Module cache 

Per-(upstream, subject) AuthClient cache.

Each entry binds one MCP upstream and one subject to a single AuthClient<reqwest::Client> so tokens are never shared between users. Entries are built lazily on first use via the upstream’s UpstreamOauthManager, cached by (upstream_name, subject), and invalidated when the upstream’s OAuth registration changes (e.g. client_id rotation) or when the upstream is removed from config at reload time.

Intended to be injected into both a gateway’s lifecycle/reload manager (for eviction during config reload) and its per-request connection pool (for per-request lookup from MCP handlers), keeping this cache decoupled from either — it needs no reference to a gateway or pool type.

Structs

CachedAuthClient

A cached AuthClient plus the OAuth-registration fingerprint it was built from. When the current config’s fingerprint differs, the entry is evicted and rebuilt so a stale client_id never signs a request.

OauthClientCache