From ec3c9c4a817c04d9cb68bd92584599166bc2a35a Mon Sep 17 00:00:00 2001 From: Vegar Sechmann Molvig Date: Fri, 23 Oct 2026 12:34:21 +0200 Subject: [PATCH] test(mcp): cover secrets in named fragments --- internal/mcp/tools/graphql_validation_test.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/internal/mcp/tools/graphql_validation_test.go b/internal/mcp/tools/graphql_validation_test.go index 4571fb43..f7fa33bc 100644 --- a/internal/mcp/tools/graphql_validation_test.go +++ b/internal/mcp/tools/graphql_validation_test.go @@ -60,6 +60,12 @@ func TestValidateQueryDocument(t *testing.T) { `, wantErr: "field 'secrets' returns type 'SecretConnection'", }, + { + // https://github.com/nais/cli/issues/803 + name: "deployment key accessed through named fragment is refused", + query: `query { team(slug: "a") { ...TeamFields } } fragment TeamFields on Team { deploymentKey { key } }`, + wantErr: "field 'deploymentKey' returns type 'DeploymentKey'", + }, { name: "fragment on forbidden type is refused", query: `query { team(slug: "a") { secrets(first: 1) { nodes { ...S } } } } fragment S on Secret { name }`,