feat: serve HTTP logic functions on isolated *.withtwenty.com domain (#22045)

## Summary

Implements
[core-team-issues#2473](https://github.com/twentyhq/core-team-issues/issues/2473):
serve HTTP-triggered logic functions from a dedicated, **cookieless**
public domain (`{workspaceSubdomain}.withtwenty.com`) instead of the
same-site `/s/` route, so functions can safely return **arbitrary
headers** — custom headers, `Permissions-Policy`
(camera/mic/geolocation), `Cross-Origin-Opener-Policy: same-origin`,
`Cross-Origin-Embedder-Policy: require-corp`, `Set-Cookie`, etc.

The `/s/` route stays the strict, same-site path it is today.
**Self-hosting is unchanged** — everything new is gated on
`PUBLIC_DOMAIN_URL` being set.

### Why

Today user-authored function responses are served same-site with the
Twenty app, so the response-header allow-list is restricted to 5 safe
headers and request headers are limited to a per-function allow-list.
Serving from an origin that shares nothing with `*.twenty.com` removes
that constraint safely — the same "user content domain" pattern as
GitHub (`*.githubusercontent.com`) and CodeSandbox (`*.csb.app`).

## What's in here

**Routing**
- The **root-path → `/s` rewrite happens at the nginx ingress**, not in
app code. The existing `api-ingress.yaml` already rewrites root paths
onto `/s` (host-agnostically) when the edge sets
`X-Twenty-Public-Domain: true`, so `*.withtwenty.com` and registered
custom public domains are handled by the same mechanism. (An earlier
in-app middleware was removed as a redundant, wrong-layer duplicate.)
- `WorkspaceDomainsService.resolveWorkspaceAndPublicDomain` recognizes
`*.` subdomains, resolves the workspace by subdomain, and returns
`isIsolatedOrigin`. Explicitly registered public-domain rows still take
precedence and keep their application scoping. The ingress preserves the
`Host` header, so this resolution still fires.

**Headers (server)**
- Isolated origin → all response headers pass through and all request
headers are forwarded. Same-site `/s/` keeps the strict allow-lists.
(Global CORS already handles preflight/ACAO.)

**`/s/` deprecation for new routes (cloud only)**
- New `LOGIC_FUNCTION_LEGACY_ROUTE_CUTOFF` config var (ISO date,
optional). When `PUBLIC_DOMAIN_URL` is set, functions created on/after
the cutoff return **410 Gone** on `/s/` with the new URL. Existing
routes and self-hosted instances are untouched.

**Frontend education**
- `publicFunctionDomain` added to `ClientConfig` (from
`PUBLIC_DOMAIN_URL`).
- The logic-function **Live URL** now resolves to
`https://{workspaceSubdomain}.{publicFunctionDomain}{path}` on cloud,
falling back to `/s/` for self-hosting.
- Front components call their functions through the SDK
(`RestApiClient`), which now targets the isolated domain via the
injected `TWENTY_FUNCTIONS_URL`.
- New **"Public URL"** section on the application **Settings** tab
explaining the isolated domain (shown when the app exposes
HTTP-triggered functions).

**Docs**: note the `withtwenty.com` domain for external callers in the
apps guide.

## Infra prerequisites (not code — needs dashboard work)
- Wildcard DNS `*.withtwenty.com` (proxied) + wildcard TLS in the
public-domain Cloudflare zone.
- Edge (Cloudflare) sets `X-Twenty-Public-Domain: true` for
`*.withtwenty.com` requests, so the existing nginx ingress rewrites them
onto `/s` (same header the custom-domain flow already relies on).
- Set `PUBLIC_DOMAIN_URL=https://withtwenty.com` on cloud.
- Submit `withtwenty.com` to the **Public Suffix List** (required for
cross-tenant cookie isolation before relying on `Set-Cookie`).

## Test plan
- [x] `nx typecheck twenty-server`, `nx typecheck twenty-front`
- [x] `lint:diff-with-main` + oxfmt clean (server + front)
- [x] `npx jest route-trigger public-function-domain
domain-server-config workspace-domains build-logic-function-event
client-config` → server unit tests passing (resolution tiers, header
passthrough vs allow-list, `/s/` cutoff 410)
- [x] `npx jest getLogicFunctionHttpUrl` (front) and `nx test
twenty-client-sdk` (RestApiClient routing) passing
- [x] CI green (server, front, sdk, renderer, ui, zapier, example apps)
- [ ] Manual: hit `{subdomain}.withtwenty.com/` end-to-end once infra is
provisioned

<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22045?utm_source=github"
rel="nofollow noreferrer noopener" target="_blank">``&lt;img alt="Review
in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"&gt;``</a>

packages/twenty-server/src/engine/core-modules/application/application.entity.ts

@@ -19,6 +19,7 @@ import { ApplicationRegistrationEntity } from 'src/engine/core-modules/applicati
 import { ApplicationRegistrationSourceType } from 'src/engine/core-modules/application/application-registration/enums/application-registration-source-type.enum';
 import { FileEntity } from 'src/engine/core-modules/file/entities/file.entity';
 import { ApplicationVariableEntity } from 'src/engine/core-modules/application/application-variable/application-variable.entity';
+import { PublicDomainEntity } from 'src/engine/core-modules/public-domain/public-domain.entity';
 import { WasIntroducedInUpgrade } from 'src/engine/core-modules/upgrade/decorators/was-introduced-in-upgrade.decorator';
 import { AgentEntity } from 'src/engine/metadata-modules/ai/ai-agent/entities/agent.entity';
 import { CommandMenuItemEntity } from 'src/engine/metadata-modules/command-menu-item/entities/command-menu-item.entity';
@@ -120,6 +121,29 @@ export class ApplicationEntity extends WorkspaceRelatedEntity {
   @JoinColumn({ name: 'applicationRegistrationId' })
   applicationRegistration: Relation<ApplicationRegistrationEntity> | null;
 
+  @Column({ nullable: true, type: 'uuid' })
+  @WasIntroducedInUpgrade({
+    upgradeCommandName:
+      '2.16.0_AddPrimaryPublicDomainToApplicationFastInstanceCommand_1782281874768',
+  })
+  primaryPublicDomainId: string | null;
+
+  @ManyToOne(() => PublicDomainEntity, {
+    onDelete: 'SET NULL',
+    nullable: true,
+  })
+  @JoinColumn({ name: 'primaryPublicDomainId' })
+  primaryPublicDomain: Relation<PublicDomainEntity> | null;
+
+  @OneToMany(
+    () => PublicDomainEntity,
+    (publicDomain) => publicDomain.application,
+    {
+      onDelete: 'SET NULL',
+    },
+  )
+  publicDomains: Relation<PublicDomainEntity[]>;
+
   @OneToMany(() => AgentEntity, (agent) => agent.application, {
     onDelete: 'CASCADE',
   })

packages/twenty-server/src/engine/core-modules/application/application.service.ts

