From 957e0982c16b71801d8d6816b805e5fa87325ee2 Mon Sep 17 00:00:00 2001
From: Denis Mishin <dmishin@pomerium.com>
Date: Wed, 28 May 2025 13:20:02 -0700
Subject: [PATCH] mcp: fix upstream client access token (#5626)

## Summary

the `mcp: pass_upstream_access_token` option should take effect even if
no upstream oauth config is set.

## Related issues

<!-- For example...
- #159
-->

## User Explanation

<!-- How would you explain this change to the user? If this
change doesn't create any user-facing changes, you can leave
this blank. If filled out, add the `docs` label -->

## Checklist

- [ ] reference any related issues
- [ ] updated unit tests
- [ ] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review
---
 config/policy.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/policy.go b/config/policy.go
index 22c2fa97c..c81c0831d 100644
--- a/config/policy.go
+++ b/config/policy.go
@@ -224,7 +224,7 @@ func (p *MCP) HasUpstreamOAuth2() bool {
 
 // IsUpstreamClientNeedsAccessToken checks if the route is for the MCP Client and if it needs to pass the upstream access token
 func (p *MCP) IsUpstreamClientNeedsAccessToken() bool {
-	return p != nil && p.UpstreamOAuth2 != nil && p.PassUpstreamAccessToken
+	return p != nil && p.PassUpstreamAccessToken
 }
 
 type UpstreamOAuth2 struct {