refactor(mcp): use Envoy Gateway's ClaimToHeader type

Replace the custom ClaimToHeader type definition with egv1a1.ClaimToHeader
to reduce code duplication between AI Gateway and Envoy Gateway.

fix codegen to append license header

Signed-off-by: Matthieu Paret <mp@blackfuel.ai>

Author: mtparet

Makefile

@@ -122,20 +122,20 @@ codegen: ## Generate typed client, listers, and informers for the API.
 		--clientset-name="versioned" \
 		--input-base="" \
 		--input="github.com/envoyproxy/ai-gateway/api/v1alpha1" \
-		--go-header-file=/dev/null \
+		--go-header-file=hack/boilerplate.go.txt \
 		--output-dir="./api/v1alpha1/client/clientset" \
 		--output-pkg="github.com/envoyproxy/ai-gateway/api/v1alpha1/client/clientset" \
 		--plural-exceptions="BackendSecurityPolicy:BackendSecurityPolicies"
 	@echo "codegen => generating listers..."
 	@$(GO_TOOL) lister-gen \
-		--go-header-file=/dev/null \
+		--go-header-file=hack/boilerplate.go.txt \
 		--output-dir="./api/v1alpha1/client/listers" \
 		--output-pkg="github.com/envoyproxy/ai-gateway/api/v1alpha1/client/listers" \
 		--plural-exceptions="BackendSecurityPolicy:BackendSecurityPolicies" \
 		"github.com/envoyproxy/ai-gateway/api/v1alpha1"
 	@echo "codegen => generating informers..."
 	@$(GO_TOOL) informer-gen \
-		--go-header-file=/dev/null \
+		--go-header-file=hack/boilerplate.go.txt \
 		--versioned-clientset-package="github.com/envoyproxy/ai-gateway/api/v1alpha1/client/clientset/versioned" \
 		--listers-package="github.com/envoyproxy/ai-gateway/api/v1alpha1/client/listers" \
 		--output-dir="./api/v1alpha1/client/informers" \

api/v1alpha1/mcp_route.go

@@ -259,28 +259,7 @@ type MCPRouteOAuth struct {
 	// +kubebuilder:validation:Optional
 	// +kubebuilder:validation:MaxItems=16
 	// +optional
-	ClaimToHeaders []ClaimToHeader `json:"claimToHeaders,omitempty"`
-}
-
-// ClaimToHeader defines a mapping from a JWT claim to an HTTP header.
-type ClaimToHeader struct {
-	// Claim is the JWT claim name to extract. Supports nested claims using dot notation
-	// (e.g., "realm_access.roles", "resource_access.my-client.roles").
-	// For array claims, the values will be JSON-encoded in the header.
-	//
-	// +kubebuilder:validation:Required
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:MaxLength=256
-	Claim string `json:"claim"`
-
-	// Header is the HTTP header name to forward the claim value as.
-	// The header name should follow HTTP header naming conventions.
-	//
-	// +kubebuilder:validation:Required
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:MaxLength=256
-	// +kubebuilder:validation:Pattern=`^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?$`
-	Header string `json:"header"`
+	ClaimToHeaders []egv1a1.ClaimToHeader `json:"claimToHeaders,omitempty"`
 }
 
 // MCPRouteAuthorization defines the authorization configuration for a MCPRoute.

api/v1alpha1/zz_generated.deepcopy.go

@@ -148,12 +148,7 @@ func (c *MCPRouteController) ensureSecurityPolicy(ctx context.Context, mcpRoute
 		// Add ClaimToHeaders to extract JWT claims and set them as HTTP headers.
 		// Envoy's JWT filter will extract these claims and add them to the request headers,
 		// which can then be forwarded to backend MCP servers.
-		for _, ctoh := range oauth.ClaimToHeaders {
-			jwtProvider.ClaimToHeaders = append(jwtProvider.ClaimToHeaders, egv1a1.ClaimToHeader{
-				Claim:  ctoh.Claim,
-				Header: ctoh.Header,
-			})
-		}
+		jwtProvider.ClaimToHeaders = append(jwtProvider.ClaimToHeaders, oauth.ClaimToHeaders...)
 
