xarmian d4e69a566b fix(auth): reset-password, register and bootstrap refuse a cross-site form, as login does (BUG-3680) (#2146) ...

* fix(auth): reset-password, register and bootstrap refuse a cross-site form, as login does (BUG-3680)

/api/v1/auth/reset-password is CSRF-exempt and a completed reset sets a
web session cookie. decodeJSON does not check the content type, so a
cross-site text/plain form whose name=value serializes as JSON could
complete a reset of the attacker's own account in the victim's browser
and sign the victim into it (login CSRF). Only login and 2FA login-verify
called refuseCrossSiteSignIn (BUG-3350).

The population, by every handler that creates a session:
- login, 2fa/login-verify: guarded already.
- reset-password: unguarded. Guarded now.
- register: CSRF-exempt without a session, and an anonymous signup signs
  the browser into the new account. Same class. Guarded now.
- bootstrap: CSRF-exempt and signs the browser into the admin it creates.
  On a fresh instance reachable by loopback, or in open-bootstrap mode,
  a cross-site form could plant the attacker's admin. Guarded now.
- oauth-login: requires the sidecar's cloud_secret, so not browser-
  reachable. Left as is.
- rotateSessionsAfterCredentialChange callers are authenticated,
  CSRF-checked writes; the CLI approval session is not a browser cookie.

Every legitimate client of the three already sends application/json with
no Origin (CLI) or this server's origin (the SPA), and pad-cloud calls
none of them.

Tests, one per door: text/plain, urlencoded, foreign Origin and null
Origin are refused, set no session cookie and change nothing (the reset
token survives and then completes; no account is created; no admin is
created). Same-origin and headless JSON still complete. Removing one
door's guard fails exactly that door's test. TestBUG3350's login cases
still pass.

docs/api.md names the refusal for all five sign-in doors.

Claude-Session: https://claude.ai/code/session_01Rj4CMyK2EqxerMihbGs3Kr

* test(auth): the cross-site sign-in guard keeps an allowed CORS origin, a remote token bootstrap and an admin's SPA register working (BUG-3680)

Codex r2 on #2146 found the new tests did not exercise these legitimate
callers, so a guard that broke them could pass. Each control is paired with a
refusal on the same door, so it proves the guard's discrimination and not a
door that ignores Origin. Mutants: dropping the CORS list fails the CORS test;
requiring an Origin fails the remote token bootstrap.

Claude-Session: https://claude.ai/code/session_01Rj4CMyK2EqxerMihbGs3Kr

2026-10-14 03:30:20 -04:00

..

render

fix(attachments): a HEIC embed is decided by what can be served and painted, not by an image/ prefix (BUG-2964)

2026-09-08 19:40:37 -04:00

testdata

test(interchange): golden bundle fixture and a full export, import, export round-trip diff (TASK-3628) (#2125)

2026-10-13 16:11:27 -04:00

access_epoch_test.go

fix: the access epoch tracks the live collection set; deleted collections leave the local index; the open-children guard ignores them (BUG-3428 phase 2) (#1826)

2026-10-06 07:59:20 -04:00

access_epoch.go

fix: the access epoch tracks the live collection set; deleted collections leave the local index; the open-children guard ignores them (BUG-3428 phase 2) (#1826)

2026-10-06 07:59:20 -04:00

access_kick.go

feat(server): revoking access re-checks live connections immediately (#1744)

2026-10-02 19:43:19 -04:00

activity_cursor_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

activity_cursor.go

fix(activity): feeds page by a (created_at, id) keyset and break timestamp ties by id (BUG-2781) (#1459)

2026-09-23 09:05:05 -04:00

app_api_attachments.go

fix(apps): an app upload is charged against the plan's storage cap (BUG-3653 part B) (#2119)

2026-10-13 15:44:44 -04:00

app_api_read.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

app_api_write.go

feat(apps): the app API admits a person's delegated token (TASK-3399, SPEC-6 U5b-2) (#1782)

2026-10-04 22:57:52 -04:00

app_api.go

fix(apps): an app upload is charged against the plan's storage cap (BUG-3653 part B) (#2119)

2026-10-13 15:44:44 -04:00

app_attribution.go

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

app_delegated_consent.go

feat(apps): the app API admits a person's delegated token (TASK-3399, SPEC-6 U5b-2) (#1782)

2026-10-04 22:57:52 -04:00

app_item_actions.go

feat(apps): app item actions and context codes (TASK-3414, SPEC-6 U11) (#1784)

2026-10-05 02:29:48 -04:00

app_pending_sweep.go

feat(items): idempotency keys for patch writes (TASK-3585) (#2062)

2026-10-11 11:33:30 -04:00

app_tokens.go

fix(oauth): introspection describes only the caller's own client's access tokens (BUG-3398) (#1791)

2026-10-05 11:51:01 -04:00

app_upgrade_diff_test.go

feat(apps): app upgrade: staged preview with a classed diff, one-transaction confirm that re-derives it (TASK-3397, SPEC-6 U8b2) (#1777)

2026-10-04 16:16:29 -04:00

app_upgrade_diff.go

fix(server): the upgrade diff states what a widened delegated access grants (BUG-3427) (#1817)

2026-10-05 19:45:01 -04:00

app_webhook_delivery.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

app_webhooks.go

feat(apps): upgrade review and draft activation in Settings → Apps (TASK-3413, SPEC-6 U9b) (#1789)

2026-10-05 06:09:12 -04:00

apps_available.go

feat(apps): app attachment routes: item-scoped upload, metadata, and a streamed download re-admitted before its first byte (TASK-3401, SPEC-6 U6c) (#1776)

2026-10-04 15:14:27 -04:00

artifact_import_parity_test.go

feat(apps): app install provisioning, install codes and redeem (TASK-3397, SPEC-6 U8b) (#1772)

2026-10-04 11:59:42 -04:00

artifact_import.go

feat(apps): app install staging: apps/1 manifest, fetch policy, pending reservations, preview (TASK-3397, U8a) (#1770)

2026-10-04 07:19:07 -04:00

artifact_normalize.go

feat(apps): app install staging: apps/1 manifest, fetch policy, pending reservations, preview (TASK-3397, U8a) (#1770)

2026-10-04 07:19:07 -04:00

attachments_authz.go

fix(store): route cross-workspace copy's lock-held reads through the copy transaction (BUG-2409) (#1136)

2026-08-17 08:16:02 -04:00

authz_cross_workspace_test.go

fix(access): system collections are ordinary collections for restricted members (TASK-3376) (#1756)

2026-10-03 09:19:10 -04:00

authz_cross_workspace.go

feat: built-ins record their origin; an item made from one can be offered Pad's current text (TASK-3462 U1+U2) (#1852)

2026-10-07 06:40:06 -04:00

body_reader_census_test.go

fix(server): cap the MCP request body at 7 MiB, answering 413 (BUG-3534) (#1988)

2026-10-09 19:48:36 -04:00

bootstrap_test.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

bootstrap.go

feat(auth): PAD_BYPASS_SETUP_TOKEN open-bootstrap escape hatch (#429)

2026-05-06 13:27:12 -04:00

bug1791_archived_visibility_test.go

fix(items): surface archived items instead of masking them as missing (BUG-1791) (#733)

2026-06-15 14:44:58 -04:00

bug1926_me_admin_bearer_test.go

fix(server): the /me summary mirrors the admin bypass; every admin route proven open to an admin session, closed to an admin PAT (BUG-1926) (#1918)

2026-10-08 19:33:25 -04:00

bug2136_invite_consent_test.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

bug2367_close_state_test.go

fix(BUG-2367): a move or copy that would reopen, close or un-abandon an item must name the status instead of inheriting whatever survived migration (#1516)

2026-09-24 15:53:06 -04:00

bug2367_migrate_doors_test.go

fix(BUG-2367): moves and copies never carry into a computed field, and a carried unique-field collision is dropped and named instead of 500ing or storing a duplicate (#1514)

2026-09-24 13:12:32 -04:00

bug2639_guest_grant_terminal_test.go

fix(store): item field filters match exactly; the comma OR is explicit and lives only in the list endpoint's query parse (BUG-3167) (#1478)

2026-09-23 20:24:40 -04:00

bug2640_done_field_display_test.go

fix(project): standup and changelog rows show the value of the item's own done field, not a blank read from a literal status (BUG-2640) (#1477)

2026-09-23 19:37:58 -04:00

bug2683_bulk_move_dropped_test.go

test(BUG-2683): pin that a bulk move records an ordinary dropped field in its activity row, the case the bug was filed for (#1531)

2026-09-25 02:03:55 -04:00

bug2684_preflight_origin_test.go

test(BUG-2684): pin that the copy preflight labels a dropped-then-defaulted key from=default, the case the bug was filed for (#1533)

2026-09-25 01:36:38 -04:00

bug2685_grandfathered_reserved_key_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

bug2788_entry_id_stability_test.go

fix(timeline): structured entries get a persisted id instead of a positional one that renumbers when a sibling moves (BUG-2788) (#1540)

2026-09-25 07:10:26 -04:00

bug2812_scan_bench_test.go

fix(server): the request-body gate reads tokens with jsontext, so a NUL behind a repeated key or beside 1e999 is refused, and a repeated request member is refused on every body (BUG-2812) (#1550)

2026-09-25 21:48:30 -04:00

bug2817_metrics_label_bound_test.go

fix(metrics): bound the MCP tool label and the HTTP method label, which callers could fill with invented values (BUG-2817) (#1456)

2026-09-23 06:01:08 -04:00

bug2819_audit_source_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

bug2819_filename_source_wiring_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

bug2896_collection_traits_duplicate_keys_test.go

fix(store): a JSON blob that repeats a member is stored collapsed, so SQLite's json_extract and Go read the same value (BUG-2896) (#1547)

2026-09-25 16:24:50 -04:00

bug3028_relation_blank_test.go

fix: a relation's "no target" has one stored form, and required means it names one (BUG-3028) (#1427)

2026-09-22 08:08:15 -04:00

bug3035_applier_seq_test.go

fix(cli): item edit refuses a stale body, guards its save with expected_seq, and keeps a recovery file on failure (BUG-3035) (#1418)

2026-09-21 21:03:05 -04:00

bug3037_expected_seq_test.go

feat(items): expected_seq — an OCC token that can tell two same-second writes apart (BUG-3037) (#1351)

2026-09-13 22:38:15 -04:00

bug3049_bulk_field_patch_test.go

fix(items): twelve item-field writers send a patch instead of replacing the blob (BUG-3049 / BUG-3055) (#1349)

2026-09-13 21:14:57 -04:00

bug3069_workspace_not_found_test.go

fix(api): a workspace that does not resolve answers 404 not_found marked details.scope=workspace, so a client can tell it from a missing item (BUG-3069) (#1534)

2026-09-25 03:46:16 -04:00

bug3079_default_drop_test.go

fix(items): an injected schema default takes the same type check a supplied value takes (BUG-3079) (#1362)

2026-09-14 09:03:24 -04:00

bug3080_client_write_test.go

fix: a tab's older content write can no longer land over its newer one (BUG-3080) (#1435)

2026-09-22 13:54:24 -04:00

bug3099_account_delete_owned_test.go

fix(store): account deletion reads the owned workspaces inside its transaction under the owner lock, so a workspace minted or unjoined in the window no longer survives its deleted owner (BUG-3099) (#1567)

2026-09-26 09:47:46 -04:00

bug3124_watermark_stamp_test.go

feat: a caught-up tab stamps the flush watermark, so viewing an item no longer leaves it pending (BUG-3124 unit B) (#1420)

2026-09-21 22:50:56 -04:00

bug3154_bulk_undeclared_key_test.go

fix(server): a bulk status or priority change refuses an item whose collection has no such field (BUG-3154) (#1450)

2026-09-23 03:09:25 -04:00

bug3163_reserved_write_doors_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

bug3167_query_or_contract_test.go

fix(store): item field filters match exactly; the comma OR is explicit and lives only in the list endpoint's query parse (BUG-3167) (#1478)

2026-09-23 20:24:40 -04:00

bug3202_field_number_precision_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

bug3202_semantic_compare_test.go

fix(fields): field writes keep every number's literal, so an integer above 2^53 is no longer rounded by a write that never named it (BUG-3202) (#1545)

2026-09-25 14:22:09 -04:00

bug3219_repeated_member_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

bug3244_rebuild_seed_grant_test.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

bug3244_schema_rebuild_set_aside_test.go

fix(collab): a schema rebuild sets aside the WHOLE op-log, so set-aside edits can be replayed (TASK-3574 (4)) (#2047)

2026-10-11 00:17:53 -04:00

bug3244_set_aside_guard_test.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

bug3254_guest_workspace_get_test.go

fix(workspaces): GET /workspaces/{ws} marks a guest, so a guest who arrives by URL gets the guest sidebar, not member chrome (BUG-3254) (#1616)

2026-09-27 13:08:42 -04:00

bug3257_role_board_counts_test.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

bug3273_stream_soft_delete_test.go

fix(server): an open workspace event stream closes when its workspace is soft-deleted (BUG-3273) (#1638)

2026-09-28 11:04:51 -04:00

bug3307_workspace_slug_test.go

fix(store): reusing a recently deleted workspace's name no longer 500s, and a create that loses a slug race takes the next one (BUG-3307) (#1689)

2026-09-30 09:10:41 -04:00

bug3314_activity_ip_test.go

fix(store): activity reads a member can reach no longer return ip_address and user_agent (BUG-3314) (#1679)

2026-09-30 02:20:23 -04:00

bug3327_applier_version_test.go

fix(versions): an applier-path body write leaves a version row (BUG-3327) (#1709)

