Make an HTTP request with standard error handling. Raises APIError on 4xx/5xx, RateLimitError on 429.

Resolve workspace and enforce membership check.

Instantiate and return a provider for the given platform. Args: platform: A PlatformCredential.Platform value (e.g. "facebook").

Resolve workspace and enforce membership check.

Create a user + org + workspace + membership + one connected account. Sets ``last_workspace_id`` so the OAuth resolver picks this workspace, and

Check if a status transition is valid.

Create a notification and dispatch to enabled channels. This is the single entry point that all features call. The function: 1. Creates the N

Create a ``Post`` + one ``PlatformPost`` for ``social_account``. The canonical service-layer entry point for the Agent API. The composer's HT

Validate that a URL is http(s) and does not resolve to a private/reserved IP. Returns False for non-http(s) schemes (file://, gopher://, etc.) an

Return a 204 whose ``HX-Trigger`` carries a toast and an optional refresh event. Every approval surface listens for ``showToast`` (renders the to

Strict tag normalization for JSON API endpoints. Raises ValueError on malformed input or overflow — caller returns HTTP 400.

Get workspace and verify the user has access via the RBAC middleware.

Stack the HTTP-level tiers and raise 429 if any trip. Centralized here so routers don't each re-import django-ratelimit helpers. Per-tier rat

Return an aggregate post-level status from an iterable of child statuses. Rules: - empty → "draft" - all children share the same valu

Return workspace-scoped assets plus shared org-level assets.

Create an ApprovalAction row for either a bundled or per-PP action.

Persist one ``ApiKeyAuditLog`` row for the request. Deliberately omits request body — payloads may contain media URLs with embedded signed to

Resolve app credentials and instantiate the provider.

Resolve workspace and enforce membership check.

Return MCP's text-content envelope around a JSON-serializable value. Most Claude clients render text blocks reliably; the experimental ``json

Return True when ``credentials`` holds every required key for ``platform``. Used to populate ``PlatformCredential.is_configured`` (the runtime ga

Return app credentials for ``platform``, with ``.env`` dominant. If env has any non-empty value for the platform it wins; otherwise fall back

Issue a DOT access token for ``user`` and return its raw value. ``token_checksum`` (the indexed column our verifier looks up) is populated by

Re-check a workspace permission inside a tool handler. Mirrors REST's ``_require_perm`` so MCP can't be used to bypass permissions that the R

Resolve the credentials dict for publishing on behalf of `account`. Combines org-level `PlatformCredential` (with `.env` dominant) with per-a

Map a provider exception to a short, user-facing message.

Return True if ``membership`` grants the given org-permission key. ``membership`` is an ``OrgMembership`` or None (e.g., the user has no memb

Lenient tag normalization for HTML form POSTs. Splits a comma-separated string, strips whitespace, truncates each tag to MAX_TAG_LENGTH, dedu