Fix workspace hydratation (#12452)

We must separate the concept of hydratation which happens at the request
level (take the token and pass auth/user context), from the concept of
authorization which happens at the query/endpoint/mutation level.

Previously, hydratation exemption happened at the operation name level
which is not correct because the operation name is meaningless and
optional. Still this gave an impression of security by enforcing a
blacklist. So in this PR we introduce linting rule that aim to achieve a
similar behavior, now every api method has to have a guard. That way if
and endpoint is not protected by AuthUserGuard or AuthWorspaceGuard,
then it has to be stated explicitly next to its code.

---------

Co-authored-by: Charles Bochet <charles@twenty.com>

tools/eslint-rules/utils/createRule.ts

@@ -0,0 +1,3 @@
+import { ESLintUtils } from '@typescript-eslint/utils';
+
+export const createRule = ESLintUtils.RuleCreator(() => __filename); 

tools/eslint-rules/utils/typedTokenHelpers.ts

@@ -0,0 +1,56 @@
+import { TSESTree } from '@typescript-eslint/utils';
+
+export const typedTokenHelpers = {
+  nodeHasDecoratorsNamed(
+    node: TSESTree.MethodDefinition | TSESTree.ClassDeclaration,
+    decoratorNames: string[]
+  ): boolean {
+    if (!node.decorators) {
+      return false;
+    }
+
+    return node.decorators.some((decorator) => {
+      if (decorator.expression.type === TSESTree.AST_NODE_TYPES.Identifier) {
+        return decoratorNames.includes(decorator.expression.name);
+      }
+      
+      if (decorator.expression.type === TSESTree.AST_NODE_TYPES.CallExpression) {
+        const callee = decorator.expression.callee;
+        if (callee.type === TSESTree.AST_NODE_TYPES.Identifier) {
+          return decoratorNames.includes(callee.name);
+        }
+      }
+
+      return false;
+    });
+  },
+
+  nodeHasAuthGuards(
+    node: TSESTree.MethodDefinition | TSESTree.ClassDeclaration
+  ): boolean {
+    if (!node.decorators) {
+      return false;
+    }
+
+    return node.decorators.some((decorator) => {
+      // Check for @UseGuards() call expression
+      if (
+        decorator.expression.type === TSESTree.AST_NODE_TYPES.CallExpression &&
+        decorator.expression.callee.type === TSESTree.AST_NODE_TYPES.Identifier &&
+        decorator.expression.callee.name === 'UseGuards'
+      ) {
+        // Check the arguments for UserAuthGuard, WorkspaceAuthGuard, or PublicEndpoint
+        return decorator.expression.arguments.some((arg) => {
+          if (arg.type === TSESTree.AST_NODE_TYPES.Identifier) {
+            return arg.name === 'UserAuthGuard' || 
+                   arg.name === 'WorkspaceAuthGuard' || 
+                   arg.name === 'PublicEndpointGuard';
+          }
+          return false;
+        });
+      }
+
+      return false;
+    });
+  },
+};