@@ -258,6 +258,21 @@ export class ApplicationService {
     });
   }
 
+  async findPrimaryPublicDomainName({
+    applicationId,
+    workspaceId,
+  }: {
+    applicationId: string;
+    workspaceId: string;
+  }): Promise<string | null> {
+    const application = await this.applicationRepository.findOne({
+      where: { id: applicationId, workspaceId },
+      relations: ['primaryPublicDomain'],
+    });
+
+    return application?.primaryPublicDomain?.domain ?? null;
+  }
+
   async findByUniversalIdentifier({
     universalIdentifier,
     workspaceId,

packages/twenty-server/src/engine/core-modules/application/constants/application-entity-relation-properties.constant.ts

@@ -11,4 +11,6 @@ export const APPLICATION_ENTITY_RELATION_PROPERTIES = [
   'packageJsonFile',
   'yarnLockFile',
   'applicationRegistration',
+  'primaryPublicDomain',
+  'publicDomains',
 ] as const satisfies (keyof ApplicationEntity)[];

packages/twenty-server/src/engine/core-modules/client-config/client-config.controller.spec.ts

@@ -68,6 +68,7 @@ describe('ClientConfigController', () => {
         isEmailVerificationRequired: false,
         defaultSubdomain: 'app',
         frontDomain: 'localhost',
+        publicFunctionDomain: null,
         support: {
           supportDriver: SupportDriver.NONE,
           supportFrontChatId: undefined,

packages/twenty-server/src/engine/core-modules/client-config/client-config.entity.ts

@@ -270,6 +270,9 @@ export class ClientConfig {
   @Field(() => String)
   frontDomain: string;
 
+  @Field(() => String, { nullable: true })
+  publicFunctionDomain: string | null;
+
   @Field(() => Boolean)
   analyticsEnabled: boolean;
 

packages/twenty-server/src/engine/core-modules/client-config/services/client-config.service.spec.ts

@@ -30,6 +30,7 @@ describe('ClientConfigService', () => {
           provide: DomainServerConfigService,
           useValue: {
             getFrontUrl: jest.fn(),
+            getPublicBaseHostnameOrUndefined: jest.fn(),
           },
         },
         {
@@ -147,6 +148,7 @@ describe('ClientConfigService', () => {
         isEmailVerificationRequired: true,
         defaultSubdomain: 'app',
         frontDomain: 'app.twenty.com',
+        publicFunctionDomain: null,
         support: {
           supportDriver: 'FRONT',
           supportFrontChatId: 'chat-123',

packages/twenty-server/src/engine/core-modules/client-config/services/client-config.service.ts

@@ -195,6 +195,9 @@ export class ClientConfigService {
       ),
       defaultSubdomain: this.twentyConfigService.get('DEFAULT_SUBDOMAIN'),
       frontDomain: this.domainServerConfigService.getFrontUrl().hostname,
+      publicFunctionDomain:
+        this.domainServerConfigService.getPublicBaseHostnameOrUndefined() ??
+        null,
       support: {
         supportDriver: supportDriver ? supportDriver : SupportDriver.NONE,
         supportFrontChatId: this.twentyConfigService.get(

packages/twenty-server/src/engine/core-modules/domain/domain-server-config/services/domain-server-config.service.ts

@@ -1,6 +1,12 @@
 import { Injectable } from '@nestjs/common';
 
+import { isDefined } from 'twenty-shared/utils';
+
 import { buildUrlWithPathnameAndSearchParams } from 'src/engine/core-modules/domain/domain-server-config/utils/build-url-with-pathname-and-search-params.util';
+import {
+  getHostnameFromUrlOrUndefined,
+  isHostUnderPublicFunctionDomain,
+} from 'src/engine/core-modules/domain/domain-server-config/utils/public-function-domain.util';
 import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
 
 @Injectable()
@@ -31,6 +37,12 @@ export class DomainServerConfigService {
     return new URL(this.twentyConfigService.get('PUBLIC_DOMAIN_URL'));
   }
 
+  getPublicBaseHostnameOrUndefined(): string | undefined {
+    return getHostnameFromUrlOrUndefined(
+      this.twentyConfigService.get('PUBLIC_DOMAIN_URL'),
+    );
+  }
+
   buildBaseUrl({
     pathname,
     searchParams,
@@ -52,14 +64,38 @@ export class DomainServerConfigService {
 
     const isFrontdomain = originHostname.endsWith(`.${frontDomain}`);
 
-    const subdomain = originHostname.replace(`.${frontDomain}`, '');
+    if (isFrontdomain) {
+      const subdomain = originHostname.replace(`.${frontDomain}`, '');
+
+      return {
+        subdomain: this.isDefaultSubdomain(subdomain) ? undefined : subdomain,
+        domain: null,
+        isPublicDomainOrigin: false,
+      };
+    }
+
+    const publicBaseDomain = this.getPublicBaseHostnameOrUndefined();
+
+    if (
+      isDefined(publicBaseDomain) &&
+      isHostUnderPublicFunctionDomain({
+        host: originHostname,
+        publicDomainBaseHostname: publicBaseDomain,
+      })
+    ) {
+      const subdomain = originHostname.replace(`.${publicBaseDomain}`, '');
+
+      return {
+        subdomain: this.isDefaultSubdomain(subdomain) ? undefined : subdomain,
+        domain: null,
+        isPublicDomainOrigin: true,
+      };
+    }
 
     return {
-      subdomain:
-        isFrontdomain && !this.isDefaultSubdomain(subdomain)
-          ? subdomain
-          : undefined,
-      domain: isFrontdomain ? null : originHostname,
+      subdomain: undefined,
+      domain: originHostname,
+      isPublicDomainOrigin: false,
     };
   };
 

packages/twenty-server/src/engine/core-modules/domain/domain-server-config/utils/__tests__/public-function-domain.util.spec.ts

