Harden server-side input validation and auth defaults (#18018)

## Summary

- **File storage (LocalDriver):** Add realpath resolution and symlink
rejection to `writeFile`, `downloadFile`, and `downloadFolder` — brings
them in line with the existing `readFile` protections. Includes unit
tests.
- **JWT:** Pin signing/verification to HS256 explicitly.
- **Auth:** Revoke active refresh tokens when a user changes their
password.
- **Logic functions:** Validate `handlerName` as a safe JS identifier at
both DTO and runtime level, preventing injection into the generated
runner script.
- **User entity:** Remove `passwordHash` from the GraphQL schema
(`@Field` decorator removed, column stays).
- **Query params:** Use `crypto.randomBytes` instead of `Math.random`
for SQL parameter name generation.
- **Exception filter:** Mirror the request `Origin` header instead of
sending `Access-Control-Allow-Origin: *`.

## Test plan

- [x] `local.driver.spec.ts` — writeFile rejects symlinks, downloadFile
rejects paths outside storage
- [ ] Verify JWT auth flow still works (login, token refresh)
- [ ] Verify password change invalidates existing sessions
- [ ] Verify logic function creation with valid/invalid handler names
- [ ] Verify file upload/download in dev environment


Made with [Cursor](https://cursor.com)

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

packages/twenty-server/src/engine/metadata-modules/logic-function/dtos/create-logic-function.input.ts

@@ -8,6 +8,7 @@ import {
   IsOptional,
   IsString,
   IsUUID,
+  Matches,
   Max,
   Min,
 } from 'class-validator';
@@ -71,6 +72,9 @@ export class CreateLogicFunction {
   checksum?: string;
 
   @IsString()
+  @Matches(/^[a-zA-Z_$][a-zA-Z0-9_$]*$/, {
+    message: 'handlerName must be a valid JavaScript identifier',
+  })
   @Field({ nullable: false })
   handlerName: string;
 

packages/twenty-server/src/engine/metadata-modules/logic-function/dtos/logic-function-source.input.ts

@@ -1,6 +1,6 @@
 import { Field, InputType } from '@nestjs/graphql';
 
-import { IsObject, IsString } from 'class-validator';
+import { IsObject, IsString, Matches } from 'class-validator';
 import graphqlTypeJson from 'graphql-type-json';
 
 @InputType()
@@ -14,6 +14,9 @@ export class LogicFunctionSourceInput {
   toolInputSchema: object;
 
   @IsString()
+  @Matches(/^[a-zA-Z_$][a-zA-Z0-9_$]*$/, {
+    message: 'handlerName must be a valid JavaScript identifier',
+  })
   @Field({ nullable: false })
   handlerName: string;
 }

packages/twenty-server/src/engine/metadata-modules/logic-function/dtos/update-logic-function-from-source.input.ts

@@ -9,6 +9,7 @@ import {
   IsOptional,
   IsString,
   IsUUID,
+  Matches,
   Max,
   Min,
   ValidateNested,
@@ -53,6 +54,9 @@ class UpdateLogicFunctionFromSourceInputUpdates {
   toolInputSchema?: object;
 
   @IsString()
+  @Matches(/^[a-zA-Z_$][a-zA-Z0-9_$]*$/, {
+    message: 'handlerName must be a valid JavaScript identifier',
+  })
   @Field({ nullable: true })
   @IsOptional()
   handlerName?: string;