2026-10-01 23:56:37 -04:00

bug3331_search_scope_test.go

fix(search): scope workspace search to visible items (#1723)

2026-10-02 11:18:07 -04:00

bug3333_deleted_collection_grant_test.go

fix(store): reads exclude soft-deleted collections' items (BUG-3425) (#1820)

2026-10-05 21:18:56 -04:00

bug3334_fail_closed_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

bug3335_document_restore_scope_test.go

fix(documents): restore only a document of the URL's workspace (BUG-3335) (#1724)

2026-10-02 13:15:31 -04:00

bug3336_account_delete_test.go

fix(account): account deletion needs an interactive, recently signed-in session (BUG-3336) (#1733)

2026-10-02 15:43:57 -04:00

bug3337_connection_authoritative_test.go

fix(mcp): a connection row decides workspace access, not the legacy token list (BUG-3337) (#1749)

2026-10-02 22:03:29 -04:00

bug3338_include_future_test.go

fix(oauth): include_future_workspaces is no longer a control; limit to current is an action (BUG-3338) (#1751)

2026-10-02 22:41:29 -04:00

bug3339_share_link_deleted_workspace_test.go

fix(share-links): a link stops resolving while its workspace is deleted (#1726)

2026-10-02 12:41:02 -04:00

bug3340_webhook_scope_test.go

fix(webhooks): whole-workspace access to manage; no delivery for a deleted workspace (#1727)

2026-10-02 13:20:09 -04:00

bug3341_lease_permission_test.go

feat(lease): an opaque worker id holds item leases, so two agents under one name do not share one (TASK-3613) (#2102)

2026-10-12 09:24:33 -04:00

bug3342_role_board_scope_test.go

fix(server): role-board reorder refuses another workspace's item and counts its rows (BUG-3342) (#1750)

2026-10-02 22:16:36 -04:00

bug3343_sse_empty_collection_test.go

fix(sse): an item event without a collection is not workspace-level (BUG-3343) (#1729)

2026-10-02 13:52:04 -04:00

bug3346_body_ids_test.go

fix(api): body-supplied IDs must name something in the authorized workspace (BUG-3346) (#1728)

2026-10-02 13:34:22 -04:00

bug3347_access_epoch_effective_test.go

fix: the access epoch tracks the live collection set; deleted collections leave the local index; the open-children guard ignores them (BUG-3428 phase 2) (#1826)

2026-10-06 07:59:20 -04:00

bug3348_unverified_email_access_test.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

bug3349_disable_test.go

fix(auth): disabling an account ends every credential, and a disabled account gets no new one (BUG-3349) (#1741)

2026-10-02 18:34:56 -04:00

bug3350_session_kind_test.go

fix(auth): a CLI session is never a browser cookie, and sign-in refuses a cross-site form (BUG-3350) (#1747)

2026-10-02 20:48:37 -04:00

bug3353_legacy_token_test.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

bug3354_import_bundle_bomb_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

bug3355_last_owner_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

bug3356_set_plan_revision_test.go

fix(billing): a plan past its expiry entitles nothing, and Stripe plan writes are ordered (BUG-3356) (#1753)

2026-10-02 23:32:54 -04:00

bug3357_bundle_duplicate_attachment_test.go

fix(import): refuse duplicate source ids and attach by source id (#1740)

2026-10-02 17:51:55 -04:00

bug3357_bundle_ownership_test.go

fix(import): refuse duplicate source ids and attach by source id (#1740)

2026-10-02 17:51:55 -04:00

bug3361_admin_pat_test.go

feat(cloud): a Stripe event marker is a claim with a lease, so a handler that dies does not lose the event (BUG-3561, pad half) (#2043)

2026-10-11 00:02:50 -04:00

bug3366_index_doors_test.go

test(server): /items-index and /items-changes do not name an ungranted parent (BUG-3366, TASK-2215 review) (#1959)

2026-10-09 08:15:03 -04:00

bug3366_lineage_guest_test.go

fix(server): lineage and closure name only items the caller may see (#1743)

2026-10-02 18:49:07 -04:00

bug3372_attribution_test.go

fix(server): attribution comes from the request, never the body (BUG-3372) (#1754)

2026-10-03 03:51:24 -04:00

bug3379_imported_marker_test.go

feat(import): mark rows a workspace import wrote, author not verified (BUG-3379) (#1755)

2026-10-03 05:18:30 -04:00

bug3382_verify_claim_test.go

fix(auth): a verification link verifies only for its account's session; the mailbox owner can claim (BUG-3382) (#1758)

2026-10-03 09:48:19 -04:00

bug3395_retry_effects_test.go

fix(store): account deletion and workspace purge lock comments root first, and retry a residual deadlock (BUG-3395) (#1792)

2026-10-05 07:01:22 -04:00

bug3398_introspect_test.go

fix(oauth): introspection describes only the caller's own client's access tokens (BUG-3398) (#1791)

2026-10-05 11:51:01 -04:00

bug3400_reuse_ownership_test.go

fix(oauth): another client's replay of a spent refresh token or code revokes nothing (BUG-3400) (#1807)

2026-10-05 13:22:23 -04:00

bug3407_validated_schema_census_test.go

feat(collab): a patch to an item open in an editor applies as a narrowed replace (PLAN-3578 step 2) (#2056)

2026-10-11 07:45:12 -04:00

bug3416_app_me_test.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

bug3417_null_lists_test.go

fix(apps): every list in an apps JSON response is a list, never null (BUG-3417) (#1796)

2026-10-05 08:49:03 -04:00

bug3424_grant_path_ceiling_test.go

fix(server): the item-grant filter keeps an app request's read ceiling (BUG-3424) (#1825)

2026-10-06 01:33:24 -04:00

bug3425_deleted_collection_reads_test.go

fix(store): reads exclude soft-deleted collections' items (BUG-3425) (#1820)

2026-10-05 21:18:56 -04:00

bug3427_upgrade_delegated_copy_test.go

fix(server): the upgrade diff states what a widened delegated access grants (BUG-3427) (#1817)

2026-10-05 19:45:01 -04:00

bug3428_phase2_epoch_guard_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

bug3437_comment_on_update_test.go

fix(timeline): 'commented on update' only for a comment an update carried (BUG-3437) (#1832)

2026-10-06 12:57:14 -04:00

bug3438_register_invitation_claim_test.go

fix(server): register-with-code claims the invitation atomically; a gone invitation refuses and rolls the account back (BUG-3438) (#1834)

2026-10-06 15:48:30 -04:00

bug3446_blank_library_options_test.go

feat: built-ins record their origin; an item made from one can be offered Pad's current text (TASK-3462 U1+U2) (#1852)

2026-10-07 06:40:06 -04:00

bug3447_collection_agent_activity_test.go

fix: the first-run launchpad follows an onboarding agent live (BUG-3447) (#1837)

2026-10-06 18:31:29 -04:00

bug3447_collection_create_event_test.go

fix: the first-run launchpad follows an onboarding agent live (BUG-3447) (#1837)

2026-10-06 18:31:29 -04:00

bug3453_ready_fallback_test.go

fix(server): an ordinary open backlog fills Up next and pad project ready (BUG-3453) (#1854)

2026-10-07 08:36:58 -04:00

bug3474_reval_fail_closed_test.go

fix(server): a collab revalidation tick that errors makes the conn read-only (BUG-3474) (#1866)

2026-10-07 19:45:14 -04:00

bug3479_remove_unusable_truth_test.go

fix(server): removeUnusableWorkspace reports a failed delete as kept (BUG-3479) (#1870)

2026-10-07 23:39:39 -04:00

bug3480_list_filter_keys_test.go

fix: item lists refuse a filter key that names no field (BUG-3480) (#1880)

2026-10-08 10:43:33 -04:00

bug3482_delete_totp_limit_test.go

fix(auth): account deletion's 2FA code goes through login's limiter and single-use claim (BUG-3482) (#1881)

2026-10-08 09:09:20 -04:00

bug3530_share_order_test.go

fix(server): a shared collection lists items in the owner's arranged order (BUG-3530) (#1990)

2026-10-09 20:32:51 -04:00

bug3534_mcp_body_limit_test.go

fix(server): cap the MCP request body at 7 MiB, answering 413 (BUG-3534) (#1988)

2026-10-09 19:48:36 -04:00

bug3538_suggested_once_per_item_test.go

fix(dashboard): a task under two active plans no longer pins the skeleton (BUG-3538) (#2002)

2026-10-09 23:25:20 -04:00

bug3544_invite_setup_window_test.go

fix(server): a workspace invite in the setup window answers setup_required, not 500 (BUG-3544) (#2034)

2026-10-10 20:15:11 -04:00

bug3586_patch_timeout_test.go

fix(collab): a patch whose applier times out is not re-sent to another tab (BUG-3586) (#2059)

2026-10-11 08:33:52 -04:00

bug3626_account_export_test.go

fix(server): an account export that times out or fails says so, instead of arriving short (BUG-3626) (#2109)

2026-10-12 15:12:22 -04:00

bug3634_restricted_owner_grant_test.go

fix(members): a collection-restricted owner cannot grant beyond its scope through invitations or role changes (BUG-3634) (#2116)

2026-10-13 11:16:07 -04:00

bug3652_refused_upload_blob_test.go

fix(export): an export reads one snapshot, so a concurrent write cannot leave an item without its collection (BUG-3654) (#2122)

2026-10-14 00:25:14 -04:00

bug3653_app_storage_limit_test.go

fix(apps): an app upload is charged against the plan's storage cap (BUG-3653 part B) (#2119)

2026-10-13 15:44:44 -04:00

bug3653_storage_cap_doors_test.go

fix(storage): bundle import and cross-workspace copy are charged against the storage cap (BUG-3653, TASK-3625) (#2117)

2026-10-13 12:27:31 -04:00

bug3669_share_csp_test.go

fix(share): a shared item body is sanitized with the markdown allowlist, and the SPA CSP restricts form-action (BUG-3669) (#2145)

2026-10-14 02:04:58 -04:00

bug3671_oauth_subject_test.go

fix(auth): a social sign-in without a provider subject is refused on an account with one bound (BUG-3671) [deploy BEFORE pad-cloud #80] (#2144)

2026-10-14 02:02:41 -04:00

bug3678_refresh_window_test.go

fix(oauth): a revoked grant mints nothing, and one refresh token rotates once (BUG-3678) (#2121)

2026-10-13 22:34:03 -04:00

bug3679_reset_link_after_password_change_test.go

fix(auth): a password change kills outstanding reset links (BUG-3679) (#2114)

2026-10-13 10:15:42 -04:00

bug3680_cross_site_signin_doors_test.go

fix(auth): reset-password, register and bootstrap refuse a cross-site form, as login does (BUG-3680) (#2146)

2026-10-14 03:30:20 -04:00

bug3703_list_filter_cap_test.go

fix(api): item lists are bounded at 1000 with has-more paging, and filter-key probing is bounded (BUG-3704, BUG-3703) (#2143)

2026-10-14 01:07:58 -04:00

bug3704_list_bounds_test.go

fix(api): item lists are bounded at 1000 with has-more paging, and filter-key probing is bounded (BUG-3704, BUG-3703) (#2143)

2026-10-14 01:07:58 -04:00

bug3747_compaction_generation_test.go

fix(collab): a compaction snapshot covers only its own generation's cursors (BUG-3747) (#2142)

2026-10-13 23:30:26 -04:00

bug3768_restricted_owner_apps_test.go

fix(apps): a collection-restricted owner cannot grant an app whole-workspace access (BUG-3768) (#2123)

2026-10-13 14:41:33 -04:00

claim_codes_test.go

feat(mcp): workspace.create + workspace.claim actions + claim-code mechanics (TASK-1521) (#582)

2026-05-18 00:43:46 -04:00

claim_codes.go

feat(mcp): workspace.create + workspace.claim actions + claim-code mechanics (TASK-1521) (#582)

2026-05-18 00:43:46 -04:00

client_write_marks.go

fix: a tab's older content write can no longer land over its newer one (BUG-3080) (#1435)

2026-09-22 13:54:24 -04:00

cloud_admin_gate_test.go

feat(cloud): the Stripe customer link is compare-and-set, and readable by user (TASK-3549) (#2027)

2026-10-10 15:59:17 -04:00

cloud_contract_test.go

feat(cloud): a Stripe event marker is a claim with a lease, so a handler that dies does not lose the event (BUG-3561, pad half) (#2043)

2026-10-11 00:02:50 -04:00

collection_resolve_test.go

fix(cli,mcp): send raw collection slug so an alias can't shadow a real collection (BUG-2630) (#1162)

2026-08-19 08:13:29 -04:00

collection_resolve.go

fix(cli,mcp): send raw collection slug so an alias can't shadow a real collection (BUG-2630) (#1162)

2026-08-19 08:13:29 -04:00

compress_routes_test.go

feat(server): gzip what the client accepts, except streams, upgrades, ranges and secrets (TASK-2225) (#1934)

2026-10-09 03:16:26 -04:00

content_disposition_test.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

content_disposition.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

content_state_population_test.go

fix(web): a body the server marks as behind its live document says so wherever it is rendered — share pages, the read-only pane, the diff, and a dot on marked rows in lists, backlinks and the palette (BUG-3050 U3) (#1577)

2026-09-26 13:37:34 -04:00

content_write_guard.go

feat(items): agent body writes are version-checked by default, phase 1: count, warn, replace (PLAN-3555) (#2054)

2026-10-11 05:29:53 -04:00

context.go

feat(lease): an opaque worker id holds item leases, so two agents under one name do not share one (TASK-3613) (#2102)

