fix(mcp): ignore OAuth credentials without access tokens

[CorgiBoyG]

Link to Issue or Description of Change

• Closes: MCP invocation can replace a valid provider header with Bearer None #7587
• Follow-up to: fix(mcp): align auth and provider header precedence #7550

Problem:

After #7550 made explicit auth headers authoritative, McpTool._get_headers() can still emit the literal header Authorization: Bearer None when an OAuth2 credential object exists without an access token. That invalid auth header then overrides a valid header_provider value during invocation, while discovery correctly keeps the provider header.

Copybara imported the earlier #7550 patch as f82aa222 before its final revision added this guard and regression coverage.

Solution:

Keep OAuth2 field precedence while constructing an Authorization header only when access_token is non-empty. An empty-token OAuth2 credential therefore contributes no auth header and cannot fall through to an unrelated or stale HTTP credential on the same object, allowing the existing provider header to remain effective.

The change is deliberately limited to the OAuth2 guard and one regression test at the MCP session-creation boundary.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All relevant unit tests pass locally.

The regression test fails on current main with:

Actual: create_session(headers={'Authorization': 'Bearer None'})

After the fix:

pytest -q -p no:cacheprovider tests/unittests/tools/mcp_tool
441 passed

pytest -q -p no:cacheprovider tests/unittests/tools tests/unittests/auth
3478 passed, 1 skipped

Also verified:

OAuth2/HTTP credential combinations: 15 checked, 0 mismatches against build_auth_headers()
pyink --check: passed
ruff check: passed
git diff --check: passed

The full repository test suite was not run.

Manual End-to-End (E2E) Tests:

Not run. The regression test asserts the final headers passed to create_session().

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• The changed condition is self-explanatory; no additional code comment is required.
• I have added a test that proves the fix is effective.
• Relevant MCP and auth unit tests pass locally.
• I have manually tested my changes end-to-end.
• No downstream dependency changes are required.

Additional context

The later credential-manager fix in 7fca46f1 rejects an unredeemed authorization-code credential, but it does not cover an empty-token credential without an auth code or one returned by a custom auth provider. Guarding header construction remains necessary at this boundary.

[CorgiBoyG]

Updated the branch after an additional credential-path review. The guard now keeps OAuth2 field precedence while checking access_token within that branch, so an empty OAuth2 credential cannot fall through to a stale HTTP credential on the same object. The regression test now covers this mixed-field case.

Validation on the updated commit:

• MCP unit tests: 441 passed
• tools/auth unit tests: 3478 passed, 1 skipped
• OAuth2/HTTP credential combinations: 15 checked, 0 mismatches against build_auth_headers()
• Pyink, Ruff, and git diff --check: passed

The full repository test suite was not run.

[adk-bot]

Thank you @CorgiBoyG for your contribution! 🎉

Your changes have been successfully imported and merged via Copybara in commit dc78d0a.

Closing this PR as the changes are now in the main branch.