Fix Mass Assignment in Assistants Endpoints

[christopherholland-workday]

Flowise-323 (See comments on Assistants)

Moved from #6052 (The branch got messed up in previous PR)

[gemini-code-assist]

Code Review

This pull request refactors the assistant creation logic by moving the assignment of workspaceId from the controller to the service layer and introducing stripProtectedFields to sanitize the input. The review feedback recommends replacing Object.assign with explicit property mapping to further mitigate mass assignment vulnerabilities and ensure strict control over entity attributes.

[gemini-code-assist]

Avoid mass assignment from request bodies to entities. Instead of using Object.assign, explicitly map allowed properties. This prevents potential IDOR vulnerabilities and ensures sensitive fields like workspaceId are handled correctly from a trusted source (e.g., user session), as per the repository security rules.

Suggested change

	Object.assign(newAssistant, stripProtectedFields(requestBody))
	newAssistant.workspaceId = workspaceId
	newAssistant.details = requestBody.details
	newAssistant.credential = requestBody.credential
	newAssistant.iconSrc = requestBody.iconSrc
	newAssistant.type = requestBody.type
	newAssistant.workspaceId = workspaceId

References

1. Avoid mass assignment from request bodies to entities. Instead of using a generic assignment like Object.assign(entity, body), explicitly map allowed properties. Sensitive fields like workspaceId must be set on the server from a trusted source (e.g., user session), not from the client request body, to prevent IDOR vulnerabilities.