@flaredev/cli 0.9.1 → 0.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flaredev/cli",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "The flare command-line tool: create, generate, migrate, and deploy Flare apps",
   "license": "MIT",
   "author": "Muke Johnbaptist",
@@ -41,7 +41,7 @@
     "jiti": "^2.7.0",
     "jsonc-parser": "^3.3.1",
     "picocolors": "^1.1.1",
-    "@flaredev/core": "0.9.1"
+    "@flaredev/core": "0.11.0"
   },
   "engines": {
     "node": ">=22"

package/templates/app/components/dashboard/dashboard-sidebar.tsx

@@ -96,8 +96,8 @@ export function DashboardSidebar({
         </SidebarMenu>
       </SidebarHeader>
 
-      <SidebarContent>
-        <SidebarGroup>
+      <SidebarContent className="gap-0">
+        <SidebarGroup className="px-2 py-1">
           <SidebarGroupContent>
             <SidebarMenu>
               <SidebarMenuItem>
@@ -113,8 +113,8 @@ export function DashboardSidebar({
         </SidebarGroup>
 
         {byGroup(resources).map(([heading, group]) => (
-          <SidebarGroup key={heading}>
-            <SidebarGroupLabel>{heading}</SidebarGroupLabel>
+          <SidebarGroup key={heading} className="px-2 py-1">
+            <SidebarGroupLabel className="mt-1 h-6">{heading}</SidebarGroupLabel>
             <SidebarGroupContent>
               <SidebarMenu>
                 {group.map((resource) => {
@@ -149,8 +149,8 @@ export function DashboardSidebar({
           </SidebarGroup>
         ))}
 
-        <SidebarGroup>
-          <SidebarGroupLabel>Manage</SidebarGroupLabel>
+        <SidebarGroup className="px-2 py-1">
+          <SidebarGroupLabel className="mt-1 h-6">Manage</SidebarGroupLabel>
           <SidebarGroupContent>
             <SidebarMenu>
               {manage.map((link) => (
@@ -168,8 +168,8 @@ export function DashboardSidebar({
         </SidebarGroup>
 
         {links.length > 0 && (
-          <SidebarGroup>
-            <SidebarGroupLabel>Platform</SidebarGroupLabel>
+          <SidebarGroup className="px-2 py-1">
+            <SidebarGroupLabel className="mt-1 h-6">Platform</SidebarGroupLabel>
             <SidebarGroupContent>
               <SidebarMenu>
                 {links.map((link) => {

package/templates/app/components/dashboard/resource-form.tsx

@@ -3,7 +3,7 @@
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { useMemo, useState, useTransition, type FormEvent, type MouseEvent } from "react";
-import { createValidators, formValuesToInput, initialFormValues, issuesByField, storedFields, type ClientResource, type StoredField } from "@flaredev/core";
+import { conditionHolds, createValidators, formValuesToInput, initialFormValues, issuesByField, storedFields, type ClientResource, type StoredField } from "@flaredev/core";
 import { toast } from "sonner";
 import { createRecordAction, updateRecordAction } from "@/app/dashboard/actions";
 import { Alert, AlertDescription } from "@/components/ui/alert";
@@ -69,10 +69,21 @@ export function ResourceForm({ resource, mode, id, record, relations = {}, listH
   const router = useRouter();
   const validators = useMemo(() => createValidators(resource), [resource]);
   const hidden = useMemo(() => new Set(omit ?? []), [omit]);
-  const fields = useMemo(() => storedFields(resource).filter(([key]) => !hidden.has(key)), [resource, hidden]);
-  const steps = useMemo(() => toSteps(fields), [fields]);
   const [step, setStep] = useState(0);
   const [values, setValues] = useState(() => initialFormValues(resource, record));
+  /**
+   * The fields on show. A conditional field appears only while its condition holds, so
+   * this is recomputed as the form is filled in: choose "recurring" and the billing cycle
+   * appears, choose "one-off" and it goes away again.
+   *
+   * The same condition decides what the server requires, so a field that is not on show
+   * is never one the save is about to fail on.
+   */
+  const fields = useMemo(
+    () => storedFields(resource).filter(([key, def]) => !hidden.has(key) && conditionHolds(def.showWhen, values)),
+    [resource, hidden, values],
+  );
+  const steps = useMemo(() => toSteps(fields), [fields]);
   const [errors, setErrors] = useState<Record<string, string>>({});
   const [pending, startTransition] = useTransition();
 

