Entity/ownership scoping lives entirely in the repo, which re-implements the
forms_select_owner_or_org_shared RLS policy in SQL (repos run on the admin client):
a form is visible when the caller created it, or it is shared with the caller's org.
Both halves of that rule are fed from ctx.user, never from input — there is no
caller-supplied id to gate here, which is why this procedure carries the org-setting
and feature-flag gates but no resource middleware.
Each row carries its required contact types so the drawer can say "needs a Facility and
a Prescriber" before kickoff.
The fillable-template picker for the fill drawer.
Entity/ownership scoping lives entirely in the repo, which re-implements the
forms_select_owner_or_org_sharedRLS policy in SQL (repos run on the admin client): a form is visible when the caller created it, or it is shared with the caller's org. Both halves of that rule are fed fromctx.user, never from input — there is no caller-supplied id to gate here, which is why this procedure carries the org-setting and feature-flag gates but no resource middleware.Each row carries its required contact types so the drawer can say "needs a Facility and a Prescriber" before kickoff.