ListItemsChangesSince returns the skinny-projection of items that have mutated (create / update / soft-delete / restore) since the given seq cursor, i

--- Workspace Members --- ListWorkspaceMembers returns all members of a workspace.

LookupEmailVerification performs a read-only validation of a verification token and returns the associated user WITHOUT consuming the token. Mirrors L

MCPTokenIdentityFromContext returns (kind, ref) attached by WithMCPTokenIdentity, or ("", "") if none was set. The audit middleware uses this to popul

MetricsMiddleware returns a chi middleware that records Prometheus metrics for every HTTP request: count, duration, and response size. Path labels us

NewInstrumentedBus wraps an EventBus with Prometheus instrumentation.

NewPostgres creates a Store backed by PostgreSQL. The connStr should be a PostgreSQL connection string (e.g. "postgres://user:pass@host/db").

RFC 8707 ("Resource Indicators for OAuth 2.0") audience-binding hook for pad's authorization server (PLAN-943 TASK-951 sub-PR B). fosite has no nativ

Ping verifies the database connection is alive.

PublicLinkBaseURL returns the URL the server should embed in emailed links (password reset, invites, share links, admin invitations). Resolution order

RemovePadEntry deletes mcpServers.pad while leaving other servers + top-level keys intact. Returns (true, nil) when an entry was removed, (false, nil)

Resize returns a new image with the longer edge fitted to maxLong, preserving aspect ratio. Images already within maxLong are returned unchanged so ca

ResolveUserPermission resolves the effective permission for a user on a specific item, following the permission resolution order from DOC-406: 1. Owne

RevokeAccessToken mirrors RevokeRefreshToken for access tokens. fosite calls these in pairs when revoking a grant (the unified "revoke the whole famil

RevokeUserOAuthConnection invalidates every token in the OAuth grant chain identified by requestID, after verifying the chain belongs to userID. Impl

RotateAPIToken generates a new secret for an existing token, preserving all metadata (name, scopes, workspace, user, expiry). The old token is invalid

SetImageProcessor wires the image processor that the upload handler uses to derive thumbnail variants (TASK-878). Optional — without it uploads still

OAuth 2.1 authorization-server HTTP handlers (PLAN-943 TASK-951). Sub-PR C built the /register, /authorize, /authorize/decide and token endpoints + th

SetRestoreBoundary records a restore boundary for itemID, keeping the stored value monotonically non-decreasing (a later restore always has a higher o

SetSSELimits configures global and per-workspace SSE connection limits. A value of 0 means unlimited.

SetTokenReaperConfig overrides the default sweep interval (1h). Pass 0 to keep the package default. Must be called before StartTokenReaper; calling af

SetToolSurfaceHandler wires the MCP catalog→JSON serializer onto the server (PLAN-1888 / TASK-1891). Called once at startup by cmd/pad/main.go with mc

StartTokenReaper kicks off the periodic sweep that deletes expired/used email-verification tokens, password-reset tokens, sessions, and CLI-auth sessi

StatusColor returns a *color.Color appropriate for the given status string.

TokenScopesFromContext returns the JSON-encoded scopes attached by WithTokenScopes, or "" if none. Empty maps to "unrestricted" in TokenScopeAllows (t

Uninstall removes the pad entry from the named agent's config. Idempotent: a missing file or missing entry is not an error and returns (path, false, n

UpdateItemWithParentLink is UpdateItemWithPreCheck plus an OPTIONAL parent-link mutation applied inside the same transaction (BUG-2013). When parentLi

ValidateWebhookURL checks that a webhook URL is safe to call. It rejects non-HTTP(S) schemes, URLs with credentials, private/reserved IPs (loopback, l

WithMCPTokenIdentity stashes the bearer-token identity so the MCP audit middleware can record which connection drove the call. kind is the discrimina

WorkspaceID is a nil-safe accessor for the resolved workspace's ID.

WorkspaceSlug is a nil-safe accessor for the resolved workspace's canonical slug — the value the token allow-list was tested against.

addConn registers a freshly-built roomConn with the room. Cancels any pending grace timer (a reconnect within the window keeps the Room alive) and ret

asOpenChildrenGuardError unwraps a store-layer error that may carry an openChildrenGuardError sentinel. Returns the sanitized details and true when th

assertDisclosesNothing checks a refusal body for anything that would confirm the source item exists or reveal the destination schema.

attachmentCallerIsRestricted reports whether the caller's access to the workspace is narrowed to specific collections or items rather than being full

attachmentItemID reads back the persisted item_id for an attachment, returning "" for a NULL association.

