fix: in mcp mtls logic, check for authorization header case insensitively

httpx internally normalizes HTTP header keys to lowercase, so the check should be case-insensitive

closes #6200

Co-authored-by: Kathy Wu <wukathy@google.com>
PiperOrigin-RevId: 940719476

Author: wukath

src/google/adk/tools/mcp_tool/mcp_session_manager.py

@@ -391,7 +391,7 @@ async def before_request(
         )
         return
 
-    if 'Authorization' in headers:
+    if any(k.lower() == 'authorization' for k in headers):
       logger.debug('Authorization header already present, not overwriting')
       return
 

tests/unittests/tools/mcp_tool/test_mcp_session_manager.py

@@ -1298,6 +1298,28 @@ def mock_refresh(req):
 
     assert headers["Authorization"] == "Bearer refreshed_token"
 
+  @pytest.mark.skipif(not AIO_SUPPORTED, reason="google.auth.aio not supported")
+  @pytest.mark.parametrize(
+      "existing_header_key",
+      ["Authorization", "authorization", "AUTHORIZATION", "authORIZATION"],
+  )
+  @pytest.mark.asyncio
+  async def test_before_request_skips_refresh_if_authorization_header_exists_case_insensitive(
+      self, existing_header_key
+  ):
+    mock_creds = Mock()
+    mock_creds.expired = True
+    mock_creds.token = "new_token"
+    mock_creds.refresh = Mock()
+
+    credentials = _RefreshableAsyncCredentials(mock_creds)
+    headers = {existing_header_key: "Bearer existing_token"}
+
+    await credentials.before_request(None, "GET", "http://example.com", headers)
+
+    mock_creds.refresh.assert_not_called()
+    assert headers == {existing_header_key: "Bearer existing_token"}
+
 
 class TestGoogleAuthAsyncByteStream: