Internal projection selections trigger authorization and leak into error paths #9939

Product

Hot Chocolate

Version

16.1.4

Link to minimal reproduction

https://github.com/drapka/hc-v16-internal-selection-leakage/blob/main/repro-hc-v16-internal-selection-leakage.cs

Steps to reproduce

• Clone the repro repository
• Run dotnet repro-hc-v16-internal-selection-leakage.cs from the project root

What is expected?

A query that does not select an [Authorize]d, [IsProjected] field should not trigger that field's authorization policy, and errors[].path should never contain HotChocolate-internal field names (_combinedSelectionSet, __projection_alias_N).

For the repro: { items { items { id name } } } should return { "data": { "items": { "items": [{ "id": 1, "name": "ok" }] } } } with no errors.

What is actually happening?

A query that selects only id and name triggers authorization on Secret (which the client never asked for) and returns errors whose path contains field names the client never wrote (_combinedSelectionSet, __projection_alias_0):

  {
    "errors": [
      { "message": "Unexpected Execution Error",
        "path": ["items", "_combinedSelectionSet", 0, "__projection_alias_0"] },
      { "message": "Unexpected Execution Error",
        "path": ["items", "items",                 0, "__projection_alias_0"] }
    ],
    "data": { "items": { "items": null } }
  }

Relevant log output

{
  "errors": [
    {
      "message": "Unexpected Execution Error",
      "path": [
        "items",
        "_combinedSelectionSet",
        0,
        "__projection_alias_0"
      ]
    },
    {
      "message": "Unexpected Execution Error",
      "path": [
        "items",
        "items",
        0,
        "__projection_alias_0"
      ]
    }
  ],
  "data": {
    "items": {
      "items": null
    }
  }
}

Additional context

This worked correctly pre-v16.