@azure/msal-common 11.0.0 → 12.1.0

package/dist/cache/CacheManager.js

@@ -1,13 +1,13 @@
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.1.0 2023-04-18 */
 'use strict';
-import { __awaiter, __generator, __extends } from '../_virtual/_tslib.js';
-import { Constants, CredentialType, AuthenticationScheme, CacheSchemaType, THE_FAMILY_ID, APP_METADATA, AUTHORITY_METADATA_CONSTANTS } from '../utils/Constants.js';
-import { CredentialEntity } from './entities/CredentialEntity.js';
+import { __awaiter, __generator, __assign, __extends } from '../_virtual/_tslib.js';
+import { Separators, CredentialType, AuthenticationScheme, THE_FAMILY_ID, APP_METADATA, AUTHORITY_METADATA_CONSTANTS } from '../utils/Constants.js';
 import { ScopeSet } from '../request/ScopeSet.js';
 import { AccountEntity } from './entities/AccountEntity.js';
 import { AuthError } from '../error/AuthError.js';
 import { ClientAuthError } from '../error/ClientAuthError.js';
 import { AuthToken } from '../account/AuthToken.js';
+import { name, version } from '../packageMetadata.js';
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17,35 +17,59 @@ import { AuthToken } from '../account/AuthToken.js';
  * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
  */
 var CacheManager = /** @class */ (function () {
-    function CacheManager(clientId, cryptoImpl) {
+    function CacheManager(clientId, cryptoImpl, logger) {
         this.clientId = clientId;
         this.cryptoImpl = cryptoImpl;
+        this.commonLogger = logger.clone(name, version);
     }
     /**
      * Returns all accounts in cache
      */
     CacheManager.prototype.getAllAccounts = function () {
         var _this = this;
-        var currentAccounts = this.getAccountsFilteredBy();
-        var accountValues = Object.keys(currentAccounts).map(function (accountKey) { return currentAccounts[accountKey]; });
-        var numAccounts = accountValues.length;
-        if (numAccounts < 1) {
+        var allAccountKeys = this.getAccountKeys();
+        if (allAccountKeys.length < 1) {
+            return [];
+        }
+        var accountEntities = allAccountKeys.reduce(function (accounts, key) {
+            var entity = _this.getAccount(key);
+            if (!entity) {
+                return accounts;
+            }
+            accounts.push(entity);
+            return accounts;
+        }, []);
+        if (accountEntities.length < 1) {
             return [];
         }
         else {
-            var allAccounts = accountValues.map(function (value) {
-                var accountEntity = CacheManager.toObject(new AccountEntity(), value);
-                var accountInfo = accountEntity.getAccountInfo();
-                var idToken = _this.readIdTokenFromCache(_this.clientId, accountInfo);
-                if (idToken && !accountInfo.idTokenClaims) {
-                    accountInfo.idToken = idToken.secret;
-                    accountInfo.idTokenClaims = new AuthToken(idToken.secret, _this.cryptoImpl).claims;
-                }
-                return accountInfo;
+            var allAccounts = accountEntities.map(function (accountEntity) {
+                return _this.getAccountInfoFromEntity(accountEntity);
             });
             return allAccounts;
         }
     };
+    /**
+     * Gets accountInfo object based on provided filters
+     */
+    CacheManager.prototype.getAccountInfoFilteredBy = function (accountFilter) {
+        var allAccounts = this.getAccountsFilteredBy(accountFilter);
+        if (allAccounts.length > 0) {
+            return this.getAccountInfoFromEntity(allAccounts[0]);
+        }
+        else {
+            return null;
+        }
+    };
+    CacheManager.prototype.getAccountInfoFromEntity = function (accountEntity) {
+        var accountInfo = accountEntity.getAccountInfo();
+        var idToken = this.getIdToken(accountInfo);
+        if (idToken) {
+            accountInfo.idToken = idToken.secret;
+            accountInfo.idTokenClaims = new AuthToken(idToken.secret, this.cryptoImpl).claims;
+        }
+        return accountInfo;
+    };
     /**
      * saves a cache record
      * @param cacheRecord
@@ -87,12 +111,12 @@ var CacheManager = /** @class */ (function () {
      */
     CacheManager.prototype.saveAccessToken = function (credential) {
         return __awaiter(this, void 0, void 0, function () {
-            var currentTokenCache, currentScopes, currentAccessTokens, removedAccessTokens_1;
+            var accessTokenFilter, tokenKeys, currentScopes, removedAccessTokens;
             var _this = this;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        currentTokenCache = this.getCredentialsFilteredBy({
+                        accessTokenFilter = {
                             clientId: credential.clientId,
                             credentialType: credential.credentialType,
                             environment: credential.environment,
@@ -100,22 +124,25 @@ var CacheManager = /** @class */ (function () {
                             realm: credential.realm,
                             tokenType: credential.tokenType,
                             requestedClaimsHash: credential.requestedClaimsHash
-                        });
+                        };
+                        tokenKeys = this.getTokenKeys();
                         currentScopes = ScopeSet.fromString(credential.target);
-                        currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
-                        if (!currentAccessTokens) return [3 /*break*/, 2];
-                        removedAccessTokens_1 = [];
-                        currentAccessTokens.forEach(function (tokenEntity) {
-                            var tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
