safe GraphQL client for non-CLI calling scenarios

[CodePrometheus]

To avoid panic when the caller comes from a non-cli scenario, parameters such as username may not have value, this pr adds relevant checks and default value.

[Copilot]

Pull Request Overview

This PR enhances the GraphQL client to safely handle missing context parameters in non-CLI scenarios by adding type checks and default values.

• Use safe context.Value extraction for Insecure, BaseURL, Username, Password, and Authorization
• Provide a hard-coded default baseURL when none is supplied
• Construct Basic auth header only when both username and password are present

Comments suppressed due to low confidence (1)

pkg/graphql/client/client.go:58

• Add unit tests for scenarios where context values are missing to verify default baseURL, insecure flag handling, and authorization header construction.

if baseURL == "" {

[kezhenxu94]

Actually this GraphQL client is not coupled with CLI, if you are using this client in your MCP server, you should pass the context.Context with the contextkey.Insecure{} set to false

[kezhenxu94]

Example:

ctx := context.Background()
ctx = context.WithValue(ctx, contextkey.Insecure{}, true)
// pass the ctx to the graphql client

[CodePrometheus]

@kezhenxu94 Yeah, I could default Insecure to true/false or make it configurable, I'll revert changes for this parameter. But for the other four parameters validation, let's keep this PR's approach, does this make sense to us?