--- Collection Grants --- CreateCollectionGrant creates a direct grant on a collection for a user.

New creates a Store backed by SQLite at the given path. The DSN is configured for safe concurrent use under Go's connection pool: - `_pragma=busy_ti

SubscribeAndReplaySince atomically subscribes AND captures every buffered notification with ID > sinceID, under the SAME lock (codex round 1 finding 3

classifyHTTPStatus is the legacy entry point preserved for callers that don't know their resource kind. New callers should use classifyHTTPStatusKind

connectWatchStream connects to GET /api/v1/events/stream with a Bearer token and returns a channel of parsed SSE events. UNARMED — the S1 legacy shape

doAuthedRequest is like doRequest but with a session cookie + the matching User-Agent attached (SessionAuth UA-binding, see middleware_auth.go:186).

emptyPreflight is the everything-is-zero case. Its whole job is to prove "nothing to report" renders as an explicit zero rather than as silence.

A non-nil error is always paired with an EMPTY id (BUG-2779). Neither this function nor CreateActivity returns a usable-looking handle beside a failur

CreateComment adds a new comment to an item. userID is the authenticated user authoring the comment (empty for agent/system comments); it's stored as

CrossWorkspaceItemScope scopes the check to one already-loaded item. Collection visibility is checked first and item-level grants second, in that orde

NewErrorResult packages an ErrorPayload as an MCP CallToolResult with IsError=true. Both the JSON envelope and a human-readable summary are returned:

createTestWorkspace creates a workspace via API and returns its slug.

Tests for the transactional event outbox (SPEC-3 §choke point, TASK-2658). The load-bearing case here is the DISJOINT-DELTA RULE (SPEC-3 v1.3): canon

D returns the store's dialect for building backend-specific SQL.

IsEmailVerified returns true if the user's email address has been verified. Mirrors IsDisabled: a non-empty EmailVerifiedAt timestamp means verified,

gen is the subscription this notification arrived on, or currentGen() for a caller that is not the receive loop. CHECKED HERE, under the lock that AP

isBearerAuth reports whether the request was authenticated via an Authorization: Bearer header rather than a browser session cookie. True for: PATs on

AuthorizeCrossWorkspaceRead decides whether the caller may READ the scoped resource in a workspace OTHER than the request's own. workspaceSlugOrID ma

BaseURL returns the configured base URL.

BuildCLIArgs translates an MCP tool call's JSON arguments into the CLI argument list that should be appended after the command path. Pure function — n

CopyItemAcrossWorkspaces copies one item from its workspace into another, atomically. THE LOCK ORDER. Changed only deliberately, and stated here beca

CrossWorkspaceCollectionScope scopes the check to one collection — creating into it, or disclosing its schema. Visibility here is FULL-collection-acc

GetTemplate returns the workspace template with the given name, or nil if no template with that name exists.

Publish broadcasts an event to every subscriber whose itemID matches event.ItemID. Non-blocking: full subscriber channels drop the event with a warnin

buildSyntheticTree returns a small cobra tree exercising the shapes the emitter has to handle: subgroups, leaf commands with positional args, flags of

cycleIdleSubscriptions ends coverage for every workspace whose subscription has received nothing for idleTimeout, and REPLACES that subscription. DRO

requireEditPermission checks if the user has edit access to the given item. For regular members (editor/owner), this uses the standard role check. For

───────────────────────────────────────────────────────────────────── Helpers for non-HTTP error paths (TASK-1077 — replace plain-string NewToolResult

============================================================ Clients (RFC 7591 — Dynamic Client Registration) ========================================

CreateOAuthConnection inserts a new connection row. Idempotent in the sense that callers should INSERT once per /authorize/decide; if the same request

NewDispatcher creates a Dispatcher with the given store. The delivery client enforces the SSRF guard at connect time, not just at parse time: its dia

NewMemorySessionPresence returns an empty in-process registry.