 		securityPolicySpec.JWT = &egv1a1.JWT{
 			Providers: []egv1a1.JWTProvider{jwtProvider},

internal/controller/mcp_route_security_policy.go

@@ -586,7 +586,7 @@ func TestMCPRouteController_syncMCPRouteSecurityPolicy_ClaimToHeaders(t *testing
 					ProtectedResourceMetadata: aigv1a1.ProtectedResourceMetadata{
 						Resource: "https://api.example.com/mcp",
 					},
-					ClaimToHeaders: []aigv1a1.ClaimToHeader{
+					ClaimToHeaders: []egv1a1.ClaimToHeader{
 						{Claim: "sub", Header: "X-User-Id"},
 						{Claim: "email", Header: "X-User-Email"},
 						{Claim: "realm_access.roles", Header: "X-User-Roles"},

internal/controller/mcp_route_security_policy_test.go

@@ -3240,24 +3240,18 @@ spec:
                           - Only the specified claims are extracted; the full JWT is not forwarded to backends
                           - Consider using a header prefix (e.g., "X-Jwt-Claim-") to avoid conflicts with other headers
                         items:
-                          description: ClaimToHeader defines a mapping from a JWT
-                            claim to an HTTP header.
+                          description: ClaimToHeader defines a configuration to convert
+                            JWT claims into HTTP headers
                           properties:
                             claim:
                               description: |-
-                                Claim is the JWT claim name to extract. Supports nested claims using dot notation
-                                (e.g., "realm_access.roles", "resource_access.my-client.roles").
-                                For array claims, the values will be JSON-encoded in the header.
-                              maxLength: 256
-                              minLength: 1
+                                Claim is the JWT Claim that should be saved into the header : it can be a nested claim of type
+                                (eg. "claim.nested.key", "sub"). The nested claim name must use dot "."
+                                to separate the JSON name path.
                               type: string
                             header:
-                              description: |-
-                                Header is the HTTP header name to forward the claim value as.
-                                The header name should follow HTTP header naming conventions.
-                              maxLength: 256
-                              minLength: 1
-                              pattern: ^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?$
+                              description: Header defines the name of the HTTP request
+                                header that the JWT Claim will be saved into.
                               type: string
                           required:
                           - claim

manifests/charts/ai-gateway-crds-helm/templates/aigateway.envoyproxy.io_mcproutes.yaml

@@ -96,6 +96,52 @@ func TestMCPRouteOAuth(t *testing.T) {
 		t.Logf("Successfully connected with valid token and retrieved %d tools", len(tools.Tools))
 	})
 
