MCP invocation can replace a valid provider header with Bearer None #7587

Describe the bug

After #7550 made explicit auth headers authoritative over header_provider, an unusable OAuth2 credential can replace a valid provider Authorization header with the literal value Bearer None during MCP tool invocation.

Current main (18a41a543f2db1dd8856b8f887d48d0c4c2ab56e) still has this behavior in McpTool._get_headers():

if credential.oauth2:
  headers = {"Authorization": f"Bearer {credential.oauth2.access_token}"}

The discovery path already avoids this through build_auth_headers(), which only emits an OAuth2 header when access_token is truthy. Invocation therefore diverges again for this edge case:

• discovery: no usable auth header, so the provider header survives;
• invocation: Bearer None is treated as auth and overrides the provider header.

This follow-up is necessary because Copybara imported the earlier #7550 patch as f82aa222, before the final PR revision added the empty-token guard and regression test.

Reproduction

credential = AuthCredential(
    auth_type=AuthCredentialTypes.OAUTH2,
    oauth2=OAuth2Auth(access_token=None),
)

auth_headers = await McpTool._get_headers(tool, tool_context, credential)
merged = _merge_auth_and_provider_headers(
    auth_headers=auth_headers,
    provider_headers={"Authorization": "Bearer provider-token"},
)

assert auth_headers == {"Authorization": "Bearer None"}
assert merged == {"Authorization": "Bearer None"}

The same result is reproducible on current main.

Expected behavior

An OAuth2 credential without an access token is not usable auth and should not emit an Authorization header. The valid provider header should remain in effect, matching the discovery path.

Proposed fix

Require a truthy credential.oauth2.access_token before building the OAuth2 header in McpTool._get_headers(), and add a regression test at the create_session() boundary.

Related changes

• MCP tool discovery and invocation apply opposite precedence to auth and provider headers #7548 / fix(mcp): align auth and provider header precedence #7550: unified auth/provider precedence.
• 7fca46f1: rejects unredeemed authorization-code credentials, but does not cover an empty-token credential without an auth code or one returned by a custom auth provider.