Disable schema endpoint by default

[tobias-tengler]

No description provided.

[Copilot]

Pull request overview

This PR updates Hot Chocolate's default security behavior so schema download endpoints are disabled outside Development by default, and adds tests plus new builder overloads to configure server options with access to IServiceProvider.

Changes:

• Disable EnableSchemaRequests by default when disableDefaultSecurity is not set and the host environment is not Development.
• Add ASP.NET Core and Fusion tests covering development/production defaults and per-endpoint overrides for schema downloads.
• Add ModifyServerOptions overloads that receive IServiceProvider, and remove schema snapshot tests/snapshots tied to internal-directive filtering.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/HotChocolate/Fusion/test/Fusion.AspNetCore.Tests/DefaultSecurityTests.cs	Adds Fusion coverage for schema-request defaults and endpoint overrides.
src/HotChocolate/Fusion/src/Fusion.AspNetCore/DependencyInjection/FusionServerServiceCollectionExtensions.cs	Applies the new default-security schema-request disablement in Fusion.
src/HotChocolate/Fusion/src/Fusion.AspNetCore/DependencyInjection/AspNetCoreFusionGatewayBuilderExtensions.ServerOptions.cs	Adds Fusion server-options overload with IServiceProvider.
src/HotChocolate/AspNetCore/test/AspNetCore.Tests/HttpGetSemanticNonNullSchemaMiddlewareTests.cs	Removes semantic-non-null schema regression test for internal directives.
src/HotChocolate/AspNetCore/test/AspNetCore.Tests/HttpGetSchemaMiddlewareTests.cs	Removes schema SDL regression test for internal directives.
src/HotChocolate/AspNetCore/test/AspNetCore.Tests/DefaultSecurityTests.cs	Adds ASP.NET Core coverage for schema-request defaults and endpoint overrides.
src/HotChocolate/AspNetCore/test/AspNetCore.Tests/__snapshots__/HttpGetSemanticNonNullSchemaMiddlewareTests.Download_GraphQL_SemanticNonNull_Schema_Does_Not_Include_Internal_Directives.snap	Deletes snapshot for internal-directive filtering on semantic-non-null schema output.
src/HotChocolate/AspNetCore/test/AspNetCore.Tests/__snapshots__/HttpGetSchemaMiddlewareTests.Download_GraphQL_Schema_Does_Not_Include_Internal_Directives.snap	Deletes snapshot for internal-directive filtering on schema output.
src/HotChocolate/AspNetCore/test/AspNetCore.Tests.Utilities/ServerTestBase.cs	Sets Development host environment in shared test server helper.
src/HotChocolate/AspNetCore/src/AspNetCore/Extensions/HotChocolateAspNetCoreServiceCollectionExtensions.Http.cs	Adds ASP.NET Core server-options overload with IServiceProvider.
src/HotChocolate/AspNetCore/src/AspNetCore/Extensions/HotChocolateAspNetCoreServiceCollectionExtensions.cs	Applies the new default-security schema-request disablement in ASP.NET Core.
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Formatters/DefaultHttpResponseFormatter.cs	Changes schema/semantic-schema formatting behavior used by download endpoints.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.