--- authorization: the four checks, in order -------------------------- restrictedEditor returns an editor in both workspaces whose membership in each

seedImage creates an image original anchored to itemID plus its thumb-md variant, each with distinct bytes, and returns (originalID, thumbMdBytes).

AddConnectionWorkspace inserts a (request_id, workspace_id) row in the allow-list join table. Idempotent: re-adding an existing pair is a no-op (INSER

Delete removes the blob identified by key. Deleting a missing key is NOT an error — callers (e.g. the orphan GC) treat it as the success case.

ExtractWikiLinks scans `content` for [[...]] occurrences OUTSIDE any fenced or inline code region, parses each into a WikiLinkRef, and returns them in

ForceRefreshRoom makes items.content the canonical source for an item's collab state: it runs `commit` under the per-item lock (so the caller can atom

GetMemberCollectionAccess returns the collection IDs a member has been explicitly granted access to (only meaningful when collection_access = "specifi

GetOAuthConnectionAccess is the hot-path projection used by the MCP introspection middleware. Runs at most two cheap indexed queries (one PK lookup, o

RegisterSession records the CURRENT session — owner from the environment (CaptureSessionOwner), the given cwd and agent name — to ~/.pad/sessions/<ses

Subscribe registers a local subscriber for the given workspace. Starts a Redis subscription for the workspace if this is the first local subscriber, a

SubscriberCount returns the number of active subscribers whose itemID matches. Used by the room manager to decide when the active peer count has dropp

ValidateUpload combines the sniff result, the client-supplied MIME header, and the filename's extension to produce one of: - (entry, "", nil) — accep

VisibleCollectionIDs returns the set of collection IDs a member can see. Returns nil if the member has "all" access (meaning no filtering needed). Sys

withCollectionAliasFallback runs op against the RAW collection slug the user typed, and — only if that fails specifically because the collection was n

bodyDecodesNUL reports whether any string a handler could read out of this JSON body — an object key or a value, at any nesting depth, including insid

── test helpers ── callToolRequest builds an mcp.CallToolRequest with the given input arguments — the public constructor isn't exposed by mcp-go so we

childLinkTypeSQL returns a SQL IN clause fragment like "'parent','implements'" for filtering item_links by child relationship types.

collectionSchemaJSONFromFlags resolves the --schema and --fields flags into a marshaled CollectionSchema JSON string. Exactly one of schemaInput or f

dispatchPadItem runs one pad_item call through the fan-out handler and returns the fake dispatcher plus the tool result.

Mutation-endpoint tests for /api/v1/connected-apps/{id}/... routes (PLAN-1519 / TASK-1524 / IDEA-1517 §3). What's covered (per endpoint): - PATCH /n

emitItemEventTx writes one item-subject event to the outbox on the caller's transaction, carrying the post-mutation snapshot. The snapshot must be re

getItemTx is the in-transaction variant of GetItem. Used by UpdateItemWithPreCheck to re-read the parent under the workspace + parent-children locks s

liveGen reports the generation of the workspace's installed subscription, and whether there is one at all. Distinct from currentSubGen, which answers

makeFanOutHandler returns the ToolHandlerFunc that mcp-go invokes when the tool is called. Reads `action` from the input, looks up the handler, and fo

movedTo parses the response and returns the moved_to block. It also asserts the disclosure rule's negative half: when the block is absent the KEY must

newTestConfig points DataDir at a fresh tmp dir and BrowserURL at the given test server. Most tests want both wired up together.

Blob-read authorization tests for PLAN-2391 / TASK-2401 (BUG-2386). handleGetAttachment used to open with a flat requireMinRole("viewer"). roleLevel(

runHelp invokes the help command with the given args and returns (stdout, stderr, error).

wedge simulates the failure this unit exists to detect: the outbound probe keeps SUCCEEDING and nothing comes back. Simulated rather than produced, b

CopyItem performs the MUTATING cross-workspace copy. NEVER RETRY THIS CALL (DR-13). See the file header for the four mechanisms that enforce it. On f

CreateAttachmentForLiveItem inserts an attachment row, refusing when its item_id does not name a LIVE item of the same workspace — re-checked and pinn

DeriveClaimCode produces the 6-digit code for the given (user, workspace) at the given wall-clock time. Exported so the Phase E "Connect project" moda

DetectWorkspace walks up the directory tree from cwd looking for .pad.toml.

