Struct OAuthPassthroughAuth 

pub struct OAuthPassthroughAuth { /* private fields */ }

OAuth passthrough — forwards the INCOMING MCP client token to the backend (H1).

PER-REQUEST: prefers the per-request inbound_token arg to apply; falls back to the construction-time captured incoming_token (via create_passthrough_auth_provider). When neither is present and the config is required, apply returns HttpConnectorError::Auth.

Trust boundary (WR-04)

This provider relays a client-controlled value into an operator-controlled destination — the trust posture is intentional and must stay visible at the type:

• The MCP client controls the forwarded token VALUE: it is the raw inbound Authorization header captured by TokenCaptureAuthProvider and forwarded verbatim (bare tokens are prefixed with Bearer in apply).
• The operator controls the destination header NAME (target_header), fixed in the committed config; the client cannot redirect the token to a different header.

Relaying the client’s own credential to the backend is the intended SSO-passthrough behavior — use it only when the backend should receive the MCP client’s own identity. The HeaderValue::try_from control-character rejection in apply is the protection against header injection; a malformed token value is rejected, not relayed.

Trait Implementations

impl HttpAuthProvider for OAuthPassthroughAuth

fn apply<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, headers: &'life1 mut HeaderMap, _query: &'life2 mut HashMap<String, String>, inbound_token: Option<&'life3 str>, ) -> Pin<Box<dyn Future<Output = Result<(), HttpConnectorError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Apply credentials to the outgoing request’s headers and query.