2026-10-12 09:24:33 -04:00

copy_preflight_drop_reason_parity_test.go

IDEA-2893 + IDEA-2894: record the accepted carry disclosure, and make the drop-reason mapper testable (#1254)

2026-09-05 19:01:57 -04:00

dashboard_attention_decisions_test.go

feat(decision): content-aware attention on the dashboard and item page (TASK-3118) (#1421)

2026-09-21 23:55:54 -04:00

decision_settings_test.go

feat(decision): instance-admin settings for the decision provider (TASK-3121) (#1426)

2026-09-22 07:34:33 -04:00

decision_settings.go

feat(decision): executable conventions, the server half (TASK-3119 U1a) (#1859)

2026-10-07 12:42:32 -04:00

decision_tick.go

feat(decision): instance-admin settings for the decision provider (TASK-3121) (#1426)

2026-09-22 07:34:33 -04:00

decode_json_nul_test.go

feat(mcp): count admitted MCP requests by method and client (TASK-2307) (#2003)

2026-10-10 00:50:31 -04:00

decode_json_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

document_lock_contention_test.go

fix(store): serialize document renames and stop reading the pool inside transactions (BUG-2778) (#1208)

2026-08-25 22:40:58 -04:00

events_publish_test.go

fix(events): Publish reports its outcome, and a failed activity publish is counted and logged (BUG-2732) (#1457)

2026-09-23 07:03:36 -04:00

events_publish.go

fix(events): Publish reports its outcome, and a failed activity publish is counted and logged (BUG-2732) (#1457)

2026-09-23 07:03:36 -04:00

events_surface_test.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

events_surface.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

handlers_2fa_recovery_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

handlers_2fa_totp_step_test.go

fix(security): make TOTP login codes single-use (BUG-2054) (#914)

2026-07-10 23:56:59 -04:00

handlers_2fa.go

fix: owners cannot lock themselves out by mistake; accounts with no password can set one and turn 2FA off (TASK-2190) (#1879)

2026-10-08 07:41:35 -04:00

handlers_account_export_contract_test.go

fix(server): an account export that times out or fails says so, instead of arriving short (BUG-3626) (#2109)

2026-10-12 15:12:22 -04:00

handlers_account_export_gate_test.go

fix(server): an account export that times out or fails says so, instead of arriving short (BUG-3626) (#2109)

2026-10-12 15:12:22 -04:00

handlers_account_test.go

fix(billing): account deletion proceeds past a sidecar 400 only for the old sidecar's empty-customer refusal (BUG-3560, retro of #2036) (#2076)

2026-10-11 18:09:25 -04:00

handlers_account.go

fix(server): an account export that times out or fails says so, instead of arriving short (BUG-3626) (#2109)

2026-10-12 15:12:22 -04:00

handlers_activity_debounce_actor_test.go

fix(store): activity debounce must not merge across writers (BUG-2763) (#1201)

2026-08-25 14:28:29 -04:00

handlers_activity.go

feat(activity): the collection and actor filters run on the server, and the web/CLI badge says which (TASK-2219) (#1948)

2026-10-09 06:36:13 -04:00

handlers_admin_bearer_gate_test.go

fix(security): gate collab WebSocket writes on editor role (TASK-265) (#938)

2026-07-15 01:30:12 -04:00

handlers_admin_billing_test.go

fix(billing): admin stats count upgrades by when the account became Pro (BUG-3591) (#2069)

2026-10-11 16:25:01 -04:00

handlers_admin_billing.go

fix(billing): admin stats count upgrades by when the account became Pro (BUG-3591) (#2069)

2026-10-11 16:25:01 -04:00

handlers_admin_invitations.go

feat(invitations): a mailbox-only proof on invitation emails verifies the invitee (TASK-3352) (#1757)

2026-10-03 07:59:37 -04:00

handlers_admin_mcp_test.go

feat(mcp): MCP addressing from config; mcp_enabled setting with an env lock (TASK-3302, PLAN-2310 U1) (#1662)

2026-09-29 12:46:03 -04:00

handlers_admin_mcp.go

fix(mcp): cloud refuses to start without an https origin for MCP OAuth; a blocked self-hosted MCP says so (TASK-1069) (#1920)

2026-10-08 21:23:12 -04:00

handlers_admin_settings_test.go

fix(admin): stop leaking 2FA secret via GET /admin/settings (BUG-1909) (#779)

2026-07-01 17:44:43 -04:00

handlers_admin_users_test.go

feat(billing): record plan_source; a lowering applies only from the source that set the plan (TASK-3295) (#1657)

2026-09-29 10:14:38 -04:00

handlers_admin_users.go

feat(auth): the bot principal for installed apps: users.kind, kind gates on every sign-in door and credential, people-only counts (TASK-3392) (#1766)

2026-10-03 19:41:18 -04:00

handlers_admin.go

feat(decision): instance-admin settings for the decision provider (TASK-3121) (#1426)

2026-09-22 07:34:33 -04:00

handlers_agent_roles.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

handlers_apps_delivery_test.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

handlers_apps_install_test.go

fix(server): refuse a collection schema that repeats or empties a field key or option (TASK-3539, PR B) (#2009)

2026-10-10 03:04:20 -04:00

handlers_apps_install.go

fix(apps): a collection-restricted owner cannot grant an app whole-workspace access (BUG-3768) (#2123)

2026-10-13 14:41:33 -04:00

handlers_apps_lifecycle.go

fix(apps): a collection-restricted owner cannot grant an app whole-workspace access (BUG-3768) (#2123)

2026-10-13 14:41:33 -04:00

handlers_apps_provision_test.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

handlers_apps_provision.go

fix(apps): a collection-restricted owner cannot grant an app whole-workspace access (BUG-3768) (#2123)

2026-10-13 14:41:33 -04:00

handlers_apps_u10c_test.go

feat(apps): per-endpoint webhook delivery state, a per-install rate cap, and a 24 h drop (TASK-3408, SPEC-6 U10c) (#1783)

2026-10-05 00:02:49 -04:00

handlers_apps_upgrade_test.go

feat(apps): app upgrade: staged preview with a classed diff, one-transaction confirm that re-derives it (TASK-3397, SPEC-6 U8b2) (#1777)

2026-10-04 16:16:29 -04:00

handlers_apps_upgrade.go

fix(apps): a collection-restricted owner cannot grant an app whole-workspace access (BUG-3768) (#2123)

2026-10-13 14:41:33 -04:00

handlers_apps_webhooks_test.go

feat(apps): app-owned webhooks, held until redeem hands out the secret (TASK-3408, SPEC-6 U10a) (#1778)

2026-10-04 18:21:57 -04:00

handlers_artifact_export_device_test.go

fix(BUG-3185): an item export's file name whose stem is a Windows device gets a "_" prefix, on the server and in the CLI (#1495)

2026-09-24 03:44:11 -04:00

handlers_artifact_export.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

handlers_artifact_import_relation_carry_test.go

fix: a relation's "no target" has one stored form, and required means it names one (BUG-3028) (#1427)

2026-09-22 08:08:15 -04:00

handlers_artifact_import_warnings_test.go

WIP feat(server,store): referent validation for relation values — 6 of 8 doors (TASK-2878) (#1246)

2026-09-05 10:07:44 -04:00

handlers_artifact_import.go

feat(apps): app install provisioning, install codes and redeem (TASK-3397, SPEC-6 U8b) (#1772)

2026-10-04 11:59:42 -04:00

handlers_artifact_test.go

fix(cli): refuse a blank --stdin body on item create/update; add --clear-content (BUG-3100) (#1415)

2026-09-21 18:52:28 -04:00

handlers_attachments_attach_test.go

feat(attachments): attach binds an unattached upload to an item, so its share renders it (TASK-2247) (#1652)

2026-09-28 19:25:55 -04:00

handlers_attachments_attach.go

feat(attachments): attach binds an unattached upload to an item, so its share renders it (TASK-2247) (#1652)

2026-09-28 19:25:55 -04:00

handlers_attachments_bug2818_test.go

fix(attachments): the blocklist judges the same filename the download header serves (BUG-2818) (#1445)

2026-09-22 20:54:46 -04:00

handlers_attachments_bug2822_test.go

fix(attachments): a stored name Windows would open as a device gets a "_" prefix (BUG-2822) (#1493)

2026-09-24 02:37:59 -04:00

handlers_attachments_bug3153_test.go

fix(attachments): drop Bidi_Control characters from attachment names and rewrite legacy rows (BUG-3153) (#1452)

2026-09-23 04:35:58 -04:00

handlers_attachments_download_authz_test.go

refactor(attachments): centralize parent resolution, close orphan-read and delete-denial gaps

2026-08-02 00:55:20 +00:00

handlers_attachments_download_mime_test.go

fix(server): force-download unknown and disallowed stored MIME (BUG-2413)

2026-08-08 20:37:39 +00:00

handlers_attachments_download_test.go

fix(ci): gofmt + bump race-detector timeout to 30m (#299)

2026-04-29 15:41:12 -04:00

handlers_attachments_isobmff_test.go

fix(attachments): HEIC, HEIF and AVIF are recognised from their bytes, not refused (BUG-2961) (#1291)

2026-09-08 13:30:42 -04:00

handlers_attachments_test.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_attachments_thumbnails_parent_test.go

fix(attachments): skip derivation for an archived parent (TASK-2404)

2026-08-01 23:27:34 +00:00

handlers_attachments_thumbnails_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

handlers_attachments_thumbnails.go

feat(appstore): app attachment upload, read rule and caps behind FencedTx (TASK-3396, U7a) (#1768)

2026-10-03 21:31:44 -04:00

handlers_attachments_transform_authz_test.go

fix(attachments): gate transform on item visibility (TASK-2402)

2026-08-01 23:05:26 +00:00

handlers_attachments_transform_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_attachments_transform.go

fix(attachments): a refused upload, transform or import reclaims the blob it wrote (BUG-3652) (#2118)

2026-10-13 13:24:49 -04:00

handlers_attachments_upload_live_item_test.go

refactor(attachments): centralize parent resolution, close orphan-read and delete-denial gaps

2026-08-02 00:55:20 +00:00

handlers_attachments_variant_headers_test.go

fix(attachments): a HEIC embed is decided by what can be served and painted, not by an image/ prefix (BUG-2964)

2026-09-08 19:40:37 -04:00

handlers_attachments.go

fix(attachments): a refused upload, transform or import reclaims the blob it wrote (BUG-3652) (#2118)

2026-10-13 13:24:49 -04:00

handlers_audit.go

fix(auth): store errors on access decisions fail closed (BUG-3334) (#1730)

2026-10-02 14:06:35 -04:00

handlers_auth_admin_register_test.go

fix(auth): an admin-created registration mints no session, so creating an account no longer hands the admin a live credential for the new user (BUG-3232) (#1581)

2026-09-26 15:27:50 -04:00

handlers_auth_bootstrap_bypass_test.go

feat(auth): PAD_BYPASS_SETUP_TOKEN open-bootstrap escape hatch (#429)

2026-05-06 13:27:12 -04:00

handlers_auth_bootstrap_token_test.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

handlers_auth_local_reset_test.go

feat(auth): localhost password recovery for locked-out self-host admins (#760)

2026-06-22 20:58:50 -04:00

handlers_auth_loopback_test.go

fix(server): read raw TCP peer for loopback check (TASK-662) (#175)

2026-04-21 19:33:47 -04:00

handlers_auth_ratelimit_test.go

feat(auth): per-email login rate limiter (TASK-651) (#178)

2026-04-21 20:52:03 -04:00

handlers_auth_replaced_session_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_auth_session_rotation_test.go

feat(server): zxcvbn password strength check at registration / rotation / reset (TASK-669) (#193)

2026-04-22 12:21:34 -04:00

handlers_auth_test.go

feat(billing): billing availability and prices come from the sidecar; PAD_BILLING=auto|off (TASK-3577) (#2048)

2026-10-11 01:29:49 -04:00

handlers_auth.go

fix(auth): reset-password, register and bootstrap refuse a cross-site form, as login does (BUG-3680) (#2146)

2026-10-14 03:30:20 -04:00

handlers_backlinks_admin_bearer_test.go

fix(backlinks): scope cross-workspace admin enumeration to membership for bearer auth (BUG-1617) (#633)

2026-05-27 10:37:30 -04:00

handlers_backlinks.go

fix(server): consistent soft-delete handling across item sub-resources (#771)

2026-06-27 21:42:52 -05:00

handlers_bootstrap_test.go

fix(server): guard degraded/degraded_sections in bootstrap dashboard (BUG-2072) (#869)

2026-07-08 13:09:26 -04:00

handlers_bootstrap.go

feat: built-in update count in the bootstrap, and accepted updates record replaced fields (TASK-3462 U3a) (#1868)

2026-10-07 21:29:37 -04:00

handlers_bug3322_totp_doors_test.go

fix(auth): OAuth login and password reset no longer mint a session past TOTP (BUG-3322) (#1699)

2026-09-30 22:50:45 -04:00

handlers_builtin.go

feat(web): review and accept built-in updates from the Library page and the item pane (TASK-3462 U3b) (#1873)

2026-10-08 02:53:41 -04:00

handlers_capabilities.go

feat(items): idempotency keys for patch writes (TASK-3585) (#2062)

2026-10-11 11:33:30 -04:00

handlers_changelog_abandoned_test.go

fix(project): a collection's own abandoned_options decide what the changelog, standup and reports count as shipped (BUG-2347) (#1464)

2026-09-23 12:52:46 -04:00

handlers_changes.go

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

handlers_chatgpt_mcp.go

feat(mcp): count admitted MCP requests by method and client (TASK-2307) (#2003)

