Fix object-list filter preflight plan traversal and argument identification

ObjectListFilter フィルターリクエストの preflight と実行可能プランの走査から始め、その後、コンテキストを把握するためにリンクされた pull request の議論を確認します。deferred、streamed、live、nested のコレクションプランを追跡し、包含状態の処理と、middleware によって追加された nullable な ObjectListFilter 引数の識別を検証します。wrapped および nested フィルターが coercion され、除外された、または無関係なフィルター引数が受け入れられれば完了です。

Description

The object-list filter request preflight does not accurately follow the executable plan and can both miss invalid filters and reject valid requests.

The preflight should traverse deferred, streamed, live, and nested collection plans while only coercing the nullable ObjectListFilter argument added by the object-list filter middleware.

Source: https://github.com/fsprojects/FSharp.Data.GraphQL/pull/612#pullrequestreview-5253463363

Repro steps

1. Execute a query where an object-list filter is inside an @defer, @stream, or @live wrapper, or inside a nested collection element plan.

2. Observe that request-level filter coercion can be bypassed.

3. Execute a query containing an excluded subtree or an unrelated field with an argument such as filter: String.

4. Observe that the preflight can treat that argument as the middleware's object-list filter and reject an otherwise valid request.

Expected behavior

The preflight should:

• traverse @defer, @stream, and @live wrappers transparently;
• traverse collection element plans and nested filtered fields;
• skip nodes excluded by execution directives;
• coerce only fields whose definition contains the middleware-added nullable ObjectListFilter argument.

Actual behavior

The traversal stops at wrappers and collection element plans, allowing wrapped or nested list filters to bypass request-level coercion. It also ignores inclusion state and identifies arguments by the name filter, which can incorrectly reject excluded subtrees or unrelated filter arguments.

Known workarounds

Avoid wrapping or nesting object-list-filtered fields and avoid unrelated arguments named filter. These are not practical general-purpose workarounds.

Related information

• Operating system: All
• Branch: dev / observed while reviewing task-seq-field-streaming-fixes
• .NET Runtime, CoreCLR or Mono Version: .NET 10
• Performance information, links to performance testing scripts: N/A