@@ -0,0 +1,104 @@
+import {
+  getHostnameFromUrlOrUndefined,
+  isHostUnderPublicFunctionDomain,
+} from 'src/engine/core-modules/domain/domain-server-config/utils/public-function-domain.util';
+
+describe('getHostnameFromUrlOrUndefined', () => {
+  it('returns the lowercased hostname of a valid url', () => {
+    expect(getHostnameFromUrlOrUndefined('https://WithTwenty.com')).toBe(
+      'withtwenty.com',
+    );
+  });
+
+  it('ignores the path and port', () => {
+    expect(
+      getHostnameFromUrlOrUndefined('https://withtwenty.com:8080/ignored'),
+    ).toBe('withtwenty.com');
+  });
+
+  it('returns undefined for empty/nullish input', () => {
+    expect(getHostnameFromUrlOrUndefined(undefined)).toBeUndefined();
+    expect(getHostnameFromUrlOrUndefined(null)).toBeUndefined();
+    expect(getHostnameFromUrlOrUndefined('')).toBeUndefined();
+  });
+
+  it('returns undefined for a non-url string', () => {
+    expect(getHostnameFromUrlOrUndefined('not a url')).toBeUndefined();
+  });
+});
+
+describe('isHostUnderPublicFunctionDomain', () => {
+  const publicDomainBaseHostname = 'withtwenty.com';
+
+  it('matches a strict subdomain of the base', () => {
+    expect(
+      isHostUnderPublicFunctionDomain({
+        host: 'acme.withtwenty.com',
+        publicDomainBaseHostname,
+      }),
+    ).toBe(true);
+  });
+
+  it('matches deeper subdomains', () => {
+    expect(
+      isHostUnderPublicFunctionDomain({
+        host: 'app.acme.withtwenty.com',
+        publicDomainBaseHostname,
+      }),
+    ).toBe(true);
+  });
+
+  it('is case-insensitive and strips the port', () => {
+    expect(
+      isHostUnderPublicFunctionDomain({
+        host: 'ACME.WithTwenty.com:443',
+        publicDomainBaseHostname,
+      }),
+    ).toBe(true);
+  });
+
+  it('does not match the apex base itself', () => {
+    expect(
+      isHostUnderPublicFunctionDomain({
+        host: 'withtwenty.com',
+        publicDomainBaseHostname,
+      }),
+    ).toBe(false);
+  });
+
+  it('does not match the main app domain', () => {
+    expect(
+      isHostUnderPublicFunctionDomain({
+        host: 'acme.twenty.com',
+        publicDomainBaseHostname,
+      }),
+    ).toBe(false);
+  });
+
+  it('does not match a lookalike suffix', () => {
+    expect(
+      isHostUnderPublicFunctionDomain({
+        host: 'evilwithtwenty.com',
+        publicDomainBaseHostname,
+      }),
+    ).toBe(false);
+  });
+
+  it('returns false when no base is configured', () => {
+    expect(
+      isHostUnderPublicFunctionDomain({
+        host: 'acme.withtwenty.com',
+        publicDomainBaseHostname: undefined,
+      }),
+    ).toBe(false);
+  });
+
+  it('returns false when host is missing', () => {
+    expect(
+      isHostUnderPublicFunctionDomain({
+        host: undefined,
+        publicDomainBaseHostname,
+      }),
+    ).toBe(false);
+  });
+});

packages/twenty-server/src/engine/core-modules/domain/domain-server-config/utils/public-function-domain.util.ts

@@ -0,0 +1,32 @@
+import { isNonEmptyString } from '@sniptt/guards';
+
+export const getHostnameFromUrlOrUndefined = (
+  url?: string | null,
+): string | undefined => {
+  if (!isNonEmptyString(url)) {
+    return undefined;
+  }
+
+  try {
+    return new URL(url).hostname.toLowerCase();
+  } catch {
+    return undefined;
+  }
+};
+
+export const isHostUnderPublicFunctionDomain = ({
+  host,
+  publicDomainBaseHostname,
+}: {
+  host?: string | null;
+  publicDomainBaseHostname?: string;
+}): boolean => {
+  if (!isNonEmptyString(host) || !isNonEmptyString(publicDomainBaseHostname)) {
+    return false;
+  }
+
+  const hostname = host.split(':')[0].toLowerCase();
+  const base = publicDomainBaseHostname.toLowerCase();
+
+  return hostname !== base && hostname.endsWith(`.${base}`);
+};

packages/twenty-server/src/engine/core-modules/domain/workspace-domains/services/workspace-domains.service.ts

@@ -1,6 +1,7 @@
 import { Injectable, Logger } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
 
+import { isNonEmptyString } from '@sniptt/guards';
 import { assertIsDefinedOrThrow, isDefined } from 'twenty-shared/utils';
 import { Repository } from 'typeorm';
 
@@ -99,8 +100,9 @@ export class WorkspaceDomainsService {
   async resolveWorkspaceAndPublicDomain(origin: string): Promise<{
     workspace: WorkspaceEntity | undefined;
     publicDomain: PublicDomainEntity | null;
+    isIsolatedOrigin: boolean;
   }> {
-    const { subdomain, domain } =
+    const { subdomain, domain, isPublicDomainOrigin } =
       this.domainServerConfigService.getSubdomainAndDomainFromUrl(origin);
 
     if (!this.twentyConfigService.get('IS_MULTIWORKSPACE_ENABLED')) {
@@ -113,11 +115,46 @@ export class WorkspaceDomainsService {
       return {
         workspace: await this.getDefaultWorkspace(),
         publicDomain: publicDomain ?? null,
+        isIsolatedOrigin: isPublicDomainOrigin || isDefined(publicDomain),
+      };
+    }
+
+    if (isPublicDomainOrigin) {
+      const hostname = new URL(origin).hostname;
+
+      const registeredPublicDomain = await this.publicDomainRepository.findOne({
+        where: { domain: hostname },
+        relations: ['workspace', 'workspace.workspaceSSOIdentityProviders'],
+      });
+
+      if (isDefined(registeredPublicDomain)) {
+        return {
+          workspace: registeredPublicDomain.workspace ?? undefined,
+          publicDomain: registeredPublicDomain,
+          isIsolatedOrigin: true,
+        };
+      }
+
+      const workspaceFromSubdomain = isDefined(subdomain)
+        ? ((await this.workspaceRepository.findOne({
+            where: { subdomain },
+            relations: ['workspaceSSOIdentityProviders'],
+          })) ?? undefined)
+        : undefined;
+
+      return {
+        workspace: workspaceFromSubdomain,
+        publicDomain: null,
+        isIsolatedOrigin: true,
       };
     }
 
     if (!domain && !subdomain) {
-      return { workspace: undefined, publicDomain: null };
+      return {
+        workspace: undefined,
+        publicDomain: null,
+        isIsolatedOrigin: false,
+      };
     }
 
     const where = isDefined(domain) ? { customDomain: domain } : { subdomain };
@@ -132,6 +169,7 @@ export class WorkspaceDomainsService {
       return {
         workspace: workspaceFromCustomDomainOrSubdomain,
         publicDomain: null,
+        isIsolatedOrigin: false,
       };
     }
 
@@ -143,9 +181,51 @@ export class WorkspaceDomainsService {
     return {
       workspace: publicDomain?.workspace ?? undefined,
       publicDomain: publicDomain ?? null,
+      isIsolatedOrigin: isDefined(publicDomain),
     };
   }
 
