bootstrapAccountDeleteUser creates the first admin user, sets a Stripe customer ID on them, and returns (userID, sessionToken). Used by the handleDele

copyOK issues the copy as the owner and requires a 201.

deleteAccountReq issues the delete-account request from a client IP that differs from the loopback address bootstrap ran on. The session-IP-change mid

downloadAs issues GET or HEAD on the blob endpoint as a specific user + workspace role, bypassing the auth middleware the same way deleteAsUser does.

goAsync spawns fn in a goroutine that's tracked by s.bg, so Stop() can wait for in-flight background work to finish. Use this for any fire-and-forget

isolateHome redirects HOME to a temp dir and chdirs to a fresh temp project dir so credential writes and .pad.toml detection don't leak into the real

mustSeedWorkspaceWithRole is a test helper that creates a workspace + adds the user as a member with the given role. Centralized here because TASK-952

Tests for the OAuth 2.1 storage layer (PLAN-943 TASK-951 sub-PR A). The store layer is fosite-agnostic by design — sub-PR B introduces the fosite impo

passThrough returns an ActionFn that forwards the input verbatim to the given cmdPath via env.Dispatch. The vast majority of catalog actions use this

--- authorization: the four checks, in order -------------------------- restrictedEditor returns an editor in both workspaces whose membership in each

AddConnectionWorkspace inserts a (request_id, workspace_id) row in the allow-list join table. Idempotent: re-adding an existing pair is a no-op (INSER

EnsureServer checks if the pad server is running; if not, starts it in the background.

ExtractWikiLinks scans `content` for [[...]] occurrences OUTSIDE any fenced or inline code region, parses each into a WikiLinkRef, and returns them in

ForceRefreshRoom makes items.content the canonical source for an item's collab state: it runs `commit` under the per-item lock (so the caller can atom

GetOAuthConnectionAccess is the hot-path projection used by the MCP introspection middleware. Runs at most two cheap indexed queries (one PK lookup, o

MoveItem moves an item to a different collection within the same workspace. It updates the collection_id and fields JSON. The item_number is preserved

New creates a MemoryBus with the default replay buffer size.

NewRegistry returns an empty registry.

Subscribe registers a new subscriber for the given workspace. Returns a buffered channel that will receive events for that workspace.

SubscriberCount returns the number of active subscribers whose itemID matches. Used by the room manager to decide when the active peer count has dropp

ValidateUpload combines the sniff result, the client-supplied MIME header, and the filename's extension to produce one of: - (entry, "", nil) — accep

checkItemVisible is the context-free visibility decision. Returns (true, nil) when the (user, role) pair can see `item` under the same rules `requireI

childLinkTypeSQL returns a SQL IN clause fragment like "'parent','implements'" for filtering item_links by child relationship types.

collectionSchemaJSONFromFlags resolves the --schema and --fields flags into a marshaled CollectionSchema JSON string. Exactly one of schemaInput or f

Mutation-endpoint tests for /api/v1/connected-apps/{id}/... routes (PLAN-1519 / TASK-1524 / IDEA-1517 §3). What's covered (per endpoint): - PATCH /n

getOnlyAttachmentID returns the ID of the single live attachment row in a workspace — the test infrastructure uploads at most one blob per call, so th

movedTo parses the response and returns the moved_to block. It also asserts the disclosure rule's negative half: when the block is absent the KEY must

newTestConfig points DataDir at a fresh tmp dir and BrowserURL at the given test server. Most tests want both wired up together.

runHelp invokes the help command with the given args and returns (stdout, stderr, error).

CopyItem performs the MUTATING cross-workspace copy. NEVER RETRY THIS CALL (DR-13). See the file header for the four mechanisms that enforce it. On f

CreateActivityDebounced creates a new activity or updates an existing one if a matching activity (same document, same user, same action) was recorded

DeriveClaimCode produces the 6-digit code for the given (user, workspace) at the given wall-clock time. Exported so the Phase E "Connect project" moda

GetOAuthClient looks up a registered client by ID. Returns ErrOAuthNotFound if no row matches.

GetParentForItem returns the parent link for an item, or nil if it has no parent. A parent link pointing to a soft-deleted item is treated as no paren

MigrateFields maps field values from a source schema to a target schema. Fields with matching keys and compatible types are transferred. Incompatible

NewFetcher returns a Fetcher with production defaults applied.