package/templates/app/lib/auth.ts

@@ -1,154 +1,222 @@
-import { env, waitUntil } from "cloudflare:workers";
-import { passkey } from "@better-auth/passkey";
-import { drizzleAdapter } from "@better-auth/drizzle-adapter";
-import { betterAuth } from "better-auth";
-import { APIError, createAuthMiddleware } from "better-auth/api";
-import { nextCookies } from "better-auth/next-js";
-import { admin } from "better-auth/plugins/admin";
-import { emailOTP } from "better-auth/plugins/email-otp";
-import { magicLink } from "better-auth/plugins/magic-link";
-import { twoFactor } from "better-auth/plugins/two-factor";
-import { hashPassword, verifyPassword } from "@flaredev/core";
-import { getDb, schema } from "@/db";
-import { authConfig, type SocialProvider } from "./auth-config";
-import { checkPassword, isBreachedPassword, PASSWORD_MAX_LENGTH } from "./password-rules";
-import { sendEmailCode, sendMagicLink, sendPasswordReset, sendTwoFactorCode, sendVerificationEmail } from "./auth-emails";
-
-const vars = env as unknown as Record<string, string | undefined>;
-
-/** Optional: set when serving from a custom domain (e.g. https://example.com). */
-const configuredURL = vars.BETTER_AUTH_URL;
-
-/** A provider's credentials from the environment, when both are set. */
-function credentials(prefix: string) {
-  const clientId = vars[`${prefix}_CLIENT_ID`];
-  const clientSecret = vars[`${prefix}_CLIENT_SECRET`];
-  return clientId && clientSecret ? { clientId, clientSecret } : undefined;
-}
-
-const providerSettings: Record<SocialProvider, Record<string, string> | undefined> = {
-  google: credentials("GOOGLE"),
-  github: credentials("GITHUB"),
-  // Apple's client secret is a JWT you generate from your key (see the auth guide).
-  apple: credentials("APPLE") && { ...credentials("APPLE")!, ...(vars.APPLE_APP_BUNDLE_ID ? { appBundleIdentifier: vars.APPLE_APP_BUNDLE_ID } : {}) },
-  // "common" accepts personal and work accounts; set a tenant id to allow only your organisation.
-  microsoft: credentials("MICROSOFT") && { ...credentials("MICROSOFT")!, tenantId: vars.MICROSOFT_TENANT_ID || "common" },
-};
-
-/** Social providers switched on in lib/auth-config.ts that also have credentials. */
-const socialProviders = Object.fromEntries(
-  authConfig.social.flatMap((provider) => (providerSettings[provider] ? [[provider, providerSettings[provider]]] : [])),
-);
-
-/** Endpoints of methods switched off in lib/auth-config.ts: refused, not just hidden. */
-function disabledPath(path: string): boolean {
-  if (!authConfig.magicLink && (path === "/sign-in/magic-link" || path === "/magic-link/verify")) return true;
-  if (!authConfig.emailOtp && (path.startsWith("/email-otp/") || path === "/sign-in/email-otp" || path === "/forget-password/email-otp")) return true;
-  if (!authConfig.passkeys && path.startsWith("/passkey/")) return true;
-  const { authenticator, email } = authConfig.twoFactor;
-  if (!authenticator && !email && path.startsWith("/two-factor/")) return true;
-  if (!authenticator && (path === "/two-factor/get-totp-uri" || path === "/two-factor/verify-totp")) return true;
-  if (!email && (path === "/two-factor/send-otp" || path === "/two-factor/verify-otp")) return true;
-  return false;
-}
-
-/** Where a new password arrives, and what it's called in the body. */
-const NEW_PASSWORD_FIELDS: Record<string, string> = {
-  "/sign-up/email": "password",
-  "/reset-password": "newPassword",
-  "/change-password": "newPassword",
-};
-
-/**
- * The same password rules the sign-up and reset forms show as you type
- * (lib/password-rules.ts), enforced here so the API agrees with the screens.
- * Checked on the way in, before the password is hashed or stored.
- */
-async function guardPassword(path: string, body: Record<string, unknown> | undefined) {
-  const field = NEW_PASSWORD_FIELDS[path];
-  if (!field) return;
-  const password = body?.[field];
