Add forwardedRequestHeaders in routeTriggers (#17151)

- add `forwardedRequestHeaders` `string[]` column in `core.routeTrigger`
- filter request headers and forward filtered headers to function
payload (avoid spreading unexpectedly token or cookie)
- add `forwardedRequestHeaders` option in twenty-sdk `defineFunction`
util

BREAKING for actual routeTrigger payload but only 16 to migrate in
production

packages/twenty-shared/src/application/serverlessFunctionManifestType.ts

@@ -45,6 +45,7 @@ export type RouteTrigger = {
   path: string;
   httpMethod: `${HTTPMethod}`;
   isAuthRequired: boolean;
+  forwardedRequestHeaders?: string[];
 };
 
 export type ServerlessFunctionTriggerManifest = SyncableEntityOptions &

packages/twenty-shared/src/types/ServerlessFunctionEvent.ts

@@ -0,0 +1,32 @@
+/**
+ * AWS HTTP API v2 compatible request format for serverless functions
+ * @see https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-lambda.html
+ *
+ * @typeParam TBody - The type of the request body. Defaults to `object` for parsed JSON bodies.
+ */
+export type ServerlessFunctionEvent<TBody = object> = {
+  /** HTTP headers (filtered by forwardedRequestHeaders in route trigger) */
+  headers: Record<string, string | undefined>;
+
+  /** Query string parameters (multiple values are joined with commas, e.g., "1,2,3") */
+  queryStringParameters: Record<string, string | undefined>;
+
+  /** Path parameters extracted from the route pattern (e.g., /users/:id → { id: '123' }). Multiple values are joined with commas. */
+  pathParameters: Record<string, string | undefined>;
+
+  /** Request body */
+  body: TBody | null;
+
+  /** Whether the body is base64 encoded */
+  isBase64Encoded: boolean;
+
+  /** Request context containing HTTP method, path, and other metadata */
+  requestContext: {
+    http: {
+      /** HTTP method (GET, POST, PUT, PATCH, DELETE) */
+      method: string;
+      /** Raw request path (e.g., /users/123) */
+      path: string;
+    };
+  };
+};

packages/twenty-shared/src/types/index.ts

@@ -196,6 +196,7 @@ export type {
   RelationPredicateValue,
   RowLevelPermissionPredicateValue,
 } from './RowLevelPermissionPredicateValue';
+export type { ServerlessFunctionEvent } from './ServerlessFunctionEvent';
 export { SettingsPath } from './SettingsPath';
 export type { Sources } from './SourcesType';
 export type {