+  buildPublicFunctionBaseUrl({
+    workspace,
+    primaryPublicDomain,
+  }: {
+    workspace: Pick<WorkspaceEntity, 'subdomain'>;
+    primaryPublicDomain?: string | null;
+  }): string | undefined {
+    if (isNonEmptyString(primaryPublicDomain)) {
+      return `https://${primaryPublicDomain}`;
+    }
+
+    const publicBaseHostname =
+      this.domainServerConfigService.getPublicBaseHostnameOrUndefined();
+
+    if (!isNonEmptyString(publicBaseHostname)) {
+      return undefined;
+    }
+
+    const url = this.domainServerConfigService.getPublicDomainUrl();
+
+    url.hostname = `${workspace.subdomain}.${publicBaseHostname}`;
+
+    return url.origin;
+  }
+
+  buildPublicFunctionUrl({
+    workspace,
+    path,
+  }: {
+    workspace: Pick<WorkspaceEntity, 'subdomain'>;
+    path: string;
+  }): string | undefined {
+    const baseUrl = this.buildPublicFunctionBaseUrl({ workspace });
+
+    if (!isDefined(baseUrl)) {
+      return undefined;
+    }
+
+    return `${baseUrl}${path.startsWith('/') ? path : `/${path}`}`;
+  }
+
   private getCustomWorkspaceUrl(customDomain: string) {
     const url = this.domainServerConfigService.getFrontUrl();
 

packages/twenty-server/src/engine/core-modules/logic-function/logic-function-trigger/logic-function-trigger.service.ts

@@ -26,6 +26,7 @@ export class LogicFunctionTriggerService {
     request,
     pathParameters,
     forwardedRequestHeaders,
+    forwardAllHeaders = false,
     userId,
     userWorkspaceId,
   }: {
@@ -33,6 +34,7 @@ export class LogicFunctionTriggerService {
     request: Request;
     pathParameters: Record<string, string | string[] | undefined>;
     forwardedRequestHeaders: string[];
+    forwardAllHeaders?: boolean;
     userId?: string | null;
     userWorkspaceId?: string | null;
   }): Promise<LogicFunctionTriggerOutcome> {
@@ -40,6 +42,7 @@ export class LogicFunctionTriggerService {
       request,
       pathParameters,
       forwardedRequestHeaders,
+      forwardAllHeaders,
       userWorkspaceId: userWorkspaceId ?? null,
     });
 

packages/twenty-server/src/engine/core-modules/logic-function/logic-function-trigger/triggers/route/exceptions/route-trigger-rest-api-exception-filter.ts

@@ -45,6 +45,12 @@ export class RouteTriggerRestApiExceptionFilter implements ExceptionFilter {
           response,
           429,
         );
+      case RouteTriggerExceptionCode.LEGACY_ROUTE_DEPRECATED:
+        return this.httpExceptionHandlerService.handleError(
+          exception as CustomException,
+          response,
+          410,
+        );
       case RouteTriggerExceptionCode.ROUTE_TRIGGER_USER_UNCAUGHT_ERROR:
         return this.httpExceptionHandlerService.handleError(
           exception as CustomException,

packages/twenty-server/src/engine/core-modules/logic-function/logic-function-trigger/triggers/route/exceptions/route-trigger.exception.ts

@@ -15,6 +15,7 @@ export enum RouteTriggerExceptionCode {
   ROUTE_TRIGGER_USER_UNCAUGHT_ERROR = 'ROUTE_TRIGGER_USER_UNCAUGHT_ERROR',
   ROUTE_TRIGGER_PLATFORM_ERROR = 'ROUTE_TRIGGER_PLATFORM_ERROR',
   RATE_LIMIT_EXCEEDED = 'RATE_LIMIT_EXCEEDED',
+  LEGACY_ROUTE_DEPRECATED = 'LEGACY_ROUTE_DEPRECATED',
 }
 
 const getRouteTriggerExceptionUserFriendlyMessage = (
@@ -41,6 +42,8 @@ const getRouteTriggerExceptionUserFriendlyMessage = (
       return msg`An unexpected error occurred while executing the logic function.`;
     case RouteTriggerExceptionCode.RATE_LIMIT_EXCEEDED:
       return msg`Too many requests. Please try again later.`;
+    case RouteTriggerExceptionCode.LEGACY_ROUTE_DEPRECATED:
+      return msg`This endpoint is no longer available on /s/. Use the dedicated public domain URL instead.`;
     default:
       assertUnreachable(code);
   }

packages/twenty-server/src/engine/core-modules/logic-function/logic-function-trigger/triggers/route/route-trigger.service.ts

@@ -1,6 +1,8 @@
 import { Injectable, Logger } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
 
+import { msg } from '@lingui/core/macro';
+import { isNonEmptyString } from '@sniptt/guards';
 import { Request } from 'express';
 import { match } from 'path-to-regexp';
 import { assertIsDefinedOrThrow, isDefined } from 'twenty-shared/utils';
@@ -9,11 +11,14 @@ import { HTTPMethod } from 'twenty-shared/types';
 
 import { AccessTokenService } from 'src/engine/core-modules/auth/token/services/access-token.service';
 import { WorkspaceDomainsService } from 'src/engine/core-modules/domain/workspace-domains/services/workspace-domains.service';
+import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
+import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
 import {
   RouteTriggerException,
   RouteTriggerExceptionCode,
 } from 'src/engine/core-modules/logic-function/logic-function-trigger/triggers/route/exceptions/route-trigger.exception';
 import { LogicFunctionTriggerService } from 'src/engine/core-modules/logic-function/logic-function-trigger/logic-function-trigger.service';
+import { type RouteTriggerResponse } from 'src/engine/core-modules/logic-function/logic-function-trigger/triggers/route/utils/route-trigger-response.util';
 import {
   LogicFunctionException,
   LogicFunctionExceptionCode,
@@ -33,6 +38,7 @@ export class RouteTriggerService {
     private readonly accessTokenService: AccessTokenService,
     private readonly logicFunctionTriggerService: LogicFunctionTriggerService,
     private readonly workspaceDomainsService: WorkspaceDomainsService,
+    private readonly twentyConfigService: TwentyConfigService,
     @InjectRepository(LogicFunctionEntity)
     private readonly logicFunctionRepository: Repository<LogicFunctionEntity>,
   ) {}
@@ -46,10 +52,11 @@ export class RouteTriggerService {
   }): Promise<{
     logicFunction: LogicFunctionEntity;
     pathParams: Partial<Record<string, string | string[]>>;
+    isIsolatedOrigin: boolean;
   }> {
     const host = `${request.protocol}://${request.get('host')}`;
 