+	t.Run("claim headers forwarded to backend", func(t *testing.T) {
+		// This test validates that JWT claims configured via claimToHeaders are extracted
+		// and forwarded to the backend MCP server. The backend has TEST_EXPECTED_CLAIM_HEADERS
+		// set, so its middleware will reject any request missing the expected claim headers.
+		validToken := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.NHVaYe26MbtOYhSKkoKYdFVomg4i8ZJd8_-RU8VNbftc4TSMb4bXP3l3YlNWACwyXPGffz5aXHc6lty1Y2t4SWRqGteragsVdZufDn5BlnJl9pdR_kdVFUsra2rWKEofkZeIC4yWytE58sMIihvo9H1ScmmVwBcQP6XETqYd0aSHp1gOa9RdUPDvoXQ5oqygTqVtxaDr6wUFKrKItgBMzWIdNZ6y7O9E0DhEPTbE9rfBo6KTFsHAZnMg4k68CDp2woYIaXbmYTWcvbzIuHO7_37GT79XdIwkm95QJ7hYC9RiwrV7mesbY4PAahERJawntho0my942XheVLmGwLMBkQ" //nolint:gosec // Test JWT token
+
+		authHTTPClient := &http.Client{
+			Timeout: 10 * time.Second,
+			Transport: &mcpAuthTransport{
+				token: validToken,
+				base:  http.DefaultTransport,
+			},
+		}
+
+		client := mcp.NewClient(&mcp.Implementation{Name: "demo-http-client", Version: "0.1.0"}, nil)
+		ctx, cancel := context.WithTimeout(t.Context(), 30*time.Second)
+		t.Cleanup(cancel)
+
+		var sess *mcp.ClientSession
+		require.Eventually(t, func() bool {
+			var err error
+			sess, err = client.Connect(
+				ctx,
+				&mcp.StreamableClientTransport{
+					Endpoint:   fmt.Sprintf("%s/mcp", fwd.Address()),
+					HTTPClient: authHTTPClient,
+				}, nil)
+			if err != nil {
+				t.Logf("failed to connect to MCP server: %v", err)
+				return false
+			}
+			return true
+		}, 30*time.Second, 100*time.Millisecond, "failed to connect to MCP server")
+		t.Cleanup(func() { _ = sess.Close() })
+
+		// Call the echo tool — if claim headers are missing or wrong, the backend
+		// middleware will reject the request and this call will fail.
+		result, err := sess.CallTool(ctx, &mcp.CallToolParams{
+			Name:      "echo",
+			Arguments: map[string]interface{}{"message": "claim-header-test"},
+		})
+		require.NoError(t, err)
+		require.False(t, result.IsError, "echo tool should succeed when claim headers are forwarded")
+		t.Logf("echo tool result: %+v", result)
+	})
+
 	t.Run("without token using MCP client", func(t *testing.T) {
 		// Create an MCP client and connect to the server over Streamable HTTP.
 		client := mcp.NewClient(&mcp.Implementation{Name: "demo-http-client", Version: "0.1.0"}, nil)

tests/e2e/mcp_route_oauth_test.go

@@ -50,6 +50,11 @@ spec:
             group: ""
             kind: ConfigMap
             name: jwks-configmap
+      claimToHeaders:
+        - claim: sub
+          header: x-jwt-claim-sub
+        - claim: name
+          header: x-jwt-claim-name
       protectedResourceMetadata:
         resource: "https://foo.bar.com/mcp"
         resourceName: "example-resource"
@@ -109,6 +114,9 @@ spec:
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 1063
+          env:
+            - name: TEST_EXPECTED_CLAIM_HEADERS
+              value: "x-jwt-claim-sub=1234567890,x-jwt-claim-name=John Doe"
 ---
 apiVersion: v1
 kind: Service

tests/e2e/testdata/mcp_route_oauth.yaml

@@ -103,6 +103,29 @@ func NewServer(opts *Options) (*http.Server, *mcp.Server) {
 		})
 	}
 
+	// Setup claim header validation when environment variable TEST_EXPECTED_CLAIM_HEADERS is set.
+	// Format: "header1=value1,header2=value2"
+	expectedClaimHeaders := os.Getenv("TEST_EXPECTED_CLAIM_HEADERS")
+	if expectedClaimHeaders != "" {
+		expected := map[string]string{}
+		for _, pair := range strings.Split(expectedClaimHeaders, ",") {
+			k, v, ok := strings.Cut(pair, "=")
+			if ok {
+				expected[k] = v
+			}
+		}
+		s.AddReceivingMiddleware(func(handler mcp.MethodHandler) mcp.MethodHandler {
+			return func(ctx context.Context, method string, req mcp.Request) (mcp.Result, error) {
+				for header, value := range expected {
+					if got := req.GetExtra().Header.Get(header); got != value {
+						return nil, fmt.Errorf("expected header %q=%q, got %q", header, value, got)
+					}
+				}
+				return handler(ctx, method, req)
+			}
+		})
+	}
+
 	s.AddPrompt(CodeReviewPrompt, codReviewPromptHandler)
 	s.AddResource(DummyResource, DummyResourceHandler())
 	s.AddResourceTemplate(DummyResourceTemplate, DummyResourceHandler())