EnvToken returns the value of the PAD_TOKEN environment variable, trimmed of surrounding whitespace. When non-empty, it overrides any credential store

GetOAuthClient looks up a registered client by ID. Returns ErrOAuthNotFound if no row matches.

GetParentForItem returns the parent link for an item, or nil if it has no parent. A parent link pointing to a soft-deleted item is treated as no paren

ListSessions reads every registry record and returns them with a liveness verdict each, newest first. A malformed file is returned as a Malformed reco

LookupMIME returns the entry for a MIME type if it is on the allowlist, or (zero, false) if rejected.

NewFSStore returns a store rooted at baseDir, creating the directory if it does not exist. baseDir is typically <DataDir>/attachments.

NewFetcher returns a Fetcher with production defaults applied.

Register installs store under prefix (e.g. "fs", "s3"). The prefix MUST NOT contain a colon — Resolve splits keys on the first colon, so a prefix with

SessionArmedLocally reports whether this session has a live explicit ARM (LocalArmOn). Retained for callers that only ask the ON question; the full tr

SetEncryptionKey configures the store's AES-256 encryption key for encrypting sensitive fields (e.g., TOTP secrets) at rest. The key must be exactly 3

--- TOTP 2FA --- SetTOTPSecret stores the TOTP secret for a user (before 2FA is verified). The secret is encrypted at rest if an encryption key is con

SoftDeleteAttachment marks the given attachment row deleted (and every variant whose parent_id points at it) so the orphan GC will reclaim the bytes a

StarItem stars an item for a user. Idempotent — re-starring is a no-op.

SubscribeIfAllowed atomically checks the per-workspace limit and subscribes. See the EventBus interface for why there is no global limit here (BUG-272

WorkspaceSubscriberCount returns the number of active subscribers for a specific workspace.

bindableText reports whether a decoded string can be bound into a text comparison. It is the shared predicate of both middlewares in this file: Valida

Tests for the mutating cross-workspace copy (PLAN-2357 / TASK-2365). The fixture is the PREFLIGHT's, deliberately and not for convenience: the headli

checkItemVisible is the context-free visibility decision. Returns (true, nil) when the (user, role) pair can see `item` under the same rules `requireI

connectSSE connects to the SSE endpoint on a real test server and returns a channel of parsed events. Cancel the context to disconnect.

containsToolText looks for substr in any TextContent block of res. MCP results can carry multiple content blocks; checking all of them keeps the asser

contextWithWorkspaceRoleForTest / contextWithResolvedWorkspaceIDForTest stash the two values RequireWorkspaceAccess populates for the REQUEST's worksp

helper: create a "blocks" link from source to target

createBulkTestItem creates a task and returns it.

dest creates a destination item in ws and returns it.

doArtifactRequest posts a raw (non-JSON) body to an artifact-import endpoint.

makeCollection creates a collection via the API so it goes through the same slug/prefix machinery production does.

makeTestImage returns a freshly-allocated NRGBA image filled with a distinguishable pattern so transformation tests can assert on specific pixels. Wid

(BUG-2001) The dispatcher used to mirror the CLI's hardcoded active-status allowlist here. That wrongly hid open items in collections with custom stat

mustParseQueryFromPath extracts the query-string portion of path and parses it. Test-only — fails the test on malformed input.

newCopyTestClient points a Client at ts with a HOME that has no saved credentials, so the test never picks up the developer's real token.

newHTTPResourceFetcher wires an HTTPResourceFetcher over a test mux with a fixed authenticated user, mirroring the dispatch_http_*_test.go setup. The

newPadServer stands up the same *server.Server that production uses, wired to a fast fixture SQLite store (storetest.NewSQLite, IDEA-1914). Mirrors te

stampAttachmentRefsTx bumps attachments.last_referenced_at for every `pad-attachment:<id>` reference found in the given texts, inside the caller's tra

waitForEvent reads from the event channel with a timeout.

AddPadEntry reads (or creates) the JSON config at path, ensures mcpServers.pad points to `binary`, and writes the file back. Existing entries outside

Decode parses an artifact's portable on-disk form back into an Artifact. It splits a leading "---\n ... \n---" frontmatter block from the body, unmar

DeleteCollection soft-deletes a collection by id. When expectedUpdatedAt is non-empty it opts into optimistic-concurrency control (BUG-2265): the row'

Dispatch sends the event payload to all matching active webhooks for the workspace. Each delivery runs in its own goroutine so the caller is never blo

ListUserOAuthConnections returns every OAuth connection the user has active. "Active" means at least one access OR refresh token in the chain still ha