c44d61f324
## Summary - Validates that the timezone parameter in group-by date expressions is a recognized IANA timezone - Adds SQL string literal escaping as a defense-in-depth measure for the timezone value interpolated into SQL expressions - Moves the `IANA_TIME_ZONES` constant to `twenty-shared` so it can be reused across frontend and server packages - Adds `INVALID_TIMEZONE` error code mapped to 400 Bad Request in both GraphQL and REST API exception handlers ## Test plan - [x] Unit tests for `validateIanaTimeZone` (valid IANA zones, fixed offsets, rejects invalid strings) - [x] Unit tests for `escapeSqlStringLiteral` - [x] Integration tests for `getGroupByExpression` covering timezone validation and granularity handling Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>