[Fusion] Add FusionRequestOptions.AllowOperationPlanRequests

[tobias-tengler]

No description provided.

[Copilot]

Pull request overview

Adds an opt-in request option to control whether a client can request the Fusion operation plan to be emitted into the GraphQL response (via the Fusion-Operation-Plan header), and covers the behavior with new security snapshots/tests.

Changes:

• Introduces FusionRequestOptions.AllowOperationPlanRequests (default false) and plumbs it into request execution.
• Gates emission of extensions.fusion.operationPlan on both the request header and the new option.
• Adds/updates Fusion ASP.NET Core security tests + snapshots to validate allowed/denied/header-missing cases.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/HotChocolate/Fusion/src/Fusion.Execution/Execution/FusionRequestOptions.cs	Adds AllowOperationPlanRequests option and ensures it’s copied in Clone().
src/HotChocolate/Fusion/src/Fusion.Execution/Execution/Extensions/FusionRequestContextExtensions.cs	Adds a RequestContext extension to access the new option.
src/HotChocolate/Fusion/src/Fusion.Execution/Execution/OperationPlanContext.cs	Prevents operation plan serialization into response extensions unless requests are allowed.
src/HotChocolate/Fusion/test/Fusion.AspNetCore.Tests/FusionTestBase.cs	Enables operation plan requests for the shared test gateway setup.
src/HotChocolate/Fusion/test/Fusion.AspNetCore.Tests/DefaultSecurityTests.cs	Adds tests verifying operation plan inclusion/omission based on header + option.
src/HotChocolate/Fusion/test/Fusion.AspNetCore.Tests/snapshots/DefaultSecurityTests.OperationPlanHeader_When_Allowed_Should_Include_OperationPlan.snap	Snapshot for allowed + header present (expects operation plan in extensions).
src/HotChocolate/Fusion/test/Fusion.AspNetCore.Tests/snapshots/DefaultSecurityTests.OperationPlanHeader_When_Not_Allowed_Should_Omit_OperationPlan.snap	Snapshot for disallowed + header present (expects no operation plan).
src/HotChocolate/Fusion/test/Fusion.AspNetCore.Tests/snapshots/DefaultSecurityTests.NoOperationPlanHeader_When_Allowed_Should_Omit_OperationPlan.snap	Snapshot for allowed + header absent (expects no operation plan).
src/HotChocolate/Fusion/test/Fusion.Execution.Tests/Execution/Serialization/snapshots/JsonOperationPlanSerializationTests.Parse_Plan_Preserves_DeliveryGroup_Identity_Across_Plan_And_SubPlans.snap	Adds serialization snapshot coverage for delivery group identity across plan/subplans.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.