2026-10-10 00:50:31 -04:00

handlers_claim_code_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_claim_code.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_cli_auth_test.go

fix(server): derive CLI auth URL scheme from r.TLS, gate X-Forwarded-Proto on trusted proxies (TASK-665) (#190)

2026-04-22 09:27:45 -04:00

handlers_cli_auth.go

feat(auth): Deny and request context on the CLI sign-in approval page (TASK-2253) (#1943)

2026-10-09 05:04:19 -04:00

handlers_cloud_autocreate_husk_test.go

fix(cloud): auto-create removes a workspace it cannot seed or administer, and leaves no restorable husk (BUG-3087) (#1383)

2026-09-15 12:50:53 -04:00

handlers_cloud_autocreate_workspace_test.go

fix(cloud): auto-create removes a workspace it cannot seed or administer, and leaves no restorable husk (BUG-3087) (#1383)

2026-09-15 12:50:53 -04:00

handlers_cloud_member_ack_test.go

fix(cloud): reconcile before destroying a workspace whose owner-add lost its ack (BUG-3026) (#1341)

2026-09-11 19:34:44 -04:00

handlers_cloud.go

fix(auth): a social sign-in without a provider subject is refused on an account with one bound (BUG-3671) [deploy BEFORE pad-cloud #80] (#2144)

2026-10-14 02:02:41 -04:00

handlers_collab_applier_refusal_test.go

fix(server): a successful applier-path PATCH stops answering with the previous content (BUG-2995) (#1320)

2026-09-10 12:37:49 -04:00

handlers_collab_bug1308_test.go

test(collab): rate-bucket tests freeze their own bucket instead of racing the refill (BUG-3410) (#1788)

2026-10-05 05:08:38 -04:00

handlers_collab_prune_atomicity_test.go

fix(server): the op-log prune rides inside the write it justifies (BUG-2840 half B) (#1295)

2026-09-08 16:46:28 -04:00

handlers_collab_set_aside.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

handlers_collab_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_collab_watermark.go

feat(collab): count and log watermark stamps that cover content-bearing rows (TASK-3541 step 0) (#2023)

2026-10-10 11:54:42 -04:00

handlers_collab.go

feat(collab): a patch to an item open in an editor applies as a narrowed replace (PLAN-3578 step 2) (#2056)

2026-10-11 07:45:12 -04:00

handlers_collection_crud_visibility_test.go

fix(server): gate collection update/delete on visibility (BUG-1921) (#795)

2026-07-03 18:12:35 -04:00

handlers_collection_traits_rename_test.go

feat(store,server,web): collection kernel traits — de-hardcode conventions/playbooks slugs (TASK-2657, BUG-2702) (#1171)

2026-08-20 13:26:05 -04:00

handlers_collection_traits_test.go

feat(store,server): make collection trait uniqueness a database invariant — de-dup pass + partial unique indexes (TASK-2710) (#1257)

2026-09-05 20:43:43 -04:00

handlers_collections_concurrency_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_collections_refusal_status_test.go

fix(server): a refused collection prefix reaches the caller as a 400 naming the rule (BUG-2951) (#1293)

2026-09-08 14:51:21 -04:00

handlers_collections_reserved_keys_test.go

fix(server): reserve parent/plan schema field keys (TASK-1912) (#786)

2026-07-03 03:27:04 -04:00

handlers_collections.go

fix(server): refuse a collection schema that repeats or empties a field key or option (TASK-3539, PR B) (#2009)

2026-10-10 03:04:20 -04:00

handlers_comments_atomic_test.go

fix(comments): the "commented" activity and the comment commit in one transaction (BUG-2716) (#1388)

2026-09-15 16:36:26 -04:00

handlers_comments_bearer_gate_test.go

fix(server): bearer-gate canEditComment's admin bypass (BUG-1919) (#796)

2026-07-03 18:24:36 -04:00

handlers_comments_edit_test.go

feat(comments): comment editing backend — user_id, UpdateComment, PATCH, SSE (TASK-1663) (#665)

2026-05-30 12:38:57 -04:00

handlers_comments_item_scoped_test.go

fix(comments): a deleted comment with replies leaves a tombstone (BUG-3252) (#1675)

2026-09-30 00:41:20 -04:00

handlers_comments.go

feat(items): idempotency keys for comments, notes and decisions; idempotency_target_gone is structured (TASK-3585) (#2068)

2026-10-11 14:38:15 -04:00

handlers_connected_apps_mutations_test.go

fix(api): a workspace that does not resolve answers 404 not_found marked details.scope=workspace, so a client can tell it from a missing item (BUG-3069) (#1534)

2026-09-25 03:46:16 -04:00

handlers_connected_apps_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_connected_apps.go

feat(oauth): delegated sign-in for installed apps through the issuance barrier, shipped closed (TASK-3399, SPEC-6 U5b-1) (#1779)

2026-10-04 19:22:21 -04:00

handlers_content_state_doors_test.go

fix(items): eleven hand-built doors carry the stale-body marker (BUG-3033) (#1344)

2026-09-13 18:34:16 -04:00

handlers_convention_library.go

feat(server): library endpoints gain ?category, ?summary, /library/entry (TASK-1561) (#612)

2026-05-21 13:08:02 -04:00

handlers_dashboard_test.go

fix(server): an ordinary open backlog fills Up next and pad project ready (BUG-3453) (#1854)

2026-10-07 08:36:58 -04:00

handlers_dashboard.go

feat(lease): an opaque worker id holds item leases, so two agents under one name do not share one (TASK-3613) (#2102)

2026-10-12 09:24:33 -04:00

handlers_decisions_test.go

feat(decision): typed-decision storage and async runner (TASK-3117) (#1417)

2026-09-21 20:46:41 -04:00

handlers_decisions.go

feat(decision): typed-decision storage and async runner (TASK-3117) (#1417)

2026-09-21 20:46:41 -04:00

handlers_documents_test.go

fix(fields,activity): debounce typed-input field saves + collapse same-field activity runs (BUG-1466) (#549)

2026-05-14 22:10:12 -04:00

handlers_documents_title_test.go

fix(documents): bound the rename cascade at the title and at the projected total (BUG-2798, BUG-2796) (#1218)

2026-08-27 22:45:27 -04:00

handlers_documents.go

feat(mcp): remote /mcp writes are agent writes named by clientInfo; refused claims say lease_held (BUG-2772, BUG-3496) (#1903)

2026-10-08 15:15:26 -04:00

handlers_events_access_epoch_stream_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events_access_epoch_test.go

fix: the access epoch tracks the live collection set; deleted collections leave the local index; the open-children guard ignores them (BUG-3428 phase 2) (#1826)

2026-10-06 07:59:20 -04:00

handlers_events_cancel_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events_failed_test.go

fix(events): a closed MemoryBus refuses a late subscribe instead of handing out a channel nothing will close (BUG-2737) (#1483)

2026-09-23 21:52:18 -04:00

handlers_events_filter_test.go

fix(store): optimistic concurrency + sibling broadcast for collection settings (BUG-2265) (#989)

2026-07-21 09:43:05 -04:00

handlers_events_membership_test.go

fix(security): require workspace membership on SSE subscriptions (TASK-264) (#937)

2026-07-14 23:43:19 -04:00

handlers_events_resume_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events_revalidation_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_events_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events.go

fix: the Live badge reflects a dead SSE connection, and the reconnect catches up (TASK-2197) (#1895)

2026-10-08 13:41:39 -04:00

handlers_export_bundle_test.go

feat(attachments): bundle attachments + manifest in workspace export (TASK-884) (#305)

2026-04-29 18:30:43 -04:00

handlers_export_bundle.go

fix(export): an export reads one snapshot, so a concurrent write cannot leave an item without its collection (BUG-3654) (#2122)

2026-10-14 00:25:14 -04:00

handlers_export_gate_test.go

fix(server): deny workspace export to restricted owners (BUG-1922) (#813)

2026-07-04 13:54:08 -04:00

handlers_grant_visibility_test.go

fix(store): optimistic concurrency + sibling broadcast for collection settings (BUG-2265) (#989)

2026-07-21 09:43:05 -04:00

handlers_grants.go

feat(server): every access and credential change re-checks live connections (#1746)

2026-10-02 20:39:53 -04:00

handlers_graph_test.go

fix(server): bearer-gate visibleCollectionIDs to close BUG-1917 (#792)

2026-07-03 14:40:54 -04:00

handlers_graph.go

feat(server): focused neighborhood mode on workspace graph endpoint (TASK-1781) (#718)

2026-06-08 18:13:10 -04:00

handlers_import_bundle_bug3184_test.go

fix(server): an interrupted import rolls back, and its outcome can be asked for (BUG-3475) (#1867)

2026-10-07 21:03:24 -04:00

handlers_import_bundle_bug3191_test.go

fix(import): a panic after a bundle import creates its workspace takes the keep door, then re-panics (BUG-3191) (#1501)

2026-09-24 05:49:44 -04:00

handlers_import_bundle_bug3475_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

handlers_import_bundle_comment_refs_test.go

fix(store): cover documents and comment bodies in the attachment reference walks (BUG-2614, BUG-2615) (#1145)

2026-08-17 14:26:09 -04:00

handlers_import_bundle_husk_test.go

fix(import): a rejected bundle import leaves no restorable husk, and the shared removal reclaims blobs before it purges (BUG-3094) (#1385)

2026-09-15 14:12:20 -04:00

handlers_import_bundle_partial_test.go

fix(import): a kept partial bundle import is attached to its importer instead of left ownerless (BUG-2709) (#1386)

2026-09-15 15:40:13 -04:00

handlers_import_bundle_summary_test.go

feat(import): a bundle import reports what it carried next to what arrived, and a guide walks a self-hosted workspace to Pad Cloud (TASK-3612) (#2100)

2026-10-12 07:01:44 -04:00

handlers_import_bundle_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_import_bundle.go

fix(attachments): a refused upload, transform or import reclaims the blob it wrote (BUG-3652) (#2118)

2026-10-13 13:24:49 -04:00

handlers_import_partial_marker_test.go

feat(import): a partly imported workspace is marked until its owner keeps or deletes it (TASK-896) (#1923)

2026-10-08 22:22:06 -04:00

handlers_import_stale_bodies_test.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

handlers_import_test.go

feat(server): POST /api/v1/import/url endpoint + integration tests (TASK-1472) (#556)

2026-05-15 00:36:41 -04:00

handlers_import.go

feat(server): POST /api/v1/import/url endpoint + integration tests (TASK-1472) (#556)

2026-05-15 00:36:41 -04:00

handlers_invitation_accept_limit_test.go

fix(invitations): accepting as an existing member is idempotent (BUG-3281) (#1645)

2026-09-28 15:46:57 -04:00

handlers_invitation_deleted_workspace_test.go

fix(store,server): an invitation to a soft-deleted workspace reads as unknown (BUG-3104) (#1413)

2026-09-21 17:58:27 -04:00

handlers_invitation_email_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

handlers_invitation_preview_test.go

fix(server): invitation-preview endpoint + read-only email prefill on /join (BUG-1934) (#803)

2026-07-03 23:47:06 -04:00

handlers_item_context.go

feat(server): the item brief carries only the decisions Pad would surface, and counts the rest (TASK-3618) (#2107)

2026-10-12 11:53:29 -04:00

handlers_item_lease_test.go

fix(leases): bind item leases to the claiming account (#1731)

2026-10-02 14:20:58 -04:00

handlers_item_lease.go

feat(lease): an opaque worker id holds item leases, so two agents under one name do not share one (TASK-3613) (#2102)

2026-10-12 09:24:33 -04:00

handlers_item_links_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_item_links.go

fix(server): attribution comes from the request, never the body (BUG-3372) (#1754)

2026-10-03 03:51:24 -04:00

handlers_item_versions_bounds_test.go

fix: bound item history and stop resolving bodies nobody reads (BUG-2608) (#1147)

2026-08-17 19:02:53 -04:00

handlers_item_versions_bug3031_pg_test.go

fix(versions): a restore over unsaved collaborative edits is refused unless the caller consents to discarding them (BUG-3031) (#1573)

2026-09-26 12:57:38 -04:00

handlers_item_versions_bug3031_test.go

fix: an overwrite, including a confirmed version restore, that deleted another tab's unsaved edits says how many (BUG-3230 U2) (#1595)

2026-09-26 23:25:18 -04:00

handlers_item_versions_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_item_versions.go

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

handlers_items_access_epoch_test.go

feat(server,web): detect a revocation that writes no item, and evict the cache it left stale (IDEA-2898) (#1261)

2026-09-06 13:36:22 -04:00

handlers_items_ack_loss_test.go

fix(items): a lost commit ack no longer writes the item twice (BUG-2994) (#1340)

2026-09-11 18:03:09 -04:00

handlers_items_append_test.go

fix(items): note and decide append server-side under the write lock, so they no longer revert a concurrent field write (BUG-3056) (#1458)

2026-09-23 07:46:45 -04:00

handlers_items_attribution_test.go

fix(server): attribution comes from the request, never the body (BUG-3372) (#1754)

2026-10-03 03:51:24 -04:00

handlers_items_bug3133_pending_guard_test.go

fix: refuse a token-guarded content write over unflushed tab edits (BUG-3133) (#1423)

2026-09-22 00:42:02 -04:00

handlers_items_bug3230_refuse_pending_test.go

fix(web): the item pane's raw-markdown saves are refused, not applied, over another tab's unstored edits; an unload save keeps its text for recovery (BUG-3230 U0) (#1590)

2026-09-26 21:28:37 -04:00

handlers_items_bulk_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_items_bulk.go

fix(store,server): an item write re-checks its fields under the seq lock when the schema it was validated against has moved (BUG-3407) (#1806)