-  if (typeof password !== "string") return;
-
-  if (password.length > PASSWORD_MAX_LENGTH) {
-    throw new APIError("BAD_REQUEST", { message: `Passwords can be at most ${PASSWORD_MAX_LENGTH} characters.` });
-  }
-  const check = checkPassword(password, [body?.email as string | undefined, body?.name as string | undefined]);
-  if (!check.valid) throw new APIError("BAD_REQUEST", { message: check.advice ?? "That password is too short." });
-
-  // A password in a public breach list is already guessed, however strong it looks.
-  if (authConfig.checkBreachedPasswords && (await isBreachedPassword(password))) {
-    throw new APIError("BAD_REQUEST", {
-      message: "That password has appeared in a data breach, so it isn't safe to use here. Pick a different one.",
-    });
-  }
-}
-
-export const auth = betterAuth({
-  appName: "__APP_NAME__",
-  secret: env.BETTER_AUTH_SECRET,
-  // Without BETTER_AUTH_URL, accept local dev on any port, a `flare dev --tunnel` URL and
-  // this app's workers.dev host. Cloudflare only routes hosts this Worker serves, so a
-  // deployed app never sees a trycloudflare.com host and the allowlist can't be spoofed.
-  baseURL: configuredURL || {
-    allowedHosts: ["localhost:*", "127.0.0.1:*", "*.trycloudflare.com", "__APP_NAME__.*.workers.dev"],
-  },
-  // Sign in with Apple posts back from Apple's own origin.
-  trustedOrigins: authConfig.social.includes("apple") ? ["https://appleid.apple.com"] : [],
-  database: drizzleAdapter(getDb(), { provider: "sqlite", schema }),
-  socialProviders,
-  account: {
-    // Signing in with Google as ada@example.com joins Ada's existing account (the provider has verified the address).
-    accountLinking: { enabled: true, trustedProviders: ["google", "github", "apple", "microsoft"] },
-  },
-  emailAndPassword: {
-    enabled: true,
-    requireEmailVerification: authConfig.requireEmailVerification,
-    // PBKDF2 via WebCrypto: the default scrypt exceeds Workers CPU limits.
-    password: { hash: hashPassword, verify: verifyPassword },
-    sendResetPassword: ({ user, url }) => sendPasswordReset({ user, url }),
-    resetPasswordTokenExpiresIn: 60 * 60,
-    // A password reset signs every other device out.
-    revokeSessionsOnPasswordReset: true,
-  },
-  emailVerification: {
-    sendVerificationEmail: ({ user, url }) => sendVerificationEmail({ user, url }),
-    sendOnSignUp: true,
-    autoSignInAfterVerification: true,
-  },
-  advanced: {
-    // Let emails and other deferred work finish after the response is sent.
-    backgroundTasks: { handler: waitUntil },
-  },
-  hooks: {
-    before: createAuthMiddleware(async (ctx) => {
-      if (disabledPath(ctx.path)) throw new APIError("NOT_FOUND", { message: "This sign-in method isn't enabled." });
-      await guardPassword(ctx.path, ctx.body as Record<string, unknown> | undefined);
-    }),
-  },
-  plugins: [
-    // Adds user.role (default "user") and admin APIs. The /admin area allows ADMIN_ROLES (lib/admin.ts).
-    admin({ defaultRole: "user", adminRoles: ["admin"] }),
-    magicLink({ sendMagicLink: ({ email, url }) => sendMagicLink({ email, url }), expiresIn: 5 * 60, disableSignUp: false }),
-    emailOTP({ sendVerificationOTP: (data) => sendEmailCode(data), otpLength: 6, expiresIn: 5 * 60, allowedAttempts: 5 }),
-    twoFactor({
-      issuer: "__APP_NAME__",
-      otpOptions: { sendOTP: ({ user, otp }) => sendTwoFactorCode({ user, otp }), allowedAttempts: 5 },
-      // With only email codes switched on there's no authenticator app to confirm first.
-      skipVerificationOnEnable: !authConfig.twoFactor.authenticator,
-      // People who signed up with a social account have no password to confirm with;
-      // accounts that do have one must still give it.
-      allowPasswordless: true,
-    }),
-    passkey({ rpName: "__APP_NAME__" }),
-    // Must stay last: lets server actions set auth cookies.
-    nextCookies(),
-  ],
