Unsubscribe removes a subscriber and closes its channel.

* Open the confirmation and resolve when the user answers — the descriptor's * `ctx.confirmDelete`. A no-op that resolves false when the caller may

requireMinRole checks role and writes a 403 if insufficient. Returns true if the request should continue, false if it was rejected.

DB returns the underlying *sql.DB (for use in migrations/testing).

New creates a new Metrics instance with a custom registry and registers all application metrics plus Go runtime and process collectors.

oauthEnabledTestServer builds a Server with cloud mode + a real internal/oauth.Server backed by the test store. Returns the Server so each test can dr

===================================================================== Helpers ===================================================================== re

DeleteItem soft-deletes the item by stamping deleted_at and bumping the workspace-scoped seq so delta-sync clients see the tombstone. The seq bump use

SetMemberCollectionAccess updates a member's collection_access mode and replaces their specific collection grants atomically.

doRequestWithHeaders is a thin variant of doRequest that lets a test set arbitrary request headers (e.g. Authorization) without spinning up a real aut

GetBacklinks returns the items in `workspaceID` that contain a resolved `[[...]]` reference to `targetItemID`. Phase 1 only returns ref-kind backlinks

visibleCollectionIDs returns the set of collection IDs the current user can see in the given workspace. Returns nil if the user has "all" access (no f

--- Item Grants --- CreateItemGrant creates a direct grant on an item for a user.

currentUserID returns the authenticated user's ID, or empty string.

GetUserByEmail retrieves a user by email address (case-insensitive).

bearerJSON marshals body and issues a Bearer-authenticated request. Needed for any mutation issued AFTER a real user has been created in the test's st

newCollabTestServer wires up an httptest server whose only handler upgrades the inbound WS, registers it with the manager, and waits for the session t

CreateAttachment inserts an attachment row. id and created_at are generated by the store. The caller is expected to have already written the blob via

req builds a request from A to B with the standard actor.

Close stops every active room AND blocks until every in-flight Join goroutine has returned. After Close, Join is undefined — callers must coordinate s

Rebind converts a query with "?" placeholders to the dialect's format. For SQLite this is a no-op. For PostgreSQL, "?" becomes "$1", "$2", etc.

SetObserver attaches an Observer. Passing nil detaches. Safe to call after the bus is running; cmd/pad/cmd_server.go calls it at wiring time.

requireItemVisible checks that the item's collection is visible to the requesting user. For guests with item-level grants, also verifies that the spec

IsZero reports whether the collection declares no kernel traits at all.

auditMeta safely marshals a map to a JSON string for audit log metadata. Falls back to "{}" on marshal error so audit calls never break.

Decode reads bytes from r and returns the decoded image plus the detected format ("png", "jpeg", "gif", "bmp", "tiff", …). The returned format is the

isCollectionVisible checks if a collection ID is in the visible set. If visibleIDs is nil, all collections are visible.

EventsSince returns buffered notifications with ID > sinceID, for Last-Event-ID resume. Returns nil if sinceID has been evicted from the buffer (gap t

Set adds or replaces the credential for the given server URL. The canonical URL is mirrored into the value's ServerURL field so a caller reading the c

s256Challenge computes the base64url(no-padding, SHA256(verifier)) per RFC 7636 §4.2. PKCE clients use this to derive code_challenge from code_verifie

Build returns a cmdhelp Document without serializing it. Callers that need to inspect or further mutate the document (tests, dynamic enum resolvers in

GetAttachment returns the attachment with the given id, or (nil, nil) if no such row exists. Soft-deleted rows ARE returned (so download handlers can

guestResourceFilter returns the full-collection IDs and granted item IDs for the current user if they need item-level grant filtering. Returns nil/nil

liveCmdhelpDoc returns a minimal cmdhelp.Document with every command path the read-only catalog references. Lighter than re-running pad's full cobra e

runItemCopy is the whole command, minus flag binding. Order of operations is load-bearing: 1. Build the request (the SAME body both endpoints take).

workspaceIDForSlug looks up the internal UUID for a slug — used by tests that synthesize attachment rows directly via the store (bypassing the upload

helper: fetch the dashboard and return the parsed response

readCSRFFromCookie hits any consent-rendering endpoint that sets the CSRF cookie on first visit, returns the token. We use oauth/authorize because it'

BUG-2301: `pad item note` / `pad item decide` wrote structured entries that no web surface rendered — the renderer shipped in c61f4cda and was deleted

ItemRef returns the reference string (e.g. "TASK-5") for an item, or empty string.

resolvableBody is a request the copy can actually satisfy: the two needs_value entries the base fixture leaves open are supplied, so the preflight com

Remove deregisters a session. It must be idempotent and must not panic on an unknown id — the stream handler calls it from a defer that also runs on p

--- Phase Links --- SetParentLink sets the parent for an item. Since an item can belong to at most one parent, this deletes any existing parent link f

refOf builds a PREFIX-NUMBER string from a fresh item — used by the integration tests since the canonical ref isn't on the model directly. ItemNumber

Resolve returns the store responsible for key, or an error if no matching backend is registered. The key format is "<prefix>:<rest>".

SubscribeIfAllowed atomically checks the per-workspace subscriber limit and, only if it is satisfied, subscribes in the same critical section. Return

errorHandler fails the test if invoked. Used to assert that a code path doesn't hit the handler at all.

--- Item Links ---

GetWorkspaceMember retrieves a single membership record.

New creates a MemoryBus with the default replay buffer size.

attach creates an original attachment in ws and returns it.

call issues the preflight exactly as the router would, with the caller's auth surface described by o. The workspace-A role and resolved ID are stashed

Exported context-key helpers for callers that need to synthesize an authenticated request without going through the auth middleware chain (e.g. the in

actorFromRequest derives actor and source from the request's auth context. Actor is "user" or "agent" (determined by X-Pad-Agent header). Source is "w

cloudAdminReq is a small helper that builds a request with optional JSON body and the caller-chosen headers.

newHeartbeatBus builds a phase-1 bus (recognises heartbeats, publishes none) on a hand-driven clock, with an observer attached.

AuthorizeCrossWorkspaceEdit decides whether the caller may WRITE the scoped resource in a workspace OTHER than the request's own. It runs every step

NewRedisBus creates a new Redis-backed EventBus. The provided redis.Client should already be configured and connected.

NOTE: callerIsGone already exists in this package, added by BUG-2751 for the resume settle path, and is reused here rather than duplicated. Its reason

* Claim what is now on screen. Recording a token whose key is null (an * un-addressable view) correctly claims nothing.

BoolToInt converts a Go bool to a query parameter value. SQLite: 0/1 (integers) PostgreSQL: true/false (native booleans)