-    const { workspace, publicDomain } =
+    const { workspace, publicDomain, isIsolatedOrigin } =
       await this.workspaceDomainsService.resolveWorkspaceAndPublicDomain(host);
 
     assertIsDefinedOrThrow(
@@ -90,9 +97,16 @@ export class RouteTriggerService {
       const routeMatched = routeMatcher(requestPath);
 
       if (routeMatched) {
+        this.assertLegacyRouteIsServableOrThrow({
+          logicFunction,
+          workspace,
+          isIsolatedOrigin,
+        });
+
         return {
           logicFunction,
           pathParams: routeMatched.params,
+          isIsolatedOrigin,
         };
       }
     }
@@ -103,6 +117,58 @@ export class RouteTriggerService {
     );
   }
 
+  private assertLegacyRouteIsServableOrThrow({
+    logicFunction,
+    workspace,
+    isIsolatedOrigin,
+  }: {
+    logicFunction: LogicFunctionEntity;
+    workspace: WorkspaceEntity;
+    isIsolatedOrigin: boolean;
+  }) {
+    if (isIsolatedOrigin) {
+      return;
+    }
+
+    const cutoffIso = this.twentyConfigService.get(
+      'LOGIC_FUNCTION_LEGACY_ROUTE_CUTOFF',
+    );
+
+    if (!isNonEmptyString(cutoffIso)) {
+      return;
+    }
+
+    const publicFunctionUrl =
+      this.workspaceDomainsService.buildPublicFunctionUrl({
+        workspace,
+        path: logicFunction.httpRouteTriggerSettings?.path ?? '/',
+      });
+
+    if (!isDefined(publicFunctionUrl)) {
+      return;
+    }
+
+    const cutoffDate = new Date(cutoffIso);
+
+    if (Number.isNaN(cutoffDate.getTime())) {
+      return;
+    }
+
+    if (logicFunction.createdAt.getTime() >= cutoffDate.getTime()) {
+      this.logger.warn(
+        `Logic function ${logicFunction.id} was requested on the deprecated /s/ route but is only served on ${publicFunctionUrl}`,
+      );
+
+      throw new RouteTriggerException(
+        `Logic function ${logicFunction.id} is no longer served on the legacy /s/ route`,
+        RouteTriggerExceptionCode.LEGACY_ROUTE_DEPRECATED,
+        {
+          userFriendlyMessage: msg`This endpoint has moved. Call it at ${publicFunctionUrl} instead.`,
+        },
+      );
+    }
+  }
+
   private async validateWorkspaceFromRequest({
     request,
     workspaceId,
@@ -160,8 +226,8 @@ export class RouteTriggerService {
   }: {
     request: Request;
     httpMethod: HTTPMethod;
-  }) {
-    const { logicFunction, pathParams } =
+  }): Promise<{ response: RouteTriggerResponse; isIsolatedOrigin: boolean }> {
+    const { logicFunction, pathParams, isIsolatedOrigin } =
       await this.getLogicFunctionWithPathParamsOrFail({
         request,
         httpMethod,
@@ -191,6 +257,7 @@ export class RouteTriggerService {
         pathParameters: pathParams,
         forwardedRequestHeaders:
           httpRouteSettings?.forwardedRequestHeaders ?? [],
+        forwardAllHeaders: isIsolatedOrigin,
         userId,
         userWorkspaceId,
       });
@@ -225,6 +292,6 @@ export class RouteTriggerService {
       );
     }
 
-    return outcome.response;
+    return { response: outcome.response, isIsolatedOrigin };
   }
 }

packages/twenty-server/src/engine/core-modules/logic-function/logic-function-trigger/triggers/route/utils/__tests__/build-logic-function-event.util.spec.ts

@@ -107,6 +107,29 @@ describe('filterRequestHeaders', () => {
       'content-type': 'application/json',
     });
   });
+
+  it('should forward every header when forwardAllHeaders is true', () => {
+    const requestHeaders = {
+      'content-type': 'application/json',
+      authorization: 'Bearer token123',
+      'x-custom-header': 'custom-value',
+      'x-array-header': ['a', 'b'],
+      'x-missing': undefined,
+    };
+
+    const result = filterRequestHeaders({
+      requestHeaders,
+      forwardedRequestHeaders: [],
+      forwardAllHeaders: true,
+    });
+
+    expect(result).toEqual({
+      'content-type': 'application/json',
+      authorization: 'Bearer token123',
+      'x-custom-header': 'custom-value',
+      'x-array-header': 'a, b',
+    });
+  });
 });
 
 describe('extractBody', () => {

packages/twenty-server/src/engine/core-modules/logic-function/logic-function-trigger/triggers/route/utils/build-logic-function-event.util.ts

@@ -4,13 +4,34 @@ import { type LogicFunctionEvent } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import { isObject, isString } from '@sniptt/guards';
 
+const normalizeHeaderValue = (
+  headerValue: string | string[] | undefined,
+): string | undefined =>
+  Array.isArray(headerValue) ? headerValue.join(', ') : headerValue;
+
 export const filterRequestHeaders = ({
   requestHeaders,
   forwardedRequestHeaders,
+  forwardAllHeaders = false,
 }: {
   requestHeaders: Request['headers'];
   forwardedRequestHeaders: string[];
+  forwardAllHeaders?: boolean;
 }): Record<string, string | undefined> => {
+  if (forwardAllHeaders) {
+    const allHeaders: Record<string, string | undefined> = {};
+
+    for (const [headerName, headerValue] of Object.entries(requestHeaders)) {
+      if (headerValue === undefined) {
+        continue;
+      }
+
+      allHeaders[headerName] = normalizeHeaderValue(headerValue);
+    }
+
+    return allHeaders;
+  }
+
   const lowercaseForwardedHeaders = forwardedRequestHeaders.map((h) =>
     h.toLowerCase(),
   );
@@ -21,9 +42,7 @@ export const filterRequestHeaders = ({
     const headerValue = requestHeaders[headerName];
 
     if (headerValue !== undefined) {
-      filteredHeaders[headerName] = Array.isArray(headerValue)
-        ? headerValue.join(', ')
-        : headerValue;
+      filteredHeaders[headerName] = normalizeHeaderValue(headerValue);
     }
   }
 
@@ -118,11 +137,13 @@ export const buildLogicFunctionEvent = ({
   request,
   pathParameters,
   forwardedRequestHeaders,
+  forwardAllHeaders = false,
   userWorkspaceId,
 }: {
   request: Request;
   pathParameters: Record<string, string | string[] | undefined>;
   forwardedRequestHeaders: string[];
+  forwardAllHeaders?: boolean;
   userWorkspaceId: string | null;
 }): LogicFunctionEvent => {
   const rawBody = extractRawBody(request);
@@ -131,6 +152,7 @@ export const buildLogicFunctionEvent = ({
     headers: filterRequestHeaders({
       requestHeaders: request.headers,
       forwardedRequestHeaders,
+      forwardAllHeaders,
     }),
     queryStringParameters: normalizeQueryStringParameters(request.query),
     pathParameters: normalizePathParameters(pathParameters),

packages/twenty-server/src/engine/core-modules/logic-function/logic-function-trigger/triggers/route/utils/route-trigger-response.util.ts