-});
-
-export type Session = typeof auth.$Infer.Session;
-
-/** OAuth providers switched on and configured, e.g. ["github"], for the sign-in buttons. */
-export function enabledSocialProviders(): SocialProvider[] {
-  return Object.keys(socialProviders) as SocialProvider[];
-}
+import { env, waitUntil } from "cloudflare:workers";
+import { passkey } from "@better-auth/passkey";
+import { drizzleAdapter } from "@better-auth/drizzle-adapter";
+import { betterAuth } from "better-auth";
+import { APIError, createAuthMiddleware } from "better-auth/api";
+import { nextCookies } from "better-auth/next-js";
+import { admin } from "better-auth/plugins/admin";
+import { emailOTP } from "better-auth/plugins/email-otp";
+import { magicLink } from "better-auth/plugins/magic-link";
+import { twoFactor } from "better-auth/plugins/two-factor";
+import { hashPassword, verifyPassword } from "@flaredev/core";
+import { eq } from "drizzle-orm";
+import { getDb, schema } from "@/db";
+import { authConfig, type SocialProvider } from "./auth-config";
+import { checkPassword, isBreachedPassword, PASSWORD_MAX_LENGTH } from "./password-rules";
+import { sendEmailCode, sendMagicLink, sendPasswordReset, sendTwoFactorCode, sendVerificationEmail } from "./auth-emails";
+
+const vars = env as unknown as Record<string, string | undefined>;
+
+/**
+ * Optional: set when serving from a custom domain (e.g. https://example.com).
+ *
+ * Better Auth compares the request's Origin header against this string, and an Origin never
+ * carries a trailing slash. So `https://example.com/` — which is what you get copying a
+ * domain out of a browser bar or the Vercel dashboard — matches nothing, and every sign-in
+ * comes back 403 with nothing in the log saying why. Correct it and say so: a warning that
+ * leaves sign-in broken is not much better than the silence it replaces.
+ */
+function authBaseURL(raw: string | undefined): string | undefined {
+  const value = raw?.trim();
+  if (!value) return undefined;
+  // Only a trailing slash is removed. A path stays: an app served under one legitimately
+  // sets BETTER_AUTH_URL to https://example.com/app.
+  const url = value.replace(/\/+$/, "");
+  if (url !== value) {
+    console.warn(`[auth] BETTER_AUTH_URL has a trailing slash, which never matches an Origin header and makes every sign-in 403. Using "${url}" — set BETTER_AUTH_URL to that to silence this.`);
+  }
+  if (url && !/^https?:\/\//.test(url)) {
+    console.warn(`[auth] BETTER_AUTH_URL ("${url}") has no scheme, so it cannot match an Origin. Set it to a full origin, e.g. https://example.com.`);
+  }
+  return url || undefined;
+}
+
+const configuredURL = authBaseURL(vars.BETTER_AUTH_URL);
+
+/** A provider's credentials from the environment, when both are set. */
+function credentials(prefix: string) {
+  const clientId = vars[`${prefix}_CLIENT_ID`];
+  const clientSecret = vars[`${prefix}_CLIENT_SECRET`];
+  return clientId && clientSecret ? { clientId, clientSecret } : undefined;
+}
+
+const providerSettings: Record<SocialProvider, Record<string, string> | undefined> = {
+  google: credentials("GOOGLE"),
+  github: credentials("GITHUB"),
+  // Apple's client secret is a JWT you generate from your key (see the auth guide).
+  apple: credentials("APPLE") && { ...credentials("APPLE")!, ...(vars.APPLE_APP_BUNDLE_ID ? { appBundleIdentifier: vars.APPLE_APP_BUNDLE_ID } : {}) },
+  // "common" accepts personal and work accounts; set a tenant id to allow only your organisation.
+  microsoft: credentials("MICROSOFT") && { ...credentials("MICROSOFT")!, tenantId: vars.MICROSOFT_TENANT_ID || "common" },
+};
+
+/** Social providers switched on in lib/auth-config.ts that also have credentials. */
+const socialProviders = Object.fromEntries(
+  authConfig.social.flatMap((provider) => (providerSettings[provider] ? [[provider, providerSettings[provider]]] : [])),
+);
+