2026-10-05 12:44:17 -04:00

handlers_items_collab_versions_test.go

fix(server): attribution comes from the request, never the body (BUG-3372) (#1754)

2026-10-03 03:51:24 -04:00

handlers_items_content_echo_test.go

fix(items): a lost commit ack no longer writes the item twice (BUG-2994) (#1340)

2026-09-11 18:03:09 -04:00

handlers_items_content_route_test.go

fix(collab): an open tab refuses a content write over typing the server has not stored (BUG-3542) (#2016)

2026-10-10 09:08:04 -04:00

handlers_items_content_route.go

feat(collab): a patch to an item open in an editor applies as a narrowed replace (PLAN-3578 step 2) (#2056)

2026-10-11 07:45:12 -04:00

handlers_items_content_state_test.go

feat(items): content_state marks a body the server knows is stale (BUG-3000) (#1343)

2026-09-13 10:51:03 -04:00

handlers_items_copy_attachment_authz_test.go

fix(copy): authorize attachment references in cross-workspace copy (TASK-2408)

2026-08-02 04:54:31 +00:00

handlers_items_copy_content_state_test.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

handlers_items_copy_parity_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

handlers_items_copy_preflight_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_items_copy_preflight.go

feat(items): idempotency keys for cross-workspace copy and move (TASK-3585) (#2070)

2026-10-11 15:59:02 -04:00

handlers_items_copy_relation_test.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

handlers_items_copy_resolve.go

fix(items): a keyed replay of an archived-source move re-checks the destination (TASK-3585) (#2087)

2026-10-11 20:34:11 -04:00

handlers_items_copy_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_items_copy.go

fix(storage): bundle import and cross-workspace copy are charged against the storage cap (BUG-3653, TASK-3625) (#2117)

2026-10-13 12:27:31 -04:00

handlers_items_field_coercion_test.go

test(server): pin the last three coercion call sites (BUG-2850)

2026-09-03 12:49:33 +00:00

handlers_items_fieldpatch_test.go

feat(items): field-level PATCH + conflict envelope + read-only version history (TASK-2022) (#876)

2026-07-08 16:47:34 -04:00

handlers_items_github_pr_test.go

fix(items): github_pr is written only through a typed, validated update member; the field-setter door refuses it (BUG-2696, ToolSurfaceVersion 0.47) (#1469)

2026-09-23 14:35:41 -04:00

handlers_items_jsonb_inner_shape_test.go

feat(store): JSONB NOT NULL hardening on items/views + handler shape validation (IDEA-1486+1488) (#566)

2026-05-16 10:15:59 -04:00

handlers_items_move_overrides_test.go

fix(server): a move refuses a field override the destination does not declare, as the copy does (BUG-2379) (#1448)

2026-09-23 00:02:43 -04:00

handlers_items_moved_out_test.go

fix(sync): moved-out tombstones for cross-visibility collection moves (BUG-1675) (#670)

2026-05-30 19:57:45 -04:00

handlers_items_open_children_guard_test.go

fix(deps): bump go-jose/v3 to v3.0.5 to clear GO-2026-4945 (BUG-1619) (#634)

2026-05-27 13:21:57 -04:00

handlers_items_open_children_guard.go

fix(collab): a markdown applier request that timed out is not re-sent to another tab (BUG-3748) (#2133)

2026-10-13 15:28:37 -04:00

handlers_items_parent_ambiguity_test.go

fix(server): refuse a PATCH carrying both a fields hierarchy key and top-level parent_id (BUG-2594) (#1133)

2026-08-17 03:42:08 -04:00

handlers_items_patch.go

fix(items): undo of an emptied line; a patch that changes nothing is refused (PLAN-3578 retro fixes 5+6) (#2089)

2026-10-11 21:10:03 -04:00

handlers_items_preimage_test.go

fix(server): diff the activity change list against the store's pre-image (BUG-2776) (#1206)

2026-08-25 20:16:18 -04:00

handlers_items_refuse_undeclared_test.go

fix(mcp): bulk-update refuses an undeclared status/priority per item on stdio and remote too (BUG-3156, ToolSurfaceVersion 0.46) (#1463)

2026-09-23 10:48:28 -04:00

handlers_items_rename_cascade_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

handlers_items_reserved_fieldpatch_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

handlers_items_reserved_write.go

fix(fields): field writes keep every number's literal, so an integer above 2^53 is no longer rounded by a write that never named it (BUG-3202) (#1545)

2026-09-25 14:22:09 -04:00

handlers_items_sort_order.go

feat: bulk sort_order: one all-or-nothing request per lane reorder, one activity row per item collapsed per batch (TASK-3517) (#1933)

2026-10-09 02:04:52 -04:00

handlers_items_test.go

fix(server): attribution comes from the request, never the body (BUG-3372) (#1754)

2026-10-03 03:51:24 -04:00

handlers_items_title_test.go

feat: every content change through the ChatGPT door is versioned first (TASK-3321 U1b) (#1711)

2026-10-02 01:01:15 -04:00

handlers_items.go

fix(api): item lists are bounded at 1000 with has-more paging, and filter-key probing is bounded (BUG-3704, BUG-3703) (#2143)

2026-10-14 01:07:58 -04:00

handlers_library_activate.go

feat: built-ins record their origin; an item made from one can be offered Pad's current text (TASK-3462 U1+U2) (#1852)

2026-10-07 06:40:06 -04:00

handlers_library_entry.go

feat(cli): pad library get + list --full + server-side category filter (TASK-1562) (#613)

2026-05-21 16:59:57 -04:00

handlers_library_test.go

feat(cli): pad library get + list --full + server-side category filter (TASK-1562) (#613)

2026-05-21 16:59:57 -04:00

handlers_mcp_audit_test.go

feat(admin): the MCP audit page names users and connections instead of truncated UUIDs (TASK-2255 C110) (#2032)

2026-10-10 18:32:29 -04:00

handlers_mcp_audit.go

feat(admin): the MCP audit page names users and connections instead of truncated UUIDs (TASK-2255 C110) (#2032)

2026-10-10 18:32:29 -04:00

handlers_mcp_test.go

fix(members): keep a workspace's owner and at least one owner member (#1737)

2026-10-02 17:01:54 -04:00

handlers_mcp_tool_surface_test.go

feat(server): expose MCP tool-surface over authed REST endpoint (#764)

2026-06-24 22:45:32 -04:00

handlers_mcp.go

feat(mcp): count admitted MCP requests by method and client (TASK-2307) (#2003)

2026-10-10 00:50:31 -04:00

handlers_me_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_me.go

fix(server): the /me summary mirrors the admin bypass; every admin route proven open to an admin session, closed to an admin PAT (BUG-1926) (#1918)

2026-10-08 19:33:25 -04:00

handlers_member_collection_access_escalation_test.go

fix(server): deny restricted owners from escalating collection access (BUG-1925) (#815)

2026-07-04 14:39:33 -04:00

handlers_members.go

fix(members): a collection-restricted owner cannot grant beyond its scope through invitations or role changes (BUG-3634) (#2116)

2026-10-13 11:16:07 -04:00

handlers_my_invitations.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

handlers_oauth_claim_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_oauth_claim.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_oauth_clients.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_oauth_provider_test.go

fix(server): auth-perimeter hardening — B6–B9 from the IDEA-1927 audit (TASK-1932) (#811)

2026-07-04 11:33:18 -04:00

handlers_oauth_test.go

fix(oauth): another client's replay of a spent refresh token or code revokes nothing (BUG-3400) (#1807)

2026-10-05 13:22:23 -04:00

handlers_oauth.go

fix(oauth): the consent screen names Pad, the instance, the user's workspaces and the return host (TASK-1071) (#2017)

2026-10-10 09:15:51 -04:00

handlers_openai_challenge.go

feat(chatgpt): serve OpenAI's domain challenge at /.well-known/openai-apps-challenge (TASK-3321 G4) (#1717)

2026-10-02 04:08:52 -04:00

handlers_plan_limit_race_test.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

handlers_plan_source_test.go

feat(billing): record plan_source; a lowering applies only from the source that set the plan (TASK-3295) (#1657)

2026-09-29 10:14:38 -04:00

handlers_playbook_library.go

feat(server): library endpoints gain ?category, ?summary, /library/entry (TASK-1561) (#612)

2026-05-21 13:08:02 -04:00

handlers_playbook_match_ratelimit_test.go

feat(server): a dedicated rate limit for synchronous decision-provider calls (TASK-3141) (#1436)

2026-09-22 13:42:37 -04:00

handlers_playbook_match_test.go

feat(playbook): match free text to an active playbook via the decision provider (TASK-3120) (#1429)

2026-09-22 11:28:57 -04:00

handlers_playbooks_test.go

fix(playbooks): enforce draft gate server-side + expose status (BUG-2020) (#874)

2026-07-08 15:28:21 -04:00

handlers_playbooks.go

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

handlers_project_intel_test.go

fix(server): lineage and closure name only items the caller may see (#1743)

2026-10-02 18:49:07 -04:00

handlers_project_intel.go

feat(server): reference items stop counting as open work (PLAN-3535 PR 2) (#2000)

2026-10-09 22:31:16 -04:00

handlers_push_cross_instance_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_delivery_symmetry_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_presence_unreadable_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_publish_result_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_push_store_error_test.go

fix(access): system collections are ordinary collections for restricted members (TASK-3376) (#1756)

2026-10-03 09:19:10 -04:00

handlers_push_test.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

handlers_push_visibility_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_push.go

feat(push): idempotency keys for push, and the monitor drops a re-published push (TASK-3585) (#2071)

2026-10-11 16:44:56 -04:00

handlers_rbac_test.go

fix(auth): an admin-created registration mints no session, so creating an account no longer hands the admin a live credential for the new user (BUG-3232) (#1581)

2026-09-26 15:27:50 -04:00

handlers_ref_resolver_test.go

fix(access): system collections are ordinary collections for restricted members (TASK-3376) (#1756)

2026-10-03 09:19:10 -04:00

handlers_ref_resolver.go

fix: one prefix grammar, and the ref parser widens to it (BUG-2943) (#1286)

2026-09-07 17:32:36 -04:00

handlers_relation_backlinks.go

feat(relations): materialised reverse index and Referenced-by (PLAN-2857 U5 / TASK-2997) (#1328)

2026-09-11 00:57:47 -04:00

handlers_reminders_test.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

handlers_reminders.go

feat(mcp): pad_item reminders lists an item's reminders and unremind disarms one (TASK-3611) (#2097)

2026-10-12 03:18:50 -04:00

handlers_reports_test.go

feat(report): windowed project report endpoint + DateBucket dialect (TASK-1630) (#638)

2026-05-29 08:24:05 -04:00

handlers_reports.go

feat(report): Insights buckets days in the viewer's time zone (TASK-3524) (#1955)

2026-10-09 08:14:55 -04:00

handlers_restore_plan_limit_test.go

test(server): RED legs for item restore past items_per_workspace (BUG-3101)

2026-09-17 11:02:02 -04:00

handlers_role_board.go

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

handlers_search_collection_bug2659_test.go

fix(search): the collection filter resolves exact-first per workspace in scope, so a collection named task is no longer shadowed by tasks (BUG-2659, BUG-2839) (#1576)

2026-09-26 12:20:58 -04:00

handlers_search.go

feat: predictable palette search scope; "All" searches every workspace you can see (TASK-3604) (#2085)

2026-10-11 19:48:40 -04:00

handlers_sessions_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_sessions.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

handlers_share_attachments_derive_test.go

feat(web,server): render embedded image attachments on share pages via a variants-only byte endpoint (BUG-2389 2b, TASK-2637) (#1153)

2026-08-18 12:26:00 -04:00

handlers_share_attachments_test.go

fix(server): sign protected share-page images on every install (BUG-3305) (#1673)

2026-09-29 20:35:28 -04:00

handlers_share_attachments.go

fix(server): sign protected share-page images on every install (BUG-3305) (#1673)

2026-09-29 20:35:28 -04:00

handlers_share_links_bruteforce_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

handlers_share_links_test.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_share_links.go

fix(server): a shared collection lists items in the owner's arranged order (BUG-3530) (#1990)

2026-10-09 20:32:51 -04:00

handlers_stars_test.go

perf(web): tag and starred pages render from the local index (TASK-2231) (#1938)

2026-10-09 03:16:57 -04:00

handlers_stars.go

perf(web): tag and starred pages render from the local index (TASK-2231) (#1938)

2026-10-09 03:16:57 -04:00

handlers_storage_delete_authz_test.go

fix(attachments): classify derived rows after authorization on delete

2026-08-02 01:50:34 +00:00

handlers_storage_test.go

feat(attachments): Settings → Storage tab with attachment list (TASK-882) (#303)

2026-04-29 17:44:12 -04:00

handlers_storage.go

fix(attachments): classify derived rows after authorization on delete

2026-08-02 01:50:34 +00:00

handlers_stream_gap_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_stream_session_liveness_test.go

fix(server): a stream ends when the credential that opened it stops being valid (BUG-3007) (#1323)

2026-09-10 16:47:31 -04:00

handlers_tags_test.go

feat(tags): workspace tag enumeration endpoint + cross-collection filter (TASK-1653) (#658)

2026-05-29 23:43:02 -04:00

handlers_timeline_collapse_test.go

feat(import): mark rows a workspace import wrote, author not verified (BUG-3379) (#1755)

2026-10-03 05:18:30 -04:00

handlers_timeline_comment_agent_test.go

feat(server): timeline comment rows carry the agent name (TASK-2760) (#1196)

2026-08-24 18:09:02 -04:00

handlers_timeline_cursor_test.go

fix: timeline can answer has_more=true with zero entries, and the client cannot page past it (BUG-2765) (#1202)

