feat: Configuration for disabling authorization token passthrough

[swcollard]

Auth in the MCP server works by having the user go through the OAuth flow to obtain an auth token. This auth token is then validated and passed to the upstream API in Tool calls for accessing the resources in that API. There has been a request to not perform this passthrough of validated tokens in the event that the upstream API does not share the same auth methods as the mcp server.

This PR adds an optional new parameter to the config.transport.auth config object, disable_auth_token_passthrough, which is false by default, that when true, will no longer pass through validated Auth tokens to the GraphQL API.

Contains fix for #280

[apollo-librarian]

✅ Docs preview ready

The preview is ready to be viewed. View the preview

File Changes

0 new, 2 changed, 0 removed

* (developer-tools)/apollo-mcp-server/(latest)/config-file.mdx
* (developer-tools)/apollo-mcp-server/(latest)/limitations.mdx

Build ID: a1a783ee498e7520d931c31a
Build Logs: View logs

URL: https://www.apollographql.com/docs/deploy-preview/a1a783ee498e7520d931c31a

[github-actions]

❌ Changeset file missing for PR

All changes should include an associated changeset file.
Please refer to README for more information on generating changesets.

[alocay]

Can we shorten this a bit via:

match transport {
    apollo_mcp_server::server::Transport::STDIO => false,
    _ { auth, .. } => auth.map(...).unwrap_or(false)
}

[swcollard]

I can't quite get this syntax working? I think the match needs the enum name so it can pull the auth values from the struct. And the compiler isn't smart enough to pull it as an 'else' case?

[DaleSeo]

Thanks for taking care of this issue! Could you also update config-file.mdx to include the new setting?

[Copilot]

Pull Request Overview

This PR adds a configuration option to disable authorization token passthrough from the MCP server to upstream GraphQL APIs. This allows users to prevent validated auth tokens from being forwarded when the upstream API uses different authentication methods.

• Added disable_auth_token_passthrough boolean configuration parameter with default value of false
• Modified token propagation logic to respect the new configuration setting
• Updated all relevant structs and initialization code to include the new parameter

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/apollo-mcp-server/src/auth.rs	Added disable_auth_token_passthrough field to auth Config struct
crates/apollo-mcp-server/src/main.rs	Added logic to extract and apply the configuration from transport settings
crates/apollo-mcp-server/src/server.rs	Added parameter to Server struct and builder method
crates/apollo-mcp-server/src/server/states.rs	Added field to internal Config struct and initialization
crates/apollo-mcp-server/src/server/states/starting.rs	Passed configuration to Running state
crates/apollo-mcp-server/src/server/states/running.rs	Added conditional logic to skip token passthrough and updated test data
.changesets/feat_auth_token_passthrough_disable.md	Added changeset documentation

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The config.transport is being cloned unnecessarily. Since it's moved into the builder on line 115, you can use the cloned transport variable instead of cloning again.

Suggested change

	.transport(config.transport)
	.transport(transport)

[Copilot]

The condition logic is duplicated between lines 215-217 and 248-250. Consider extracting this into a helper method to reduce code duplication and improve maintainability.