+/** Endpoints of methods switched off in lib/auth-config.ts: refused, not just hidden. */
+function disabledPath(path: string): boolean {
+  if (!authConfig.magicLink && (path === "/sign-in/magic-link" || path === "/magic-link/verify")) return true;
+  if (!authConfig.emailOtp && (path.startsWith("/email-otp/") || path === "/sign-in/email-otp" || path === "/forget-password/email-otp")) return true;
+  if (!authConfig.passkeys && path.startsWith("/passkey/")) return true;
+  const { authenticator, email } = authConfig.twoFactor;
+  if (!authenticator && !email && path.startsWith("/two-factor/")) return true;
+  if (!authenticator && (path === "/two-factor/get-totp-uri" || path === "/two-factor/verify-totp")) return true;
+  if (!email && (path === "/two-factor/send-otp" || path === "/two-factor/verify-otp")) return true;
+  return false;
+}
+
+/** Where a new password arrives, and what it's called in the body. */
+const NEW_PASSWORD_FIELDS: Record<string, string> = {
+  "/sign-up/email": "password",
+  "/reset-password": "newPassword",
+  "/change-password": "newPassword",
+};
+
+/**
+ * The same password rules the sign-up and reset forms show as you type
+ * (lib/password-rules.ts), enforced here so the API agrees with the screens.
+ * Checked on the way in, before the password is hashed or stored.
+ */
+async function guardPassword(path: string, body: Record<string, unknown> | undefined) {
+  const field = NEW_PASSWORD_FIELDS[path];
+  if (!field) return;
+  const password = body?.[field];
+  if (typeof password !== "string") return;
+
+  if (password.length > PASSWORD_MAX_LENGTH) {
+    throw new APIError("BAD_REQUEST", { message: `Passwords can be at most ${PASSWORD_MAX_LENGTH} characters.` });
+  }
+  const check = checkPassword(password, [body?.email as string | undefined, body?.name as string | undefined]);
+  if (!check.valid) throw new APIError("BAD_REQUEST", { message: check.advice ?? "That password is too short." });
+
+  // A password in a public breach list is already guessed, however strong it looks.
+  if (authConfig.checkBreachedPasswords && (await isBreachedPassword(password))) {
+    throw new APIError("BAD_REQUEST", {
+      message: "That password has appeared in a data breach, so it isn't safe to use here. Pick a different one.",
+    });
+  }
+}
+
+/**
+ * The first account to exist becomes the admin.
+ *
+ * Generated resources are admin-only, so without this a fresh app has a database, an API
+ * and a dashboard that nobody can reach — and the usual fix for that is to open
+ * everything up, which is how an admin panel ends up on the internet. The person running
+ * sign-up on an empty database is the person setting the app up.
+ *
+ * Done here rather than in `databaseHooks.user.create`, because the admin plugin already
+ * registers one of those (`{ role: defaultRole, ...user }`) and Better Auth does not merge
+ * the two — a second one is silently never called. This runs after the row exists and
+ * states the rule in SQL, which no plugin can quietly win.
+ *
+ * Everyone after them keeps the plugin's default role, and no role reaches an admin-only
+ * resource until you grant one with `flare user:role them@example.com admin`.
+ *
+ * Two people signing up in the same instant would both see two rows and neither would be
+ * promoted, leaving an app with no admin. It needs a brand-new app and millisecond timing,
+ * and `flare user:role you@example.com admin` fixes it, so this stays the simple rule
+ * rather than a transaction nobody can read.
+ */
+let adminSettled = false;
+
+async function promoteFirstUser() {
+  if (adminSettled) return;
+  const db = getDb();
+  // Two rows is all it takes to answer "is there exactly one?".
+  const rows = await db.select({ id: schema.user.id, role: schema.user.role }).from(schema.user).limit(2);
+  if (rows.length !== 1) {
+    // Nobody yet: the next sign-up asks again. More than one: the question is settled.