MCP audit middleware tests (PLAN-943 TASK-960). What's covered: - A successful tool call writes one audit row with the right tool_name + args_hash +

--- Auto-create Workspace (TASK-432) --- autoCreateWorkspace creates a default workspace for a new user in cloud mode. Called after user creation in r

buildBootstrapURL constructs the /setup URL the operator should open. setup_method dispatch (kept in sync with handleSessionCheck in internal/server/

buildChildrenDoneExpr compiles a set of per-collection done filters into a single SQL boolean expression plus ordered args. `itemAlias` is the item-ta

buildDashboardResponse is the canonical dashboard-assembly path. The HTTP handler (handleGetDashboard) is now a thin wrapper around it, and the bootst

buildReconcileFindings returns the reconcile findings for the given item. The item argument MUST be non-nil — the production caller (reconcileItem) an

bumpStructuralLinkSourceTx advances the source row whenever a parent or implements edge changes. Callers must already hold the workspace seq lock on P

===================================================================== Helpers ===================================================================== by

callWorkspaceViaOAuth simulates an MCP-driven workspace API call by going through MCPBearerAuth's OAuth path. The MCP transport stub the test harness

clearCSRFCookie removes the CSRF cookie (e.g. on logout). Must clear both prefixed and unprefixed names to handle upgrades cleanly.

computeSSEVisibility resolves the caller's current visibility snapshot. Safe to call repeatedly on a live SSE connection — each call fetches the lates

counterValue is a tiny helper that pulls the float value out of a Prometheus counter.

createChildItem creates a test item and wires it as a child of parentID via SetParentLink — the same path the HTTP handler takes in production (handle

Current pane depth+ownership, read from SvelteKit `page.state`.

* Cursors are decimal-encoded `seq` values as opaque strings — but * "monotonic forward" needs a numeric compare, not lexicographic. * Treat empty /

dialWSSince is the resume-cursor variant: appends `?since=<id>` to the WS URL so the test exercises the TASK-1319 force_refresh path.

doAuthedDeleteWithCSRF issues a DELETE with both the session cookie + the CSRF double-submit pair. The session-cookie code path requires CSRF on every

doHeadlessBootstrap is the shared core of the non-interactive (agent) admin bootstrap introduced by BUG-988. Both setupCmd and padInitCmd funnel throu

docsCollection returns the standard Docs collection shared across templates.

Press a finger down at (x, y); sends `touchStart` with the full active set.

drainSSE collects everything published to a workspace's channel, giving stragglers a short window to arrive.

drainWebhooks collects deliveries over one quiet window. The window is a wait for something that must NOT arrive in half these assertions, so it is ge

emailUnverifiedBlocked is the central predicate for PLAN-1933 DR-4's email-verification gate. It reports whether a request carrying `user` must be rej

--- Plan Limit Enforcement --- enforcePlanLimit checks a workspace-scoped plan limit and writes a 403 error if the limit is exceeded. Returns true if

ensureRouter lazily initializes the router on first use, so all Set* configuration is applied before the middleware chain is built.

evict removes an entry. No-op on empty id or unknown id. Fires onChange only when an entry was actually removed. See touch's comment for why onChange

forcePlainColor disables ANSI so width/content assertions are deterministic regardless of whether the test binary's stdout happens to be a TTY.

getItemTx is the in-transaction variant of GetItem. Used by UpdateItemWithPreCheck to re-read the parent under the workspace + parent-children locks s

guardSchemaAhead refuses to start when the database contains migrations this binary doesn't ship — i.e. the DB is AHEAD of the binary, the tell-tale o

handleCmdhelpCapabilitiesFallback scans args for the --cmdhelp-capabilities flag (cmdhelp v0.1 §8 fallback form). If found, it writes the capability b

handleCopyItem copies one item into another workspace, optionally archiving the source. See the file header for the full contract.

headlessTestServer builds an httptest.Server that speaks the minimal subset of the Pad API that the headless bootstrap path touches: - GET /api/v1/a

============================================================ Helpers — shared by the three "request-row" tables ======================================

isDeadlockError reports whether err is a genuine deadlock — Postgres' SQLSTATE 40P01. It deliberately does NOT match SQLite's "database is locked"; se

isSupportedOAuthProvider reports whether provider is one pad accepts.

itemCopyList renders a list of server-supplied strings. Every element is quoted, unconditionally — unlike itemCopyLine, which quotes only when it mus

itemRefOrSlug formats an item's issue ref (e.g. "TASK-5") when its collection prefix + item number are populated, falling back to its slug. Avoids pul

itoa is strconv.Itoa renamed to keep test bodies readable when they're already heavy on ref-formatting.