-                            if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                                removedAccessTokens_1.push(_this.removeCredential(tokenEntity));
+                        removedAccessTokens = [];
+                        tokenKeys.accessToken.forEach(function (key) {
+                            if (!_this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
+                                return;
+                            }
+                            var tokenEntity = _this.getAccessTokenCredential(key);
+                            if (tokenEntity && _this.credentialMatchesFilter(tokenEntity, accessTokenFilter)) {
+                                var tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
+                                if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
+                                    removedAccessTokens.push(_this.removeAccessToken(key));
+                                }
                             }
                         });
-                        return [4 /*yield*/, Promise.all(removedAccessTokens_1)];
+                        return [4 /*yield*/, Promise.all(removedAccessTokens)];
                     case 1:
                         _a.sent();
-                        _a.label = 2;
-                    case 2:
                         this.setAccessTokenCredential(credential);
                         return [2 /*return*/];
                 }
@@ -130,149 +157,151 @@ var CacheManager = /** @class */ (function () {
      * @param realm
      */
     CacheManager.prototype.getAccountsFilteredBy = function (accountFilter) {
-        return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : Constants.EMPTY_STRING, accountFilter ? accountFilter.environment : Constants.EMPTY_STRING, accountFilter ? accountFilter.realm : Constants.EMPTY_STRING, accountFilter ? accountFilter.nativeAccountId : Constants.EMPTY_STRING);
-    };
-    /**
-     * retrieve accounts matching all provided filters; if no filter is set, get all accounts
-     * not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
-     * @param homeAccountId
-     * @param environment
-     * @param realm
-     */
-    CacheManager.prototype.getAccountsFilteredByInternal = function (homeAccountId, environment, realm, nativeAccountId) {
         var _this = this;
-        var allCacheKeys = this.getKeys();
-        var matchingAccounts = {};
-        allCacheKeys.forEach(function (cacheKey) {
+        var allAccountKeys = this.getAccountKeys();
+        var matchingAccounts = [];
+        allAccountKeys.forEach(function (cacheKey) {
+            if (!_this.isAccountKey(cacheKey, accountFilter.homeAccountId, accountFilter.realm)) {
+                // Don't parse value if the key doesn't match the account filters
+                return;
+            }
             var entity = _this.getAccount(cacheKey);
             if (!entity) {
                 return;
             }
-            if (!!homeAccountId && !_this.matchHomeAccountId(entity, homeAccountId)) {
+            if (!!accountFilter.homeAccountId && !_this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
                 return;
             }
-            if (!!environment && !_this.matchEnvironment(entity, environment)) {
+            if (!!accountFilter.localAccountId && !_this.matchLocalAccountId(entity, accountFilter.localAccountId)) {
+                return;
+            }
+            if (!!accountFilter.username && !_this.matchUsername(entity, accountFilter.username)) {
+                return;
+            }
+            if (!!accountFilter.environment && !_this.matchEnvironment(entity, accountFilter.environment)) {
                 return;
             }
-            if (!!realm && !_this.matchRealm(entity, realm)) {
+            if (!!accountFilter.realm && !_this.matchRealm(entity, accountFilter.realm)) {
                 return;
             }
-            if (!!nativeAccountId && !_this.matchNativeAccountId(entity, nativeAccountId)) {
+            if (!!accountFilter.nativeAccountId && !_this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) {
                 return;
             }
-            matchingAccounts[cacheKey] = entity;
+            matchingAccounts.push(entity);
         });
         return matchingAccounts;
     };
     /**
-     * retrieve credentails matching all provided filters; if no filter is set, get all credentials
+     * Returns true if the given key matches our account key schema. Also matches homeAccountId and/or tenantId if provided
+     * @param key
      * @param homeAccountId
-     * @param environment
-     * @param credentialType
-     * @param clientId
-     * @param realm
-     * @param target
+     * @param tenantId
+     * @returns
      */
-    CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.userAssertionHash, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
+    CacheManager.prototype.isAccountKey = function (key, homeAccountId, tenantId) {
+        if (key.split(Separators.CACHE_KEY_SEPARATOR).length < 3) {
+            // Account cache keys contain 3 items separated by '-' (each item may also contain '-')
+            return false;
+        }
+        if (homeAccountId && !key.toLowerCase().includes(homeAccountId.toLowerCase())) {
+            return false;
+        }
+        if (tenantId && !key.toLowerCase().includes(tenantId.toLowerCase())) {
+            return false;
+        }
+        // Do not check environment as aliasing can cause false negatives
+        return true;
     };
     /**
-     * Support function to help match credentials
-     * @param homeAccountId
-     * @param environment
-     * @param credentialType
-     * @param clientId
-     * @param realm
-     * @param target
-     * @param userAssertionHash
-     * @param tokenType
+     * Returns true if the given key matches our credential key schema.