2026-08-25 16:11:47 -04:00

handlers_timeline_cursor_validation_test.go

feat(store): make the NUL invariant a property of the DATABASE (DOC-2823 S2)

2026-09-01 21:16:17 +00:00

handlers_timeline_id_collision_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

handlers_timeline_structured_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

handlers_timeline.go

feat(items): pad item patch --undo, anchored on each edit's context (PLAN-3578 step 3) (#2058)

2026-10-11 09:28:08 -04:00

handlers_tokens_session_auth_test.go

fix(server): minting or rotating an API token requires an interactive session (BUG-2890) (#1267)

2026-09-06 22:02:05 -04:00

handlers_tokens.go

feat(server): every access and credential change re-checks live connections (#1746)

2026-10-02 20:39:53 -04:00

handlers_ui_dismissals.go

feat: in-app tutorials on Pad Cloud, links to getpad.dev/learn elsewhere (TASK-3452) (#1839)

2026-10-06 22:23:29 -04:00

handlers_unparented_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_unsubscribe_test.go

fix(server): escape unsubscribe page via html/template + add strict CSP (TASK-657) (#185)

2026-04-21 22:53:27 -04:00

handlers_unsubscribe.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_verify_email_test.go

fix(auth): a verification link verifies only for its account's session; the mailbox owner can claim (BUG-3382) (#1758)

2026-10-03 09:48:19 -04:00

handlers_versions.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_views_collections_jsonb_test.go

feat(store): JSONB NOT NULL hardening on items/views + handler shape validation (IDEA-1486+1488) (#566)

2026-05-16 10:15:59 -04:00

handlers_views_unparented_test.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_views.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_watch_access_test.go

fix(members): keep a workspace's owner and at least one owner member (#1737)

2026-10-02 17:01:54 -04:00

handlers_watch_access.go

fix(access): system collections are ordinary collections for restricted members (TASK-3376) (#1756)

2026-10-03 09:19:10 -04:00

handlers_watch_events_cancel_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_watch_events_oauth_scope_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_watch_events_refused_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_watch_events_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_watch_events.go

feat(push): idempotency keys for push, and the monitor drops a re-published push (TASK-3585) (#2071)

2026-10-11 16:44:56 -04:00

handlers_watch_notify.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

handlers_watch_vis_cache_test.go

feat(server): armed-session declaration + push delivery filter (PLAN-2613 S1, TASK-2616) (#1130)

2026-08-17 01:59:02 -04:00

handlers_watches_test.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_watches.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_webhook_token_idor_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_webhooks_secret_test.go

test(webhooks): use a literal IP instead of example.com in two more spots

2026-07-26 23:56:34 +00:00

handlers_webhooks.go

fix(webhooks): whole-workspace access to manage; no delivery for a deleted workspace (#1727)

2026-10-02 13:20:09 -04:00

handlers_webmcp_setting_test.go

feat(server): add webmcp_enabled platform setting + session flag (#763)

2026-06-24 22:28:34 -04:00

handlers_well_known.go

feat(oauth): RFC 9207 iss on every authorize redirect; JSON 404 for unowned /.well-known (TASK-3321 U0a) (#1706)

2026-10-01 22:25:50 -04:00

handlers_workspace_autoadd_race_test.go

test(store): SQLite interleaving for the auto-add statement (BUG-2792 review r2 P2)

2026-09-16 15:36:49 -04:00

handlers_workspace_cap_test.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

handlers_workspace_create_consent_test.go

feat(server): refuse workspace creation without may_create_workspaces consent (IDEA-2756) (#1212)

2026-08-26 13:23:56 -04:00

handlers_workspace_import_autoadd_test.go

fix(workspaces): workspace import adds the new workspace to the importing OAuth connection, as create does (BUG-2794) (#1491)

2026-09-24 01:02:00 -04:00

handlers_workspace_import_nul_test.go

fix(store,server,cli): three defects from codex round 1 (BUG-2810)

2026-09-02 15:15:11 +00:00

handlers_workspace_import_plan_limit_test.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

handlers_workspace_import_refusal_status_test.go

fix(server): a refused collection prefix reaches the caller as a 400 naming the rule (BUG-2951) (#1293)

2026-09-08 14:51:21 -04:00

handlers_workspace_mint_parity_test.go

fix(server,store): both workspace mint doors enforce their preconditions from one place (BUG-2809) (#1268)

2026-09-06 23:36:58 -04:00

handlers_workspace_tabs_test.go

fix(tabs): order workspace-tab lists by a per-user server revision (BUG-3285) (#1649)

2026-09-28 18:33:09 -04:00

handlers_workspace_tabs.go

fix(tabs): order workspace-tab lists by a per-user server revision (BUG-3285) (#1649)

2026-09-28 18:33:09 -04:00

handlers_workspaces_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_workspaces.go

fix(export): an export reads one snapshot, so a concurrent write cannot leave an item without its collection (BUG-3654) (#2122)

2026-10-14 00:25:14 -04:00

idempotency_keys.go

feat(push): idempotency keys for push, and the monitor drops a re-published push (TASK-3585) (#2071)

2026-10-11 16:44:56 -04:00

import_nul_repair.go

fix(store): a JSON blob that repeats a member is stored collapsed, so SQLite's json_extract and Go read the same value (BUG-2896) (#1547)

2026-09-25 16:24:50 -04:00

import_outcomes.go

fix(server): an interrupted import rolls back, and its outcome can be asked for (BUG-3475) (#1867)

2026-10-07 21:03:24 -04:00

import_plan_limit_message_test.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

import_read_deadline.go

fix(import): a failed bundle import always reports its workspace, and the body is read under a per-Read deadline (BUG-3184) (#1497)

2026-09-24 03:44:26 -04:00

import_stale_bodies.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

interchange_golden_test.go

test(interchange): golden bundle fixture and a full export, import, export round-trip diff (TASK-3628) (#2125)

2026-10-13 16:11:27 -04:00

isolated_client_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

item_lineage.go

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

item_moved_to_test.go

feat(relations): exact-title resolution and hydrated reads for relation fields (PLAN-2857 U6 / TASK-2996) (#1326)

2026-09-10 21:06:40 -04:00

item_moved_to.go

feat(apps): the installed-app API door, ceiling and read routes (TASK-3401, SPEC-6 U6a) (#1771)

2026-10-04 09:51:29 -04:00

library_option_widen.go

fix(server): refuse a collection schema that repeats or empties a field key or option (TASK-3539, PR B) (#2009)

2026-10-10 03:04:20 -04:00

listen_serve_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

main_test.go

perf(test): build the SQLite migration chain once per test binary (IDEA-1914) (#788)

2026-07-03 10:15:49 -04:00

materialize_recovery_links_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

materialize_recovery_test.go

fix(collab): stop appending the whole document to the op-log on every reconnect (BUG-3523) (#1965)

2026-10-09 10:42:55 -04:00

materialize_recovery.go

fix(collab): recovery refuses an incomplete op-log replay, and a failed compaction snapshot keeps the log (TASK-3574 (1) and (3)) (#2045)

2026-10-11 01:23:31 -04:00

mcp_availability_payload_test.go

feat: the console MCP section; Connected Apps follows OAuth (TASK-3303, PLAN-2310 U5) (#1666)

2026-09-29 16:41:24 -04:00

mcp_capability_test.go

feat(mcp): scope in the /mcp challenge, and a 403 insufficient_scope for read-only OAuth writes (TASK-2308) (#1986)

2026-10-09 16:38:39 -04:00

mcp_security_floor_test.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

metrics_auth_test.go

perf(test): wire remaining store helpers onto storetest fixture (TASK-1915) (#789)

2026-07-03 12:17:03 -04:00

middleware_auth_admin_token_gate_test.go

fix(auth): scope admin platform role to cookie session auth (BUG-1616) (#632)

2026-05-27 10:09:30 -04:00

middleware_auth_public_paths_test.go

fix(auth): TokenAuth falls through invalid Bearer on public API paths (BUG-1227) (#434)

2026-05-07 20:01:34 -04:00

middleware_auth.go

feat(server): a read-scoped token may run a playbook (TASK-2863) (#1987)

2026-10-09 18:56:44 -04:00

middleware_compress_test.go

feat(server): gzip what the client accepts, except streams, upgrades, ranges and secrets (TASK-2225) (#1934)

2026-10-09 03:16:26 -04:00

middleware_compress.go

feat(server): gzip what the client accepts, except streams, upgrades, ranges and secrets (TASK-2225) (#1934)

2026-10-09 03:16:26 -04:00

middleware_csrf_test.go

fix(server): auth-perimeter hardening — B6–B9 from the IDEA-1927 audit (TASK-1932) (#811)

2026-07-04 11:33:18 -04:00

middleware_csrf.go

fix(auth): a verification link verifies only for its account's session; the mailbox owner can claim (BUG-3382) (#1758)

2026-10-03 09:48:19 -04:00

middleware_form_body_test.go

fix(server): OAuth form-encoded bodies take the transport text rule, so a NUL or invalid UTF-8 in connection_name, code or refresh_token answers 400 instead of 500 (BUG-2811) (#1564)

2026-09-26 02:21:40 -04:00

middleware_form_body.go

fix(server): OAuth form-encoded bodies take the transport text rule, so a NUL or invalid UTF-8 in connection_name, code or refresh_token answers 400 instead of 500 (BUG-2811) (#1564)

2026-09-26 02:21:40 -04:00

middleware_logging_test.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

middleware_logging.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

middleware_mcp_audit_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

middleware_mcp_audit.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

middleware_mcp_auth_dual_read_test.go

fix(mcp): a connection row decides workspace access, not the legacy token list (BUG-3337) (#1749)

2026-10-02 22:03:29 -04:00

middleware_mcp_auth.go

feat(mcp): scope in the /mcp challenge, and a 403 insufficient_scope for read-only OAuth writes (TASK-2308) (#1986)

2026-10-09 16:38:39 -04:00

middleware_mcp_body_limit.go

fix(server): cap the MCP request body at 7 MiB, answering 413 (BUG-3534) (#1988)

2026-10-09 19:48:36 -04:00

middleware_mcp_client.go

feat(mcp): count admitted MCP requests by method and client (TASK-2307) (#2003)

2026-10-10 00:50:31 -04:00

middleware_mcp_host_test.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

middleware_mcp_host.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

middleware_mcp_metrics_test.go

fix(metrics): bound the MCP tool label and the HTTP method label, which callers could fill with invented values (BUG-2817) (#1456)

2026-09-23 06:01:08 -04:00

middleware_mcp_scope.go

feat(mcp): scope in the /mcp challenge, and a 403 insufficient_scope for read-only OAuth writes (TASK-2308) (#1986)

2026-10-09 16:38:39 -04:00

middleware_mcp_session_test.go

feat(metrics): session-id-keyed TTL sweep for mcp_active_sessions (TASK-1120) (#400)

2026-05-03 17:40:18 -04:00

middleware_mcp_session.go

docs(mcp): the reason given for the protocol restriction was false — replace it with the true one (TASK-2977) (#1312)

2026-09-09 20:35:44 -04:00

middleware_metrics_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

middleware_metrics.go

fix(metrics): bound the MCP tool label and the HTTP method label, which callers could fill with invented values (BUG-2817) (#1456)

2026-09-23 06:01:08 -04:00

middleware_query_test.go

fix: item lists refuse a filter key that names no field (BUG-3480) (#1880)

2026-10-08 10:43:33 -04:00

middleware_ratelimit_bug3308_test.go

fix(ratelimit): retention covers the full refill window, so an idle drained bucket is not reset (BUG-3638) (#2115)

2026-10-13 10:32:14 -04:00

middleware_ratelimit_bug3310_test.go

fix(server): one general API bucket per caller across both middleware arms (BUG-3310) (#1672)

2026-09-29 20:15:52 -04:00

middleware_ratelimit_bug3638_test.go

fix(ratelimit): retention covers the full refill window, so an idle drained bucket is not reset (BUG-3638) (#2115)

2026-10-13 10:32:14 -04:00

middleware_ratelimit_task3620_test.go

feat(server): the health probe gets its own per-address rate-limit tier, and the search burst is 30 (TASK-3620 PR B) (#2108)

2026-10-12 11:50:23 -04:00

middleware_ratelimit_test.go

feat(server): the health probe gets its own per-address rate-limit tier, and the search burst is 30 (TASK-3620 PR B) (#2108)

2026-10-12 11:50:23 -04:00

middleware_ratelimit.go

fix(ratelimit): retention covers the full refill window, so an idle drained bucket is not reset (BUG-3638) (#2115)

2026-10-13 10:32:14 -04:00

middleware_realip_test.go

fix(server): resolve the client from the right-most untrusted X-Forwarded-For hop (BUG-3323) (#1700)

2026-09-30 23:19:41 -04:00

middleware_realip.go

fix(server): resolve the client from the right-most untrusted X-Forwarded-For hop (BUG-3323) (#1700)

2026-09-30 23:19:41 -04:00

middleware_request_text_test.go

fix(server): refuse invalid-UTF-8 and NUL query values at the transport (BUG-2784) (#1217)

2026-08-27 10:35:39 -04:00

middleware_request_text.go

fix: item lists refuse a filter key that names no field (BUG-3480) (#1880)

2026-10-08 10:43:33 -04:00

middleware_security_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

middleware_security.go

fix(server): reject CORS wildcard when credentials are on (TASK-664) (#188)

2026-04-21 23:59:54 -04:00

middleware_session_ip_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

middleware_session_ua_test.go

feat(security): enforce session UA binding under strict mode (TASK-2056) (#912)