+    adminSettled = rows.length > 1;
+    return;
+  }
+  if (rows[0]!.role !== "admin") {
+    await db.update(schema.user).set({ role: "admin" }).where(eq(schema.user.id, rows[0]!.id));
+  }
+  adminSettled = true;
+}
+
+export const auth = betterAuth({
+  appName: "__APP_NAME__",
+  secret: env.BETTER_AUTH_SECRET,
+  // Without BETTER_AUTH_URL, accept local dev on any port, a `flare dev --tunnel` URL and
+  // this app's workers.dev host. Cloudflare only routes hosts this Worker serves, so a
+  // deployed app never sees a trycloudflare.com host and the allowlist can't be spoofed.
+  baseURL: configuredURL || {
+    allowedHosts: ["localhost:*", "127.0.0.1:*", "*.trycloudflare.com", "__APP_NAME__.*.workers.dev"],
+  },
+  // Sign in with Apple posts back from Apple's own origin.
+  trustedOrigins: authConfig.social.includes("apple") ? ["https://appleid.apple.com"] : [],
+  database: drizzleAdapter(getDb(), { provider: "sqlite", schema }),
+  socialProviders,
+  account: {
+    // Signing in with Google as ada@example.com joins Ada's existing account (the provider has verified the address).
+    accountLinking: { enabled: true, trustedProviders: ["google", "github", "apple", "microsoft"] },
+  },
+  emailAndPassword: {
+    enabled: true,
+    requireEmailVerification: authConfig.requireEmailVerification,
+    // PBKDF2 via WebCrypto: the default scrypt exceeds Workers CPU limits.
+    password: { hash: hashPassword, verify: verifyPassword },
+    sendResetPassword: ({ user, url }) => sendPasswordReset({ user, url }),
+    resetPasswordTokenExpiresIn: 60 * 60,
+    // A password reset signs every other device out.
+    revokeSessionsOnPasswordReset: true,
+  },
+  emailVerification: {
+    sendVerificationEmail: ({ user, url }) => sendVerificationEmail({ user, url }),
+    sendOnSignUp: true,
+    autoSignInAfterVerification: true,
+  },
+  advanced: {
+    // Let emails and other deferred work finish after the response is sent.
+    backgroundTasks: { handler: waitUntil },
+  },
+  hooks: {
+    before: createAuthMiddleware(async (ctx) => {
+      if (disabledPath(ctx.path)) throw new APIError("NOT_FOUND", { message: "This sign-in method isn't enabled." });
+      await guardPassword(ctx.path, ctx.body as Record<string, unknown> | undefined);
+    }),
+    // Any route can be the one that creates the first user — a password sign-up, a magic
+    // link, a social callback — so this asks after all of them rather than guessing which.
+    after: createAuthMiddleware(async () => {
+      await promoteFirstUser();
+    }),
+  },
+  plugins: [
+    // Adds user.role (default "user") and admin APIs. The /admin area allows ADMIN_ROLES (lib/admin.ts).
+    admin({ defaultRole: "user", adminRoles: ["admin"] }),
+    magicLink({ sendMagicLink: ({ email, url }) => sendMagicLink({ email, url }), expiresIn: 5 * 60, disableSignUp: false }),
+    emailOTP({ sendVerificationOTP: (data) => sendEmailCode(data), otpLength: 6, expiresIn: 5 * 60, allowedAttempts: 5 }),
+    twoFactor({
+      issuer: "__APP_NAME__",
+      otpOptions: { sendOTP: ({ user, otp }) => sendTwoFactorCode({ user, otp }), allowedAttempts: 5 },
+      // With only email codes switched on there's no authenticator app to confirm first.
+      skipVerificationOnEnable: !authConfig.twoFactor.authenticator,
+      // People who signed up with a social account have no password to confirm with;
+      // accounts that do have one must still give it.
+      allowPasswordless: true,
+    }),
+    passkey({ rpName: "__APP_NAME__" }),
+    // Must stay last: lets server actions set auth cookies.
+    nextCookies(),
+  ],
+});
+
+export type Session = typeof auth.$Infer.Session;
+
+/** OAuth providers switched on and configured, e.g. ["github"], for the sign-in buttons. */
+export function enabledSocialProviders(): SocialProvider[] {
+  return Object.keys(socialProviders) as SocialProvider[];
+}

