[Fusion] Fail composition when a field reads protected fields without their authorization requirements

[michaelstaib]

Ticket: hc-fork-2-hdw.4 (Transitive require access check)

Stacked on #29. This PR's diff is against mst/auth-interface-inheritance.

New post-merge rule AuthorizationTransitiveRequirementsRule. It is a hard composition error that blocks data leaking through dependencies (the class of Apollo advisory GHSA-m8jr-fxqx-8xx6).

What counts as a dependency, walked with the FieldSelectionMap parser:

• @require selections, on fields and on arguments, including nested selections, fragments, choices and object construction.
• Lookup keys.

How coverage is checked:

• Checks run against the canonical, flattened requirements that [Fusion] Inherit authorization requirements across interfaces, types and return types during composition #29 produces.
• Every OR-branch of the requiring field must be a superset of some OR-branch of the dependency.
• @authenticated on a dependency requires @authenticated on the requiring field.
• Lookups that return a union or an interface are checked against each possible type, including nested type-conditioned choices.

The error message names the requiring coordinate, the uncovered dependency, the coordinate it was reached through, and the schema. The new code is documented in composition.md.

Needs a planner ruling (comment 271), which could change behavior. The ticket counts lookup keys as dependencies but excludes @is, and a lookup's key comes from its @is argument. The implementer chose this:

• Lookup keys are dependencies of every field the lookup's schema serves on the entity.
• They count only for key fields that another schema also serves.
• @is selections are not walked as a dependency of the lookup field itself.

The reviewer also flagged a risk. Under the #29 rule, protecting id on one Node type also protects Node.id. Combined with node(id:) @lookup, that may require every field served by any schema with a Node lookup to carry that protection. This was not exercised.

Verified:

• dotnet build src/All.slnx: 0 errors.
• Fusion.Composition.Tests: 3624/3624.
• Fusion.Composition.ApolloFederation.Tests: 240/240.
• FusionAuthorizationDirectiveTests: 20/20.
• Nitro CLI Fusion command tests: 1928/1928.

These ran before I rebased onto the docs-only #29 commit 2c04c80. The rebase was clean.

Minor review notes, not fixed:

• The @is exclusion test passes under either interpretation.
• There is no passing (covered) test for a @require choice or fragment.
• Choice expansion inside object selections grows exponentially with the number of choice fields in one map.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.