fix: pass $select when fetching group members to prevent sparse objects

Without $select, Microsoft Graph returns only id and @odata.type for
group members, which causes defaultUserTransformer/defaultGroupTransformer
to return undefined and silently drop membership refs. Requesting the
minimum fields needed by both transformers ensures member objects always
have enough data to produce stable entity refs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: pillaris <pillaris@adobe.com>

plugins/catalog-backend-module-msgraph-incremental/src/MicrosoftGraphIncrementalEntityProvider.test.ts

@@ -586,6 +586,17 @@ describe('MicrosoftGraphIncrementalEntityProvider', () => {
       expect(groupEntity!.entity.spec?.members).toContain(
         'user:default/alice_example.com',
       );
+      // Verify $select is passed so member objects are never sparse
+      expect(mockClient.getGroupMembers).toHaveBeenCalledWith(
+        'grp-1',
+        expect.objectContaining({
+          select: expect.arrayContaining([
+            'id',
+            'displayName',
+            'userPrincipalName',
+          ]),
+        }),
+      );
     });
 
     it('populates spec.children with nested group refs from getGroupMembers', async () => {

plugins/catalog-backend-module-msgraph-incremental/src/MicrosoftGraphIncrementalEntityProvider.ts

@@ -429,6 +429,17 @@ export class MicrosoftGraphIncrementalEntityProvider
 
           for await (const member of client.getGroupMembers(group.id!, {
             top: GROUP_PAGE_SIZE,
+            // Request the minimum fields needed by defaultUserTransformer and
+            // defaultGroupTransformer so member objects are never sparse.
+            select: [
+              'id',
+              'displayName',
+              'mail',
+              'mailNickname',
+              'userPrincipalName',
+              'description',
+              'securityEnabled',
+            ],
           })) {
             if (member['@odata.type'] === '#microsoft.graph.user') {
               try {