package/templates/app/lib/resource/drizzle-rows.ts

@@ -108,9 +108,14 @@ export function drizzleRows(table: SQLiteTable, getDb: () => AnyDatabase): Resou
       return (record as Row | undefined) ?? null;
     },
 
-    async titles(ids, titleField) {
+    async titles(ids, titleField, owner) {
       const titleColumn = columns[titleField] ?? idColumn;
-      const rows = await getDb().select({ id: idColumn, title: titleColumn }).from(table).where(inArray(idColumn, ids));
+      const ownerColumn = owner ? columns[owner.field] : undefined;
+      // An owner naming a column this table does not have would widen the query rather
+      // than narrow it, so it answers nothing instead.
+      if (owner && !ownerColumn) return [];
+      const where = ownerColumn ? and(inArray(idColumn, ids), eq(ownerColumn, owner!.value)) : inArray(idColumn, ids);
+      const rows = await getDb().select({ id: idColumn, title: titleColumn }).from(table).where(where);
       return rows as { id: string; title: unknown }[];
     },
 

package/templates/app/lib/resource/rows.ts

@@ -78,7 +78,11 @@ export interface ResourceRows {
   /** How many rows match, giving up at `limit` so a huge table is never fully counted. */
   countUpTo(query: Pick<RowsQuery, "search" | "filters" | "deleted">, limit: number): Promise<number>;
   byId(id: string): Promise<Row | null>;
-  titles(ids: string[], titleField: string): Promise<{ id: string; title: unknown }[]>;
+  /**
+   * Title values for a set of ids. `owner`, when given, restricts the rows considered —
+   * a relation picker shown to a confined user must not name records they cannot see.
+   */
+  titles(ids: string[], titleField: string, owner?: { field: string; value: string }): Promise<{ id: string; title: unknown }[]>;
   insert(values: Row): Promise<Row>;
   /** The saved row, or null when there was nothing with that id. */
   update(id: string, values: Row): Promise<Row | null>;