@@ -33,11 +33,12 @@ export const buildRouteTriggerResponse = (
 export const sendRouteTriggerResponse = (
   response: Response,
   { statusCode, headers, body }: RouteTriggerResponse,
+  { allowAllHeaders = false }: { allowAllHeaders?: boolean } = {},
 ) => {
   response.status(statusCode);
 
   for (const [key, value] of Object.entries(headers)) {
-    if (ALLOWED_RESPONSE_HEADERS.has(key.toLowerCase())) {
+    if (allowAllHeaders || ALLOWED_RESPONSE_HEADERS.has(key.toLowerCase())) {
       response.setHeader(key, value);
     }
   }

packages/twenty-server/src/engine/core-modules/public-domain/dtos/create-public-domain.input.ts

@@ -1,6 +1,6 @@
 import { ArgsType, Field } from '@nestjs/graphql';
 
-import { IsNotEmpty, IsOptional, IsString, IsUUID } from 'class-validator';
+import { IsNotEmpty, IsString, IsUUID } from 'class-validator';
 
 @ArgsType()
 export class CreatePublicDomainInput {
@@ -9,8 +9,7 @@ export class CreatePublicDomainInput {
   @IsNotEmpty()
   domain: string;
 
-  @Field(() => String, { nullable: true })
-  @IsOptional()
+  @Field(() => String)
   @IsUUID()
-  applicationId?: string | null;
+  applicationId: string;
 }

packages/twenty-server/src/engine/core-modules/public-domain/dtos/update-public-domain.input.ts

@@ -1,16 +0,0 @@
-import { ArgsType, Field } from '@nestjs/graphql';
-
-import { IsNotEmpty, IsOptional, IsString, IsUUID } from 'class-validator';
-
-@ArgsType()
-export class UpdatePublicDomainInput {
-  @Field(() => String)
-  @IsString()
-  @IsNotEmpty()
-  domain: string;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsUUID()
-  applicationId?: string | null;
-}

packages/twenty-server/src/engine/core-modules/public-domain/public-domain.entity.ts

@@ -34,13 +34,17 @@ export class PublicDomainEntity extends WorkspaceRelatedEntity {
   @Column({ type: 'boolean', default: false, nullable: false })
   isValidated: boolean;
 
-  @Column({ type: 'uuid', nullable: true })
-  applicationId: string | null;
+  @Column({ type: 'uuid', nullable: false })
+  applicationId: string;
 
-  @ManyToOne(() => ApplicationEntity, {
-    onDelete: 'CASCADE',
-    nullable: true,
-  })
+  @ManyToOne(
+    () => ApplicationEntity,
+    (application) => application.publicDomains,
+    {
+      onDelete: 'CASCADE',
+      nullable: false,
+    },
+  )
   @JoinColumn({ name: 'applicationId' })
-  application: Relation<ApplicationEntity> | null;
+  application: Relation<ApplicationEntity>;
 }

packages/twenty-server/src/engine/core-modules/public-domain/public-domain.resolver.ts

@@ -14,7 +14,6 @@ import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/re
 import { CreatePublicDomainInput } from 'src/engine/core-modules/public-domain/dtos/create-public-domain.input';
 import { PublicDomainDTO } from 'src/engine/core-modules/public-domain/dtos/public-domain.dto';
 import { PublicDomainInput } from 'src/engine/core-modules/public-domain/dtos/public-domain.input';
-import { UpdatePublicDomainInput } from 'src/engine/core-modules/public-domain/dtos/update-public-domain.input';
 import { PublicDomainExceptionFilter } from 'src/engine/core-modules/public-domain/public-domain-exception-filter';
 import { PublicDomainEntity } from 'src/engine/core-modules/public-domain/public-domain.entity';
 import {
@@ -60,19 +59,7 @@ export class PublicDomainResolver {
     return this.publicDomainService.createPublicDomain({
       domain,
       workspace: currentWorkspace,
-      applicationId: applicationId ?? null,
-    });
-  }
-
-  @Mutation(() => PublicDomainDTO)
-  async updatePublicDomain(
-    @Args() { domain, applicationId }: UpdatePublicDomainInput,
-    @AuthWorkspace() currentWorkspace: WorkspaceEntity,
-  ): Promise<PublicDomainDTO> {
-    return this.publicDomainService.updatePublicDomainApplication({
-      domain,
-      workspace: currentWorkspace,
-      applicationId: applicationId ?? null,
+      applicationId,
     });
   }
 

packages/twenty-server/src/engine/core-modules/public-domain/public-domain.service.ts

@@ -59,7 +59,7 @@ export class PublicDomainService {
   }: {
     domain: string;
     workspace: WorkspaceEntity;
-    applicationId: string | null;
+    applicationId: string;
   }): Promise<PublicDomainDTO> {
     const formattedDomain = domain.trim().toLowerCase();
 
@@ -69,12 +69,10 @@ export class PublicDomainService {
         this.publicDomainRepository.findOne(workspace.id, {
           where: { domain: formattedDomain },
         }),
-        isDefined(applicationId)
-          ? this.applicationRepository.findOneBy({
-              id: applicationId,
-              workspaceId: workspace.id,
-            })
-          : Promise.resolve(null),
+        this.applicationRepository.findOneBy({
+          id: applicationId,
+          workspaceId: workspace.id,
+        }),
       ]);
 
     if (isDefined(workspaceWithCustomDomain)) {
@@ -97,7 +95,7 @@ export class PublicDomainService {
       );
     }
 
-    if (isDefined(applicationId) && !isDefined(application)) {
+    if (!isDefined(application)) {
       throw new PublicDomainException(
         'Application not found in this workspace',
         PublicDomainExceptionCode.APPLICATION_NOT_FOUND,
@@ -130,48 +128,6 @@ export class PublicDomainService {
     return publicDomain;
   }
 