2026-07-10 23:32:22 -04:00

middleware_verified_email_test.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

middleware_verified_email.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

migrate_close_state.go

fix(BUG-2367): a move or copy that would reopen, close or un-abandon an item must name the status instead of inheriting whatever survived migration (#1516)

2026-09-24 15:53:06 -04:00

mobile_contract_test.go

test(server): the mobile shells' unversioned contracts fail CI when they move (TASK-2053) (#1294)

2026-09-08 15:49:05 -04:00

my_invitations_test.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

nul_differential_test.go

feat(server,store): the differential test's three live legs + the 400 mapping

2026-09-01 12:06:08 +00:00

nul_repair_differential_test.go

fix(store): a JSON blob that repeats a member is stored collapsed, so SQLite's json_extract and Go read the same value (BUG-2896) (#1547)

2026-09-25 16:24:50 -04:00

oauth_iss_test.go

feat(oauth): RFC 9207 iss on every authorize redirect; JSON 404 for unowned /.well-known (TASK-3321 U0a) (#1706)

2026-10-01 22:25:50 -04:00

oauth_iss.go

feat(oauth): RFC 9207 iss on every authorize redirect; JSON 404 for unowned /.well-known (TASK-3321 U0a) (#1706)

2026-10-01 22:25:50 -04:00

oauth_sweep_test.go

fix(oauth): sweep expired token, code and PKCE rows (BUG-3301) (#1671)

2026-09-29 19:29:17 -04:00

oauth_sweep.go

fix(oauth): sweep expired token, code and PKCE rows (BUG-3301) (#1671)

2026-09-29 19:29:17 -04:00

open_children_guard_pool_test.go

fix(store): serialize document renames and stop reading the pool inside transactions (BUG-2778) (#1208)

2026-08-25 22:40:58 -04:00

oplog_compaction.go

fix(collab): recovery refuses an incomplete op-log replay, and a failed compaction snapshot keeps the log (TASK-3574 (1) and (3)) (#2045)

2026-10-11 01:23:31 -04:00

oplog_gc_test.go

feat(collab): periodic op-log GC sweeper for dormant items (TASK-1309) (#471)

2026-05-09 18:19:33 -04:00

oplog_gc.go

feat(collab): the GC compacts dormant op-logs and a covered resume merges (TASK-3531 U3-U5) (#1985)

2026-10-09 20:32:46 -04:00

orphan_gc_test.go

fix(server): rowless-blob GC sweep — reclaim blobs no attachments row references (BUG-2406) (#1137)

2026-08-17 09:03:44 -04:00

orphan_gc.go

fix(attachments): a refused upload, transform or import reclaims the blob it wrote (BUG-3652) (#2118)

2026-10-13 13:24:49 -04:00

outbox_drain_test.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

outbox_drain.go

feat(apps): app webhook delivery behind an in-flight fence, signature v2 (TASK-3408, SPEC-6 U10b) (#1780)

2026-10-04 20:35:13 -04:00

outbox_payload_limit_test.go

docs,test(store): correct five comments and strengthen the shrink fixture (BUG-2827)

2026-09-02 12:05:57 +00:00

overdue_surfaces_test.go

fix(server): an ordinary open backlog fills Up next and pad project ready (BUG-3453) (#1854)

2026-10-07 08:36:58 -04:00

overdue.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

password_strength_test.go

fix(web): state the password rule on every password field, and show its refusal there (TASK-2260) (#1941)

2026-10-09 04:22:31 -04:00

password_strength.go

feat(server): zxcvbn password strength check at registration / rotation / reset (TASK-669) (#193)

2026-04-22 12:21:34 -04:00

plan2348_timeline_drops_test.go

fix(history): split activity runs by source, stamp version source, stop dropping field changes (PLAN-2348 U1) (#1685)

2026-09-30 06:50:13 -04:00

plan2348_timeline_kinds_test.go

feat(history): one History tab replaces Activity and Versions (PLAN-2348 U3) (#1692)

2026-09-30 14:58:39 -04:00

plan2348_u2_versions_test.go

feat(history): one History tab replaces Activity and Versions (PLAN-2348 U3) (#1692)

2026-09-30 14:58:39 -04:00

plan2348_version_source_test.go

fix(history): split activity runs by source, stamp version source, stop dropping field changes (PLAN-2348 U1) (#1685)

2026-09-30 06:50:13 -04:00

plan3535_reference_exclusion_test.go

feat(server): reference items stop counting as open work (PLAN-3535 PR 2) (#2000)

2026-10-09 22:31:16 -04:00

plan3535_tracks_work_test.go

feat: a collection can be reference material, not work (PLAN-3535 PR 1) (#1996)

2026-10-09 21:47:50 -04:00

plan3555_unguarded_write_test.go

feat(items): agent body writes are version-checked by default, phase 1: count, warn, replace (PLAN-3555) (#2054)

2026-10-11 05:29:53 -04:00

plan3578_patch_room_test.go

feat(items): pad item patch --undo, anchored on each edit's context (PLAN-3578 step 3) (#2058)

2026-10-11 09:28:08 -04:00

plan3578_patch_test.go

feat(items): content-anchored patch writes on an item with no live editor (PLAN-3578 step 1) (#2055)

2026-10-11 06:20:09 -04:00

plan3578_retro_fixes_test.go

fix(items): undo of an emptied line; a patch that changes nothing is refused (PLAN-3578 retro fixes 5+6) (#2089)

2026-10-11 21:10:03 -04:00

plan3578_undo_test.go

feat(items): pad item patch --undo, anchored on each edit's context (PLAN-3578 step 3) (#2058)

2026-10-11 09:28:08 -04:00

plan3598_item_context_test.go

fix(server): item context fills its budget past a part that does not fit, orders conventions by relevance, and widens implement to commit and PR rules (PLAN-3598) (#2101)

2026-10-12 08:27:13 -04:00

plan_limit_native_shell_test.go

fix(test): call SetUserPlan with a PlanWrite; main broken since 1ed52bdb (TASK-3293) (#1659)

2026-09-29 11:28:17 -04:00

progress_abandoned_test.go

fix(progress): an abandoned child leaves both the done count and the total, and 0/0 renders as no progress (BUG-3195) (#1510)

2026-09-24 11:24:33 -04:00

publish_sites_ruled_test.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

push_message_collapse_test.go

feat(web): push-to-agent composer in the item view (TASK-2561) (#1099)

2026-08-15 08:22:09 -04:00

redis_health_test.go

fix(watchevents,server): four concurrency findings from codex round 9 (BUG-2727, BUG-2726)

2026-08-22 03:43:15 +00:00

redis_health.go

refactor: prune the claim surface, and turn one prose claim into a test

2026-08-22 05:09:29 +00:00

relation_backlinks_test.go

feat(relations): materialised reverse index and Referenced-by (PLAN-2857 U5 / TASK-2997) (#1328)

2026-09-11 00:57:47 -04:00

relation_hydration.go

fix(server): lineage and closure name only items the caller may see (#1743)

2026-10-02 18:49:07 -04:00

relation_multi_roundtrip_test.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

relation_ref_prefix_test.go

fix(store): a relation ref falls back to matching by number only when its prefix names no live collection (BUG-3082) (#1369)

2026-09-14 11:49:35 -04:00

relation_referents_doors_test.go

fix(relations): a wrong_collection reason is judged on the row resolved, never by a second lookup (BUG-3012) (#1490)

2026-09-24 01:01:52 -04:00

relation_referents.go

feat(apps): app install provisioning, install codes and redeem (TASK-3397, SPEC-6 U8b) (#1772)

2026-10-04 11:59:42 -04:00

relation_target_availability.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

relation_titles_copy_test.go

feat(relations): exact-title resolution and hydrated reads for relation fields (PLAN-2857 U6 / TASK-2996) (#1326)

2026-09-10 21:06:40 -04:00

relation_titles_doors_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

relation_titles_import_test.go

fix(store): a relation ref falls back to matching by number only when its prefix names no live collection (BUG-3082) (#1369)

2026-09-14 11:49:35 -04:00

relation_unjudged_fail_closed_test.go

fix(relations): a wrong_collection reason is judged on the row resolved, never by a second lookup (BUG-3012) (#1490)

2026-09-24 01:01:52 -04:00

reminder_tick.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

reserved_seed_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

role_item_counts.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

server_test.go

feat(server): a dedicated rate limit for synchronous decision-provider calls (TASK-3141) (#1436)

2026-09-22 13:42:37 -04:00

server.go

fix(share): a shared item body is sanitized with the markdown allowlist, and the SPA CSP restricts form-action (BUG-3669) (#2145)

2026-10-14 02:04:58 -04:00

session_identity_test.go

feat(server): armed-session declaration + push delivery filter (PLAN-2613 S1, TASK-2616) (#1130)

2026-08-17 01:59:02 -04:00

session_identity.go

feat(server): armed-session declaration + push delivery filter (PLAN-2613 S1, TASK-2616) (#1130)

2026-08-17 01:59:02 -04:00

session_presence_keys_test.go

feat(redis): namespace every Redis keyspace from one shared config value (BUG-2724)

2026-08-22 01:41:31 +00:00

session_presence_namespace_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_observer_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_observer.go

refactor: prune the claim surface, and turn one prose claim into a test

2026-08-22 05:09:29 +00:00

session_presence_redis_round2_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_redis_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_redis.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

share_item_field_defs_test.go

fix(web,server): a direct item share labels and colours its field chips like a collection share, from defs that disclose only what the item shows (TASK-2248 U3) (#1587)

2026-09-26 20:13:56 -04:00

share_page_collab_isolation_test.go

fix(share): a shared item body is sanitized with the markdown allowlist, and the SPA CSP restricts form-action (BUG-3669) (#2145)

2026-10-14 02:04:58 -04:00

stream_admission_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

stream_admission.go

fix(collab): WebSocket dials get their own per-user bucket and a per-user socket cap, and the editor jitters its reconnects (BUG-1308) (#1499)

2026-09-24 04:51:57 -04:00

stream_credential_liveness.go

fix(server): a stream ends when the credential that opened it stops being valid (BUG-3007) (#1323)

2026-09-10 16:47:31 -04:00

stream_gap_announcer_test.go

test: close the mutation gaps a coverage audit named (BUG-2730, codex round 18)

2026-08-23 02:32:43 +00:00

stream_gap_announcer.go

revert(sse): remove the ordering barrier; its failure mode is worse than the problem (BUG-2730, codex round 16)

2026-08-23 02:16:35 +00:00

task772_dashboard_visibility_test.go

test(server): the dashboard shows each caller only what they may see, in every section (TASK-772) (#1976)

2026-10-09 13:11:55 -04:00

task798_demotion_grandfathering_test.go

test(server): a demotion to free grandfathers existing work and is audited (TASK-798) (#1982)

2026-10-09 14:40:57 -04:00

task1069_mcp_blocked_test.go

fix(mcp): cloud refuses to start without an https origin for MCP OAuth; a blocked self-hosted MCP says so (TASK-1069) (#1920)

2026-10-08 21:23:12 -04:00

task1071_consent_identity_test.go

fix(oauth): the consent screen names Pad, the instance, the user's workspaces and the return host (TASK-1071) (#2017)

2026-10-10 09:15:51 -04:00

task1809_lease_agent_default_test.go

feat(lease): an opaque worker id holds item leases, so two agents under one name do not share one (TASK-3613) (#2102)

2026-10-12 09:24:33 -04:00

task2188_field_usage_test.go

feat: schema edits say what they do to items; removing an option is never a rename (TASK-2188, TASK-2187) (#1877)

2026-10-08 08:29:44 -04:00

task2189_collection_restore_test.go

feat: archived collections can be listed, restored and undone; the archive confirm shows the count (TASK-2189) (#1874)

2026-10-08 03:59:26 -04:00

task2190_totp_disable_test.go

fix: owners cannot lock themselves out by mistake; accounts with no password can set one and turn 2FA off (TASK-2190) (#1879)

2026-10-08 07:41:35 -04:00

task2197_sse_heartbeat_test.go

test(server): the busy-stream heartbeat test judges each heartbeat, not a load-dependent premise (BUG-3503) (#1907)

2026-10-08 17:35:17 -04:00

task2219_activity_collection_test.go

feat(activity): the collection and actor filters run on the server, and the web/CLI badge says which (TASK-2219) (#1948)

2026-10-09 06:36:13 -04:00

task2253_cli_auth_deny_test.go

feat(auth): Deny and request context on the CLI sign-in approval page (TASK-2253) (#1943)

2026-10-09 05:04:19 -04:00

task2257_convention_mirror_test.go

fix: a convention's stored metadata copy follows its ordinary fields (TASK-2257) (#1964)

2026-10-09 09:38:42 -04:00

task2307_mcp_request_counter_test.go

feat(mcp): count admitted MCP requests by method and client (TASK-2307) (#2003)

2026-10-10 00:50:31 -04:00

task2308_mcp_scope_test.go

feat(mcp): scope in the /mcp challenge, and a 403 insufficient_scope for read-only OAuth writes (TASK-2308) (#1986)

2026-10-09 16:38:39 -04:00

task2863_read_scope_run_test.go

feat(server): a read-scoped token may run a playbook (TASK-2863) (#1987)

2026-10-09 18:56:44 -04:00

task2864_search_archived_test.go

feat(search): include_archived on /search, and an is:archived search token (TASK-2864) (#2001)

2026-10-09 23:10:51 -04:00

task3319_attachment_uploaded_test.go

feat(attachments): the viewer says when a file was uploaded, and by whom (TASK-3319) (#1697)

2026-09-30 16:49:25 -04:00

task3321_u1b_chatgpt_versions_test.go

feat: every content change through the ChatGPT door is versioned first (TASK-3321 U1b) (#1711)

