doArtifactRequest posts a raw (non-JSON) body to an artifact-import endpoint.

filterAttention returns attention items of a given type.

helper: fetch the workspace graph and return the parsed response

Supersede every outstanding token without taking a new one.

mapItemCreate translates an `item create` MCP call into a POST to api/v1/workspaces/{ws}/collections/{coll}/items. The MCP tool schema (auto-generate

BackfillOAuthConnections tests (PLAN-1519 / TASK-1522 / IDEA-1517 §2). What's covered: - Pre-TASK-952 session (no key) → all_current=1, no

OAuth connection store tests (PLAN-1519 / TASK-1520 — Phase A foundation). What's covered: - CreateOAuthConnection + GetOAuthConnection round-trip w

newTestRequest builds an OAuthRequest with sensible defaults; tests override fields they care about. signature uniqueness is the caller's responsibili

Blob-read authorization tests for PLAN-2391 / TASK-2401 (BUG-2386). handleGetAttachment used to open with a flat requireMinRole("viewer"). roleLevel(

renderMD is a small test helper that builds + renders the synthetic tree with a fixed clock and returns the markdown output as a string.

runOrphanGCSweep walks the orphaned-attachments query and reclaims rows past the grace period. Two reclamation paths: - DB row only. content_hash is

slugify converts a string to a URL-friendly slug.

--- update ---

uploadHelper does a fresh upload and returns the parsed response.

variant creates a derived thumbnail row for parent, in ws.

waitForEvent reads from the event channel with a timeout.

withTempHome chroots ~/.pad to a fresh tempdir for the test. CredentialsPath resolves via os.UserHomeDir → $HOME, so a t.Setenv("HOME", ...) is enough

CreateComment adds a new comment to an item. userID is the authenticated user authoring the comment (empty for agent/system comments); it's stored as

--- Invitations --- CreateInvitation creates a pending workspace invitation. Generates a 128-bit (16-byte) random code and stores only its SHA-256 has

CreateWatch creates a durable watch, or replaces the predicate on an existing one for the same (user, item) pair (TASK-2533). Re-running `pad watch <r

EnsureEncryptionKey makes sure the server has a usable encryption key without requiring the operator to set one explicitly. Resolution order: 1. If c

FormatForTool takes the raw embedded skill content and formats it for a specific tool. Returns the appropriately formatted content with tool-specific

IsCloud reports whether the server is running in cloud mode.

NewFSStore returns a store rooted at baseDir, creating the directory if it does not exist. baseDir is typically <DataDir>/attachments.

ParseTrustedProxyCIDRs parses a comma-separated list of CIDRs or bare IPs from the PAD_TRUSTED_PROXIES setting. Bare IPs get /32 (IPv4) or 128 (IPv6).

RelativeTime returns a human-readable relative time string.

RenderItemMarkdown is the writer-taking core of PrintItemMarkdown. Columns mirror the table renderer's — Ref · Title · Status · Priority · Collection

RenderMarkdownTable writes headers, a separator, and one row per entry as a GitHub-flavored markdown table. Every cell is escaped, so callers pass raw

RestoreBoundary returns the restore boundary recorded for itemID, or (0, false) when none has been set. The collab-snapshot PATCH handler consults it

Send sends an email using the default from address/name.

SetBypassSetupToken wires the operator's PAD_BYPASS_SETUP_TOKEN choice into the Server. When true, handleBootstrap accepts a self-host first-admin POS

SetIPChangeEnforce controls how the auth middleware reacts when a session's binding (client IP OR User-Agent hash) changes mid-lifetime: - mode == "st

MCP transport state. Set at startup by cmd/pad/main.go via SetMCPTransport when the deployment is in cloud mode (PAD_MODE=cloud). Self-hosted deployme

SetUserPlanOverrides updates per-user limit overrides (JSON string).

TerminalValuesForDoneField returns the resolved done-field key and the list of terminal values for that field. If the resolved field has no terminal_o

ValidateExamples is the contractual mechanism by which cmdhelp v0.1 prevents documentation drift (spec §6, §11 Q5). For every example in every command

--- TOML config path (Codex) -------------------------------------------- Codex nests its MCP servers in a TOML `[mcp_servers.pad]` table, so the JSO

append adds an event to the ring buffer, evicting the oldest if full.

audienceMatchingStrategy returns a fosite.AudienceMatchingStrategy that enforces "every requested audience must equal the configured canonical audienc

Tests for the mutating cross-workspace copy (PLAN-2357 / TASK-2365). The fixture is the PREFLIGHT's, deliberately and not for convenience: the headli

captureUpdateBody runs `item update` against a fake server and returns the decoded PATCH body. The GET is the CLI's own pre-fetch (it resolves the ite

createTaskWithFields is a small helper for the field-patch/OCC tests: POST a task with the given fields JSON and return the created item.

