinaryWithin reads a single binary frame within d. Returns the payload bytes or fails the test on timeout.

readControlWithin reads frames off the conn within d, drains payload (binary) frames, and returns the FIRST TextMessage parsed as a ControlMessage. Te

seedBackfillClient mirrors seedClient in connected_apps_test.go but stays internal to this file so the backfill suite can run in isolation when other

seedConnectedAppForMutations creates a user + workspace + an oauth_connections row directly so the mutation handlers have something to mutate. Returns

Phase 2 permission test suite (TASK-488). Tests collection-level visibility, system collection exemptions, and the VisibleCollectionIDs resolution log

* Read a string param. Absent (undefined/null) returns undefined — not an * error, matching strArray's absent-vs-malformed line. A present value of a

validatePasswordStrength enforces length + strength. It rejects weak passwords at registration / rotation / reset so top-of-breach-list entries like "

AllowedWorkspaces returns the workspace allow-list stored in session.Extra at consent time (TASK-952). Three return shapes matter to callers: - nil —

CopyOutcomeUnknown reports whether err leaves it genuinely unknown whether the copy committed. True for the server's 500 `copy_failed` and for any tra

CreateAttachmentForLiveItem inserts an attachment row, refusing when its item_id does not name a LIVE item of the same workspace — re-checked and pinn

============================================================ Refresh tokens (handler/oauth2/storage.go RefreshTokenStorage) ==========================

CreateWatch creates a durable watch, or replaces the predicate on an existing one for the same (user, item) pair (TASK-2533). Re-running `pad watch <r

DoneFieldKey resolves which field on a collection's schema represents "is this item done?". The resolution is: 1. If CollectionSettings.BoardGroupBy

EncryptionKeyFile returns the on-disk path where an auto-generated encryption key is persisted. Operator-provided keys (PAD_ENCRYPTION_KEY env, encryp

Fetch performs a GET against rawURL, re-validating every redirect hop and aborting if the response exceeds the size cap. Returns a wrapped error suita

GetComment returns a single comment by ID.

GetParentForItem returns the parent link for an item, or nil if it has no parent. A parent link pointing to a soft-deleted item is treated as no paren

Install adds (or refreshes) the pad entry in the named agent's config. Returns the resolved path + whether the file was actually modified (false on a

IsDisabled returns true if the user account has been disabled.

NewServer constructs an OAuth 2.1 authorization server backed by fosite v0.49.0. Compliance posture (PLAN-943 TASK-951): - PKCE required (S256 only)

RelativeTime returns a human-readable relative time string.

RemoveWorkspaceMember removes a user from a workspace.

ResolveAttachmentReferences scans `markdown` for `pad-attachment:UUID` references in standard markdown image/link syntax and replaces each with render

RoomCount is a test/debug accessor. Production code shouldn't make decisions based on this — the count is racy with grace-timer expirations.

SetAttachments wires the attachment storage Registry that the upload and download handlers use. Pass maxBytes = 0 to keep the defaultAttachmentMaxByte

SubscriberCount returns the number of active subscribers for the given item. Useful for room-manager TTL accounting (TASK-1255 — when the count hits 0

TrustedProxyRealIP returns middleware that rewrites r.RemoteAddr from X-Real-IP / X-Forwarded-For ONLY when the direct TCP peer is within one of the s

applySQLiteMigration applies a single migration file atomically. Behavior (IDEA-1485): 1. PRAGMA statements are lifted out of the migration body (se

assertBlocked asserts the response is a 403 email_not_verified.

auditUser creates a user that subsequent audit rows can FK-reference. The schema requires user_id REFERENCES users(id), so we can't insert audit rows

buildFositeRequest produces a fully-populated *fosite.Request so adapter tests can drive Create*Session methods without depending on fosite's HTTP ent

buildHTMLShell wraps body HTML in the standard transactional-email chrome — header (Pad wordmark) + body + footer note + (Cloud only) marketing footer

createItemTx is the tx-taking form of item creation (PLAN-2357 / DR-9a) and the single implementation behind BOTH CreateItem and the cross-workspace c

Delete-authorization tests for PLAN-2382 / TASK-2384. The item-detail attachment strip offers a delete affordance gated on the UI's grant-aware `canE

dialWSBracket joins as a bracket-capable participant (`?applier_bracket=1`) so the conn can be durably confirmed by a restore's finalization (BUG-2276

doRequestWithCookieFrom is like doRequestWithCookie but lets the caller set the request RemoteAddr so tests can simulate a session jumping to a differ

expandPath substitutes {key} placeholders in template using input. Each placeholder must appear as a non-empty string in input; otherwise expandPath r

getOrCreate returns the existing Room for itemID or, atomically under m.mu, mints a new one. Holding m.mu across the lookup + insertion keeps the grac

mapCollectionCreate dispatches `pad collection create <name> [--fields key:type[:opts]; ...] [--icon ...] [--description ...] [--layout ...] [--defaul

maybeInjectWorkspace defaults the `workspace` input from the dispatcher's WorkspaceLister when the caller didn't pass one explicitly (TASK-1076). The

Store-layer tests for the MCP audit log (PLAN-943 TASK-960). What's covered: - InsertMCPAuditEntry validates required fields and round-trips correct