-  async updatePublicDomainApplication({
-    domain,
-    workspace,
-    applicationId,
-  }: {
-    domain: string;
-    workspace: WorkspaceEntity;
-    applicationId: string | null;
-  }): Promise<PublicDomainDTO> {
-    const formattedDomain = domain.trim().toLowerCase();
-
-    const [publicDomain, application] = await Promise.all([
-      this.publicDomainRepository.findOne(workspace.id, {
-        where: { domain: formattedDomain },
-      }),
-      isDefined(applicationId)
-        ? this.applicationRepository.findOneBy({
-            id: applicationId,
-            workspaceId: workspace.id,
-          })
-        : Promise.resolve(null),
-    ]);
-
-    if (!isDefined(publicDomain)) {
-      throw new PublicDomainException(
-        `Public domain ${domain} not found`,
-        PublicDomainExceptionCode.PUBLIC_DOMAIN_NOT_FOUND,
-      );
-    }
-
-    if (isDefined(applicationId) && !isDefined(application)) {
-      throw new PublicDomainException(
-        'Application not found in this workspace',
-        PublicDomainExceptionCode.APPLICATION_NOT_FOUND,
-      );
-    }
-
-    publicDomain.applicationId = applicationId;
-
-    return this.publicDomainRepository.save(workspace.id, publicDomain);
-  }
-
   async checkPublicDomainValidRecords(
     publicDomain: PublicDomainEntity,
     domainValidRecords?: DomainValidRecords,

packages/twenty-server/src/engine/core-modules/twenty-config/config-variables.ts

@@ -2,6 +2,7 @@ import { Logger } from '@nestjs/common';
 
 import { plainToClass } from 'class-transformer';
 import {
+  IsDateString,
   IsDefined,
   IsNotEmpty,
   IsOptional,
@@ -1241,6 +1242,16 @@ export class ConfigVariables {
   @IsOptional()
   PUBLIC_DOMAIN_URL: string;
 
+  @ConfigVariablesMetadata({
+    group: ConfigVariablesGroup.SERVER_CONFIG,
+    description:
+      'ISO date from which HTTP logic functions are no longer served on the legacy /s/ route. Functions created on or after this date are only reachable on the isolated public domain (*.withtwenty.com). Only enforced when PUBLIC_DOMAIN_URL is set; leave empty to keep serving every function on /s/ (default for self-hosting).',
+    type: ConfigVariableType.STRING,
+  })
+  @IsDateString()
+  @IsOptional()
+  LOGIC_FUNCTION_LEGACY_ROUTE_CUTOFF: string;
+
   @ConfigVariablesMetadata({
     group: ConfigVariablesGroup.SERVER_CONFIG,
     isSensitive: true,

packages/twenty-server/src/engine/metadata-modules/flat-field-metadata/__tests__/morph-relation-from-create-field-input-to-flat-field-metadatas-to-create.spec.ts

@@ -41,6 +41,7 @@ const MOCK_FLAT_APPLICATION: FlatApplication = {
   settingsCustomTabFrontComponentId: null,
   canBeUninstalled: false,
   applicationRegistrationId: null,
+  primaryPublicDomainId: null,
   createdAt: new Date(),
   updatedAt: new Date(),
   deletedAt: null,

packages/twenty-server/src/engine/metadata-modules/flat-field-metadata/utils/__tests__/generate-morph-or-relation-flat-field-metadata-pair.spec.ts

@@ -36,6 +36,7 @@ const MOCK_FLAT_APPLICATION: FlatApplication = {
   settingsCustomTabFrontComponentId: null,
   canBeUninstalled: false,
   applicationRegistrationId: null,
+  primaryPublicDomainId: null,
   createdAt: new Date(),
   updatedAt: new Date(),
   deletedAt: null,

packages/twenty-server/src/engine/metadata-modules/front-component/front-component.module.ts

@@ -2,6 +2,7 @@ import { Module } from '@nestjs/common';
 
 import { ApplicationModule } from 'src/engine/core-modules/application/application.module';
 import { TokenModule } from 'src/engine/core-modules/auth/token/token.module';
+import { WorkspaceDomainsModule } from 'src/engine/core-modules/domain/workspace-domains/workspace-domains.module';
 import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
 import { FlatFrontComponentModule } from 'src/engine/metadata-modules/flat-front-component/flat-front-component.module';
 import { FrontComponentController } from 'src/engine/metadata-modules/front-component/controllers/front-component.controller';
@@ -25,6 +26,7 @@ import { WorkspaceMigrationModule } from 'src/engine/workspace-manager/workspace
     FlatFrontComponentModule,
     SubscriptionsModule,
     WorkspaceCacheModule,
+    WorkspaceDomainsModule,
   ],
   controllers: [FrontComponentController],
   providers: [

packages/twenty-server/src/engine/metadata-modules/route-trigger/__tests__/route-trigger.controller.spec.ts

@@ -41,9 +41,8 @@ describe('RouteTriggerController', () => {
     const response = createResponseMock();
 
     handle.mockResolvedValue({
-      statusCode: 200,
-      headers: {},
-      body: { ok: true },
+      response: { statusCode: 200, headers: {}, body: { ok: true } },
+      isIsolatedOrigin: false,
     });
 
     await controller.post(request, response);
@@ -60,9 +59,12 @@ describe('RouteTriggerController', () => {
     const response = createResponseMock();
 
     handle.mockResolvedValue({
-      statusCode: 201,
-      headers: { 'Content-Type': 'text/html', 'Cache-Control': 'no-store' },
-      body: '<h1>Hi</h1>',
+      response: {
+        statusCode: 201,
+        headers: { 'Content-Type': 'text/html', 'Cache-Control': 'no-store' },
+        body: '<h1>Hi</h1>',
+      },
+      isIsolatedOrigin: false,
     });
 
     await controller.get({} as never, response);
@@ -79,18 +81,21 @@ describe('RouteTriggerController', () => {
     expect(response.send).toHaveBeenCalledWith('<h1>Hi</h1>');
   });
 
-  it('drops headers that are not in the allow-list', async () => {
+  it('drops headers that are not in the allow-list on the same-site /s/ route', async () => {
     const response = createResponseMock();
 
     handle.mockResolvedValue({
-      statusCode: 200,
-      headers: {
-        'Content-Type': 'text/html',
-        'Set-Cookie': 'session=abc',
-        'Access-Control-Allow-Origin': '*',
-        'X-Custom': 'foo',
+      response: {
+        statusCode: 200,
+        headers: {
+          'Content-Type': 'text/html',
+          'Set-Cookie': 'session=abc',
+          'Access-Control-Allow-Origin': '*',
+          'X-Custom': 'foo',
+        },
+        body: '<h1>Hi</h1>',
       },
-      body: '<h1>Hi</h1>',
+      isIsolatedOrigin: false,
     });
 
     await controller.get({} as never, response);
@@ -110,10 +115,53 @@ describe('RouteTriggerController', () => {
     expect(response.setHeader).not.toHaveBeenCalledWith('X-Custom', 'foo');
   });
 