2026-10-02 01:01:15 -04:00

task3321_u2a_audience_test.go

feat(mcp): scope in the /mcp challenge, and a 403 insufficient_scope for read-only OAuth writes (TASK-2308) (#1986)

2026-10-09 16:38:39 -04:00

task3321_u2b_mount_test.go

feat(mcp): mount the ChatGPT catalog at /mcp/chatgpt, OAuth-only, off by default (TASK-3321 U2b) (#1719)

2026-10-02 03:34:43 -04:00

task3351_social_claim_test.go

feat(auth): social claim of a never-verified account, provider subjects, cloud-only sidecar routes (TASK-3351) (#1760)

2026-10-03 12:15:04 -04:00

task3352_invitation_proof_test.go

feat(invitations): a mailbox-only proof on invitation emails verifies the invitee (TASK-3352) (#1757)

2026-10-03 07:59:37 -04:00

task3363_resource_missing_test.go

feat(oauth): count and log requests that omit the RFC 8707 resource (TASK-3363 phase 1) (#1748)

2026-10-02 20:54:40 -04:00

task3365_access_kick_test.go

test: the stalled-transport test waits for the worker to be inside Publish before clearing the transport (BUG-3464) (#1850)

2026-10-07 05:09:33 -04:00

task3365_kick_door_census_test.go

feat(auth): Deny and request context on the CLI sign-in approval page (TASK-2253) (#1943)

2026-10-09 05:04:19 -04:00

task3376_editor_grant_escalation_test.go

fix(access): system collections are ordinary collections for restricted members (TASK-3376) (#1756)

2026-10-03 09:19:10 -04:00

task3376_system_collection_surfaces_test.go

fix(access): system collections are ordinary collections for restricted members (TASK-3376) (#1756)

2026-10-03 09:19:10 -04:00

task3389_owner_webhook_strip_test.go

feat(auth): the bot principal for installed apps: users.kind, kind gates on every sign-in door and credential, people-only counts (TASK-3392) (#1766)

2026-10-03 19:41:18 -04:00

task3392_bot_principal_test.go

feat(auth): the bot principal for installed apps: users.kind, kind gates on every sign-in door and credential, people-only counts (TASK-3392) (#1766)

2026-10-03 19:41:18 -04:00

task3394_install_tokens_test.go

feat(oauth): delegated sign-in for installed apps through the issuance barrier, shipped closed (TASK-3399, SPEC-6 U5b-1) (#1779)

2026-10-04 19:22:21 -04:00

task3397_lifecycle_test.go

feat(apps): app install lifecycle: two-phase disable and rotate, re-enable, uninstall with the tombstone (TASK-3397, SPEC-6 U8c) (#1775)

2026-10-04 14:41:45 -04:00

task3399_delegated_flow_test.go

feat(apps): the app API admits a person's delegated token (TASK-3399, SPEC-6 U5b-2) (#1782)

2026-10-04 22:57:52 -04:00

task3399b_delegated_api_test.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

task3401_app_api_test.go

feat(lease): an opaque worker id holds item leases, so two agents under one name do not share one (TASK-3613) (#2102)

2026-10-12 09:24:33 -04:00

task3401b_app_writes_test.go

feat(apps): the app API admits a person's delegated token (TASK-3399, SPEC-6 U5b-2) (#1782)

2026-10-04 22:57:52 -04:00

task3401c_app_attachments_test.go

feat(apps): app attachment routes: item-scoped upload, metadata, and a streamed download re-admitted before its first byte (TASK-3401, SPEC-6 U6c) (#1776)

2026-10-04 15:14:27 -04:00

task3409_owner_delivery_test.go

feat(webhooks): owner webhooks keep per-endpoint delivery state; 408/425/429 are retried (TASK-3409) (#1809)

2026-10-05 14:44:50 -04:00

task3413_via_app_test.go

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

task3413a_app_list_test.go

feat(apps): Settings → Apps: install review, install-code handoff, and lifecycle controls (TASK-3413, SPEC-6 U9a) (#1785)

2026-10-05 03:53:12 -04:00

task3413b_install_artifacts_test.go

feat(apps): upgrade review and draft activation in Settings → Apps (TASK-3413, SPEC-6 U9b) (#1789)

2026-10-05 06:09:12 -04:00

task3414_item_actions_test.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

task3452_tutorials_test.go

feat: in-app tutorials on Pad Cloud, links to getpad.dev/learn elsewhere (TASK-3452) (#1839)

2026-10-06 22:23:29 -04:00

task3462_builtin_origin_test.go

feat: built-ins record their origin; an item made from one can be offered Pad's current text (TASK-3462 U1+U2) (#1852)

2026-10-07 06:40:06 -04:00

task3462_builtin_update_test.go

feat: built-ins record their origin; an item made from one can be offered Pad's current text (TASK-3462 U1+U2) (#1852)

2026-10-07 06:40:06 -04:00

task3462_u3a_bootstrap_count_test.go

feat: built-in update count in the bootstrap, and accepted updates record replaced fields (TASK-3462 U3a) (#1868)

2026-10-07 21:29:37 -04:00

task3462_u3a_registry_sweep_test.go

feat: built-in update count in the bootstrap, and accepted updates record replaced fields (TASK-3462 U3a) (#1868)

2026-10-07 21:29:37 -04:00

task3462_u3a_replaced_fields_test.go

feat: built-in update count in the bootstrap, and accepted updates record replaced fields (TASK-3462 U3a) (#1868)

2026-10-07 21:29:37 -04:00

task3462_u3b_state_current_test.go

feat(web): review and accept built-in updates from the Library page and the item pane (TASK-3462 U3b) (#1873)

2026-10-08 02:53:41 -04:00

task3462_u3c_capability_test.go

feat(cli): pad library diff and pad library update for built-in conventions and playbooks (TASK-3462 U3c) (#1875)

2026-10-08 05:05:04 -04:00

task3462_u4_legacy_adoption_test.go

feat: adopt pre-origin conventions and playbooks as built-ins, once, by exact title (TASK-3462 U4) (#1878)

2026-10-08 06:55:33 -04:00

task3517_sort_order_test.go

feat: bulk sort_order: one all-or-nothing request per lane reorder, one activity row per item collapsed per batch (TASK-3517) (#1933)

2026-10-09 02:04:52 -04:00

task3524_report_tz_test.go

feat(report): Insights buckets days in the viewer's time zone (TASK-3524) (#1955)

2026-10-09 08:14:55 -04:00

task3528_app_association_test.go

test(server): the binary serves no app association file (TASK-3528) (#1967)

2026-10-09 10:01:26 -04:00

task3531_compaction_test.go

fix(collab): recovery refuses an incomplete op-log replay, and a failed compaction snapshot keeps the log (TASK-3574 (1) and (3)) (#2045)

2026-10-11 01:23:31 -04:00

task3539_schema_uniqueness_test.go

fix(server): refuse a collection schema that repeats or empties a field key or option (TASK-3539, PR B) (#2009)

2026-10-10 03:04:20 -04:00

task3541_watermark_stamp_metric_test.go

feat(collab): count and log watermark stamps that cover content-bearing rows (TASK-3541 step 0) (#2023)

2026-10-10 11:54:42 -04:00

task3549_stripe_customer_cas_test.go

feat(cloud): the Stripe customer link is compare-and-set, and readable by user (TASK-3549) (#2027)

2026-10-10 15:59:17 -04:00

task3564_billing_users_test.go

feat(cloud): GET /admin/billing-users pages the users the reconcile sweep re-syncs (TASK-3564, pad half) (#2042)

2026-10-10 23:11:23 -04:00

task3574_incomplete_recovery_test.go

fix(collab): recovery refuses an incomplete op-log replay, and a failed compaction snapshot keeps the log (TASK-3574 (1) and (3)) (#2045)

2026-10-11 01:23:31 -04:00

task3574_step2_recovery_test.go

fix(collab): recovery replays SyncStep2 rows, which can hold the only copy of an edit (TASK-3574 (2)) (#2046)

2026-10-11 00:07:56 -04:00

task3585_append_key_test.go

feat(items): idempotency keys for comments, notes and decisions; idempotency_target_gone is structured (TASK-3585) (#2068)

2026-10-11 14:38:15 -04:00

task3585_comment_key_test.go

feat(items): idempotency keys for comments, notes and decisions; idempotency_target_gone is structured (TASK-3585) (#2068)

2026-10-11 14:38:15 -04:00

task3585_copy_key_test.go

feat(items): idempotency keys for cross-workspace copy and move (TASK-3585) (#2070)

2026-10-11 15:59:02 -04:00

task3585_copy_replay_authz_test.go

fix(items): a keyed replay of an archived-source move re-checks the destination (TASK-3585) (#2087)

2026-10-11 20:34:11 -04:00

task3585_create_key_test.go

feat(items): idempotency keys for item create (TASK-3585) (#2065)

2026-10-11 13:06:44 -04:00

task3585_create_limit_test.go

fix(items): a keyed create claims its key before the plan-limit check (TASK-3585) (#2088)

2026-10-11 20:34:31 -04:00

task3585_patch_key_test.go

feat(items): idempotency keys for patch writes (TASK-3585) (#2062)

2026-10-11 11:33:30 -04:00

task3585_push_key_test.go

feat(push): idempotency keys for push, and the monitor drops a re-published push (TASK-3585) (#2071)

2026-10-11 16:44:56 -04:00

task3595_signup_landing_test.go

feat(auth): a first Cloud signup lands in its new workspace; OAuth comes first (TASK-3595) (#2075)

2026-10-11 18:09:29 -04:00

task3601_payer_details_test.go

feat: a plan-limit refusal is a persistent prompt that names the limit and who can lift it (TASK-3601) (#2080)

2026-10-11 18:39:37 -04:00

task3604_search_workspace_test.go

feat: predictable palette search scope; "All" searches every workspace you can see (TASK-3604) (#2085)

2026-10-11 19:48:40 -04:00

task3611_reminder_oracle_test.go

feat(mcp): pad_item reminders lists an item's reminders and unremind disarms one (TASK-3611) (#2097)

2026-10-12 03:18:50 -04:00

task3613_lease_worker_test.go

feat(lease): an opaque worker id holds item leases, so two agents under one name do not share one (TASK-3613) (#2102)

2026-10-12 09:24:33 -04:00

task3618_item_context_decisions_test.go

feat(server): the item brief carries only the decisions Pad would surface, and counts the rest (TASK-3618) (#2107)

2026-10-12 11:53:29 -04:00

task3619_storage_cap_test.go

feat(storage): enforce plan storage limits at upload; Pro 1 GB pooled per account, Free 100 MB (TASK-3619) (#2110)

2026-10-12 15:12:36 -04:00

testimageprocessor_libvips_test.go

feat(attachments): ImageProcessor interface + pure-Go impl + thumbnail pipeline (TASK-878) (#295)

2026-04-29 14:35:49 -04:00

testimageprocessor_purego_test.go

feat(attachments): ImageProcessor interface + pure-Go impl + thumbnail pipeline (TASK-878) (#295)

2026-04-29 14:35:49 -04:00

token_reaper_test.go

fix(server): add panic recovery to background sweeper goroutines (BUG-2071) (#865)

2026-07-08 11:58:41 -04:00

token_reaper.go

fix(oauth): sweep expired token, code and PKCE rows (BUG-3301) (#1671)

2026-09-29 19:29:17 -04:00

token_scopes_test.go

feat(oauth): MCPBearerAuth OAuth integration + public-info (TASK-1027) — closes TASK-951 (#375)

2026-05-02 13:33:53 -04:00

token_workspace_allowlist_test.go

fix(security): scope MCP workspace-global reads by OAuth consent allow-list (BUG-2102) (#935)

2026-07-14 20:37:03 -04:00

token_workspace_consent_scope_test.go

fix(workspaces): reorder skips workspaces outside the OAuth consent allow-list, as the list endpoint does (BUG-3255) (#1614)

2026-09-27 12:01:55 -04:00

tutorials.go

feat: in-app tutorials on Pad Cloud, links to getpad.dev/learn elsewhere (TASK-3452) (#1839)

2026-10-06 22:23:29 -04:00

twofactor_challenge.go

fix(auth): a verification link verifies only for its account's session; the mailbox owner can claim (BUG-3382) (#1758)

2026-10-03 09:48:19 -04:00

username.go

feat: username validation, reserved words, and registration flow

2026-04-10 23:12:59 +00:00

web_build_identity_test.go

feat(ops): health reports which web bundle is served, and install-refresh warns when it is not a clean build of the commit (TASK-3233) (#1583)

2026-09-26 16:54:20 -04:00

web_build_identity.go

feat(ops): health reports which web bundle is served, and install-refresh warns when it is not a clean build of the commit (TASK-3233) (#1583)

2026-09-26 16:54:20 -04:00

workspace_access_notify_test.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

workspace_access_notify.go

feat(server): revoking access re-checks live connections immediately (#1744)

2026-10-02 19:43:19 -04:00

workspace_mint.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

workspace_owner_compensation_test.go

fix(store): reusing a recently deleted workspace's name no longer 500s, and a create that loses a slug race takes the next one (BUG-3307) (#1689)

2026-09-30 09:10:41 -04:00

workspace_owner_compensation.go

fix(server): removeUnusableWorkspace reports a failed delete as kept (BUG-3479) (#1870)

2026-10-07 23:39:39 -04:00

workspace_purge_test.go

feat(store): hard-purge soft-deleted workspaces after 30 days (TASK-1966) (#825)

2026-07-05 22:23:12 -04:00

workspace_purge.go

feat(appstore): app attachment upload, read rule and caps behind FencedTx (TASK-3396, U7a) (#1768)

2026-10-03 21:31:44 -04:00