csrfCookieName returns the CSRF cookie name. Uses the same __Host- prefix strategy as the session cookie.

doJSONReq drives a JSON request through srv and returns the recorder. Mirrors the local pattern in internal/server/server_test.go::doRequest, kept pac

doRequestWithHeadersFromAddr lets us combine arbitrary headers with a non-loopback remote-addr. Existing helpers cover one or the other but not both.

docWith constructs a minimal Document with two commands sharing a `collection` arg (caching test) and one `role` flag.

fakeSessionServer returns an httptest.Server whose /api/v1/auth/session handler responds with the SessionResponse produced by `gen` (called once per r

findFieldOptions returns the Options slice for the named field on a collection's schema, or nil if the field is missing.

isItemVisibleToGuest checks if an item is visible given grant-based access, considering both full-collection grants and individual item grants. When f

logActivity is a helper that logs activity, ignoring errors (best-effort).

makeIntegrationPNG returns a real PNG large enough that both thumb-sm (256px) and thumb-md (1024px) variants must scale down. Filled with a stripe pat

mapCollectionUpdate dispatches `pad collection update <slug> [--name ...] [--icon ...] [--description ...] [--prefix ...] [--schema ...] [--fields ...

newMCPSessionTracker constructs a tracker with the given TTL and optional onChange callback. ttl <= 0 falls back to the default; onChange may be nil (

newStub starts a test HTTP server and returns a CloudClient pointed at it. Callers supply the handler to control the response.

packageJSONResult converts a CLI stdout string into an MCP tool result. JSON bodies surface as structuredContent; non-JSON falls back to text. Top-lev

readBinaryWithin reads a single binary frame within d. Returns the payload bytes or fails the test on timeout.

readControlWithin reads frames off the conn within d, drains payload (binary) frames, and returns the FIRST TextMessage parsed as a ControlMessage. Te

seedBackfillClient mirrors seedClient in connected_apps_test.go but stays internal to this file so the backfill suite can run in isolation when other

seedConnectedAppForMutations creates a user + workspace + an oauth_connections row directly so the mutation handlers have something to mutate. Returns

Phase 2 permission test suite (TASK-488). Tests collection-level visibility, system collection exemptions, and the VisibleCollectionIDs resolution log

* Read a string param. Absent (undefined/null) returns undefined — not an * error, matching strArray's absent-vs-malformed line. A present value of a

validatePasswordStrength enforces length + strength. It rejects weak passwords at registration / rotation / reset so top-of-breach-list entries like "

AllowedWorkspaces returns the workspace allow-list stored in session.Extra at consent time (TASK-952). Three return shapes matter to callers: - nil —

CopyOutcomeUnknown reports whether err leaves it genuinely unknown whether the copy committed. True for the server's 500 `copy_failed` and for any tra

CreateAttachmentForLiveItem inserts an attachment row, refusing when its item_id does not name a LIVE item of the same workspace — re-checked and pinn

============================================================ Refresh tokens (handler/oauth2/storage.go RefreshTokenStorage) ==========================

DoneFieldKey resolves which field on a collection's schema represents "is this item done?". The resolution is: 1. If CollectionSettings.BoardGroupBy

EncryptionKeyFile returns the on-disk path where an auto-generated encryption key is persisted. Operator-provided keys (PAD_ENCRYPTION_KEY env, encryp

Fetch performs a GET against rawURL, re-validating every redirect hop and aborting if the response exceeds the size cap. Returns a wrapped error suita

GetComment returns a single comment by ID.

Install adds (or refreshes) the pad entry in the named agent's config. Returns the resolved path + whether the file was actually modified (false on a

IsDisabled returns true if the user account has been disabled.

NewServer constructs an OAuth 2.1 authorization server backed by fosite v0.49.0. Compliance posture (PLAN-943 TASK-951): - PKCE required (S256 only)

RemoveWorkspaceMember removes a user from a workspace.

ResolveAttachmentReferences scans `markdown` for `pad-attachment:UUID` references in standard markdown image/link syntax and replaces each with render

RoomCount is a test/debug accessor. Production code shouldn't make decisions based on this — the count is racy with grace-timer expirations.

SetAttachments wires the attachment storage Registry that the upload and download handlers use. Pass maxBytes = 0 to keep the defaultAttachmentMaxByte

SubscriberCount returns the number of active subscribers for the given item. Useful for room-manager TTL accounting (TASK-1255 — when the count hits 0

TrustedProxyRealIP returns middleware that rewrites r.RemoteAddr from X-Real-IP / X-Forwarded-For ONLY when the direct TCP peer is within one of the s

applySQLiteMigration applies a single migration file atomically. Behavior (IDEA-1485): 1. PRAGMA statements are lifted out of the migration body (se