+  it('forwards every header when the request is served from an isolated origin', async () => {
+    const response = createResponseMock();
+
+    handle.mockResolvedValue({
+      response: {
+        statusCode: 200,
+        headers: {
+          'Content-Type': 'text/html',
+          'Permissions-Policy': 'camera=(self)',
+          'Cross-Origin-Opener-Policy': 'same-origin',
+          'Cross-Origin-Embedder-Policy': 'require-corp',
+          'Set-Cookie': 'session=abc',
+          'X-Custom': 'foo',
+        },
+        body: '<h1>Hi</h1>',
+      },
+      isIsolatedOrigin: true,
+    });
+
+    await controller.get({} as never, response);
+
+    expect(response.setHeader).toHaveBeenCalledWith(
+      'Permissions-Policy',
+      'camera=(self)',
+    );
+    expect(response.setHeader).toHaveBeenCalledWith(
+      'Cross-Origin-Opener-Policy',
+      'same-origin',
+    );
+    expect(response.setHeader).toHaveBeenCalledWith(
+      'Cross-Origin-Embedder-Policy',
+      'require-corp',
+    );
+    expect(response.setHeader).toHaveBeenCalledWith(
+      'Set-Cookie',
+      'session=abc',
+    );
+    expect(response.setHeader).toHaveBeenCalledWith('X-Custom', 'foo');
+  });
+
   it('sends an empty response when the body is nil', async () => {
     const response = createResponseMock();
 
-    handle.mockResolvedValue({ statusCode: 200, headers: {}, body: null });
+    handle.mockResolvedValue({
+      response: { statusCode: 200, headers: {}, body: null },
+      isIsolatedOrigin: false,
+    });
 
     await controller.get({} as never, response);
 
@@ -125,7 +173,10 @@ describe('RouteTriggerController', () => {
   it('defaults a string body content-type to text/plain when none is set', async () => {
     const response = createResponseMock();
 
-    handle.mockResolvedValue({ statusCode: 200, headers: {}, body: 'plain' });
+    handle.mockResolvedValue({
+      response: { statusCode: 200, headers: {}, body: 'plain' },
+      isIsolatedOrigin: false,
+    });
 
     await controller.get({} as never, response);
 
@@ -140,9 +191,8 @@ describe('RouteTriggerController', () => {
     const response = createResponseMock();
 
     handle.mockResolvedValue({
-      statusCode: 200,
-      headers: {},
-      body: { ok: true },
+      response: { statusCode: 200, headers: {}, body: { ok: true } },
+      isIsolatedOrigin: false,
     });
 
     await controller.get({} as never, response);
@@ -154,9 +204,12 @@ describe('RouteTriggerController', () => {
     const response = createResponseMock();
 
     handle.mockResolvedValue({
-      statusCode: 200,
-      headers: { 'Content-Type': 'application/ld+json' },
-      body: { ok: true },
+      response: {
+        statusCode: 200,
+        headers: { 'Content-Type': 'application/ld+json' },
+        body: { ok: true },
+      },
+      isIsolatedOrigin: false,
     });
 
     await controller.get({} as never, response);

packages/twenty-server/src/engine/metadata-modules/route-trigger/route-trigger.controller.ts

@@ -26,58 +26,41 @@ import { sendRouteTriggerResponse } from 'src/engine/core-modules/logic-function
 export class RouteTriggerController {
   constructor(private readonly routeTriggerService: RouteTriggerService) {}
 
+  private async handleRequest(
+    request: Request,
+    response: Response,
+    httpMethod: HTTPMethod,
+  ) {
+    const { response: triggerResponse, isIsolatedOrigin } =
+      await this.routeTriggerService.handle({ request, httpMethod });
+
+    sendRouteTriggerResponse(response, triggerResponse, {
+      allowAllHeaders: isIsolatedOrigin,
+    });
+  }
+
   @Get('*path')
   async get(@Req() request: Request, @Res() response: Response) {
-    sendRouteTriggerResponse(
-      response,
-      await this.routeTriggerService.handle({
-        request,
-        httpMethod: HTTPMethod.GET,
-      }),
-    );
+    await this.handleRequest(request, response, HTTPMethod.GET);
   }
 
   @Post('*path')
   async post(@Req() request: Request, @Res() response: Response) {
-    sendRouteTriggerResponse(
-      response,
-      await this.routeTriggerService.handle({
-        request,
-        httpMethod: HTTPMethod.POST,
-      }),
-    );
+    await this.handleRequest(request, response, HTTPMethod.POST);
   }
 
   @Put('*path')
   async put(@Req() request: Request, @Res() response: Response) {
-    sendRouteTriggerResponse(
-      response,
-      await this.routeTriggerService.handle({
-        request,
-        httpMethod: HTTPMethod.PUT,
-      }),
-    );
+    await this.handleRequest(request, response, HTTPMethod.PUT);
   }
 
   @Patch('*path')
   async patch(@Req() request: Request, @Res() response: Response) {
-    sendRouteTriggerResponse(
-      response,
-      await this.routeTriggerService.handle({
-        request,
-        httpMethod: HTTPMethod.PATCH,
-      }),
-    );
+    await this.handleRequest(request, response, HTTPMethod.PATCH);
   }
 
   @Delete('*path')
   async delete(@Req() request: Request, @Res() response: Response) {
-    sendRouteTriggerResponse(
-      response,
-      await this.routeTriggerService.handle({
-        request,
-        httpMethod: HTTPMethod.DELETE,
-      }),
-    );
+    await this.handleRequest(request, response, HTTPMethod.DELETE);
   }
 }

packages/twenty-server/src/engine/twenty-orm/entity-manager/workspace-entity-manager.spec.ts

@@ -235,7 +235,6 @@ describe('WorkspaceEntityManager', () => {
         IS_UNIQUE_INDEXES_ENABLED: false,
         IS_JSON_FILTER_ENABLED: false,
         IS_MARKETPLACE_SETTING_TAB_VISIBLE: false,
-        IS_PUBLIC_DOMAIN_ENABLED: false,
         IS_EMAIL_GROUP_ENABLED: false,
         IS_JUNCTION_RELATIONS_ENABLED: false,
         IS_REST_METADATA_API_NEW_FORMAT_DIRECT: false,
@@ -262,7 +261,6 @@ describe('WorkspaceEntityManager', () => {
       featureFlagMap: {
         IS_UNIQUE_INDEXES_ENABLED: false,
         IS_JSON_FILTER_ENABLED: false,
-        IS_PUBLIC_DOMAIN_ENABLED: false,
       },
       permissionsPerRoleId: {},
       eventEmitterService: mockInternalContext.eventEmitterService,

packages/twenty-server/src/engine/workspace-manager/dev-seeder/core/utils/seed-feature-flags.util.ts

@@ -25,11 +25,6 @@ export const seedFeatureFlags = async ({
         workspaceId: workspaceId,
         value: false,
       },
-      {
-        key: FeatureFlagKey.IS_PUBLIC_DOMAIN_ENABLED,
-        workspaceId: workspaceId,
-        value: true,
-      },
       {
         key: FeatureFlagKey.IS_EMAIL_GROUP_ENABLED,
         workspaceId: workspaceId,