NewSQLite returns a *store.Store backed by a fresh SQLite file in t.TempDir(), fully migrated. See the package doc for the template+copy mechanism. St

RestoreItem un-archives a soft-deleted item and bumps the workspace-scoped seq so delta-sync clients re-materialize the row. Same lock + subquery shap

Save writes the persisted Pad config to disk.

SetEncryptionKey configures the store's AES-256 encryption key for encrypting sensitive fields (e.g., TOTP secrets) at rest. The key must be exactly 3

--- TOTP 2FA --- SetTOTPSecret stores the TOTP secret for a user (before 2FA is verified). The secret is encrypted at rest if an encryption key is con

StarItem stars an item for a user. Idempotent — re-starring is a no-op.

Unsubscribe removes a subscriber and closes its channel.

── test helpers ── callToolRequest builds an mcp.CallToolRequest with the given input arguments — the public constructor isn't exposed by mcp-go so we

containsToolText looks for substr in any TextContent block of res. MCP results can carry multiple content blocks; checking all of them keeps the asser

contextWithWorkspaceRoleForTest / contextWithResolvedWorkspaceIDForTest stash the two values RequireWorkspaceAccess populates for the REQUEST's worksp

helper: create a "blocks" link from source to target

dest creates a destination item in ws and returns it.

makeFanOutHandler returns the ToolHandlerFunc that mcp-go invokes when the tool is called. Reads `action` from the input, looks up the handler, and fo

makeTestImage returns a freshly-allocated NRGBA image filled with a distinguishable pattern so transformation tests can assert on specific pixels. Wid

(BUG-2001) The dispatcher used to mirror the CLI's hardcoded active-status allowlist here. That wrongly hid open items in collections with custom stat

mustParseQueryFromPath extracts the query-string portion of path and parses it. Test-only — fails the test on malformed input.

newCopyTestClient points a Client at ts with a HOME that has no saved credentials, so the test never picks up the developer's real token.

newHTTPResourceFetcher wires an HTTPResourceFetcher over a test mux with a fixed authenticated user, mirroring the dispatch_http_*_test.go setup. The

newPadServer stands up the same *server.Server that production uses, wired to a fast fixture SQLite store (storetest.NewSQLite, IDEA-1914). Mirrors te

setupPushTest mirrors setupItemOpenTest (item_open_test.go): points getClient()/getWorkspace() at a fake httptest server via the same urlFlag/workspac

AddPadEntry reads (or creates) the JSON config at path, ensures mcpServers.pad points to `binary`, and writes the file back. Existing entries outside

Decode parses an artifact's portable on-disk form back into an Artifact. It splits a leading "---\n ... \n---" frontmatter block from the body, unmar

Delete removes the blob identified by key. Deleting a missing key is NOT an error — callers (e.g. the orphan GC) treat it as the success case.

DeleteCollection soft-deletes a collection by id. When expectedUpdatedAt is non-empty it opts into optimistic-concurrency control (BUG-2265): the row'

DetectWorkspace walks up the directory tree from cwd looking for .pad.toml.

Dispatch sends the event payload to all matching active webhooks for the workspace. Each delivery runs in its own goroutine so the caller is never blo

ListUserOAuthConnections returns every OAuth connection the user has active. "Active" means at least one access OR refresh token in the chain still ha

Publish assigns the Notification a monotonic ID, stores it in the replay buffer, and fans it out to every live Subscribe channel. ID assignment and bu

Register installs store under prefix (e.g. "fs", "s3"). The prefix MUST NOT contain a colon — Resolve splits keys on the first colon, so a prefix with

RunBrowserBootstrap walks the operator through the browser-based first- admin bootstrap. Returns nil on success (server has flipped to setup_required:

SetPlatformSetting upserts a platform setting.

WorkspaceAttachments lists original (non-derived) attachments in a workspace, with optional filtering + sorting + pagination. Returns the page rows an

appendToCatalog inserts def into Catalog. Called from catalog_<resource>.go init() functions. Keep this small + simple; validation happens at Register

configureBootstrapToken seeds a known token on the server so tests don't depend on the random generator. The on-disk file is created in a temp dir so

connectSSE connects to the SSE endpoint on a real test server and returns a channel of parsed events. Cancel the context to disconnect.

createBulkTestItem creates a task and returns it.

createTestWorkspace creates a workspace via API and returns its slug.

decrypt decrypts a value that was encrypted with encrypt(). If the value doesn't have the "enc:" prefix, it's treated as plaintext (backward compatibi

dispatchWebhook fires a webhook event if a dispatcher is configured.