NewSession constructs a Session with the given subject (pad user ID). Returns a non-nil DefaultSession so the embedded methods don't panic on a zero-v

ResolveItem looks up an item by UUID, PREFIX-NUMBER ref (e.g. "IDEA-15"), or slug. UUID is tried first, then ref, then slug.

Subscribe registers a subscriber for the given item and returns a buffered channel of OpEvents. Caller is responsible for calling Unsubscribe (typical

dispatcherErrorResult wraps an internal dispatcher failure (build request, encode body, parse response, marshal merged fields, etc.) into the structur

logAuditEvent logs a non-workspace audit event (e.g. login, logout). Best-effort: errors are silently ignored.

watchNotificationVisible decides whether a Notification should be delivered to a caller holding the given watch map. Extracted from the handler so the

LoadStore reads the credentials file and returns a usable CredentialStore. Returns an empty (but non-nil) store if the file doesn't exist — that's not

ResolveItemIncludeDeleted is like ResolveItem but includes soft-deleted items.

UserCount returns the total number of registered users.

ValidateFields checks field values against the collection schema. It validates required fields are present, types are correct, and select values are w

equalSlice is a small helper for stable []string comparison; kept here so test files across the package can share it. catalog_test.go has equalString

newLocalOnlyBus builds a RedisBus without starting its subscription, for the tests that exercise the local fan-out path directly. Constructing through

registryEnv gives a test a fresh HOME (so ~/.pad/sessions is empty) and a clean session environment, returning the sessions dir.

Encode serializes an Artifact to its portable on-disk form: --- <yaml frontmatter> --- <body> Output is deterministic: two Encode calls on the

GetOAuthConnection fetches the connection row by request_id. Returns ErrOAuthConnectionNotFound if no row exists; any other error is a real I/O failur

GetReport computes the windowed project report for a workspace.

Put writes the blob from r into the backend, addressable by hash. The implementation MUST verify that the bytes streamed from r hash to the supplied h

Save writes the persisted Pad config to disk.

SeedCollectionsFromTemplate seeds the workspace with collections from the named template. An empty template name materializes the default collections

Unsubscribe removes a local subscriber and closes its channel. Cancels the Redis subscription if this was the last local subscriber for the workspace.

Unsubscribe removes a subscriber and closes its channel. Safe to call with an already-removed channel — no-op in that case.

clientIP extracts the client IP from RemoteAddr. This is safe because TrustedProxyRealIP runs earlier in the chain and — when a trusted proxy is confi

Connected-apps handler tests (PLAN-943 TASK-954). What's covered: - GET /api/v1/connected-apps requires cloud mode (404 outside). - List returns onl

Tests for createItemTx — the tx-taking counterpart of CreateItem (PLAN-2357 / DR-9a). Each test below pins one line of the DR-9a parity checklist: slu

logAuditEventForUser logs an audit event with an explicit user ID. Use this when the user isn't (yet) in the request context, e.g. after a successful

--- Helpers ---

seedNeverAttached inserts a never-attached attachment row aged past any grace cutoff a test will use.

sessionCookieName returns the session cookie name. When running over TLS (secureCookies=true), the __Host- prefix is used to prevent subdomain cookie

ApplyExternalContent routes an external content update through a designated applier when an active room exists. Returns nil on success; one of the sen

NewSQLite returns a *store.Store backed by a fresh SQLite file in t.TempDir(), fully migrated. See the package doc for the template+copy mechanism. St

SetCloudSidecar installs the reverse pad → pad-cloud client. Called from cmd/pad/main.go when PAD_CLOUD_SIDECAR_URL + PAD_CLOUD_SECRET are set. When u

actorNameFromRequest returns the authenticated user's display name, or empty string.

classifyExecError turns an exec.Cmd failure (err + stderr) into a structured envelope. lookup is optional — when supplied, no_workspace errors get ava

createLink mints a share link for the fixture's item or collection.

createTaskWithFields is a small helper for the field-patch/OCC tests: POST a task with the given fields JSON and return the created item.

newRequest creates an http.Request with auth and agent headers set.