+     * @param key
      */
-    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, userAssertionHash, tokenType, keyId, requestedClaimsHash) {
-        var _this = this;
-        var allCacheKeys = this.getKeys();
-        var matchingCredentials = {
-            idTokens: {},
-            accessTokens: {},
-            refreshTokens: {},
-        };
-        allCacheKeys.forEach(function (cacheKey) {
-            // don't parse any non-credential type cache entities
-            var credType = CredentialEntity.getCredentialType(cacheKey);
-            if (credType === Constants.NOT_DEFINED) {
-                return;
-            }
-            // Attempt retrieval
-            var entity = _this.getSpecificCredential(cacheKey, credType);
-            if (!entity) {
-                return;
-            }
-            if (!!userAssertionHash && !_this.matchUserAssertionHash(entity, userAssertionHash)) {
-                return;
-            }
-            /*
-             * homeAccountId can undefined, and we want to filter out cached items that have a homeAccountId of ""
-             * because we don't want a client_credential request to return a cached token that has a homeAccountId
-             */
-            if ((typeof homeAccountId === "string") && !_this.matchHomeAccountId(entity, homeAccountId)) {
-                return;
-            }
-            if (!!environment && !_this.matchEnvironment(entity, environment)) {
-                return;
-            }
-            if (!!realm && !_this.matchRealm(entity, realm)) {
-                return;
-            }
-            if (!!credentialType && !_this.matchCredentialType(entity, credentialType)) {
-                return;
-            }
-            if (!!clientId && !_this.matchClientId(entity, clientId)) {
-                return;
-            }
-            if (!!familyId && !_this.matchFamilyId(entity, familyId)) {
-                return;
+    CacheManager.prototype.isCredentialKey = function (key) {
+        if (key.split(Separators.CACHE_KEY_SEPARATOR).length < 6) {
+            // Credential cache keys contain 6 items separated by '-' (each item may also contain '-')
+            return false;
+        }
+        var lowerCaseKey = key.toLowerCase();
+        // Credential keys must indicate what credential type they represent
+        if (lowerCaseKey.indexOf(CredentialType.ID_TOKEN.toLowerCase()) === -1 &&
+            lowerCaseKey.indexOf(CredentialType.ACCESS_TOKEN.toLowerCase()) === -1 &&
+            lowerCaseKey.indexOf(CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) === -1 &&
+            lowerCaseKey.indexOf(CredentialType.REFRESH_TOKEN.toLowerCase()) === -1) {
+            return false;
+        }
+        if (lowerCaseKey.indexOf(CredentialType.REFRESH_TOKEN.toLowerCase()) > -1) {
+            // Refresh tokens must contain the client id or family id
+            var clientIdValidation = "" + CredentialType.REFRESH_TOKEN + Separators.CACHE_KEY_SEPARATOR + this.clientId + Separators.CACHE_KEY_SEPARATOR;
+            var familyIdValidation = "" + CredentialType.REFRESH_TOKEN + Separators.CACHE_KEY_SEPARATOR + THE_FAMILY_ID + Separators.CACHE_KEY_SEPARATOR;
+            if (lowerCaseKey.indexOf(clientIdValidation.toLowerCase()) === -1 && lowerCaseKey.indexOf(familyIdValidation.toLowerCase()) === -1) {
+                return false;
             }
-            /*
-             * idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
-             * Resource specific refresh tokens case will be added when the support is deemed necessary
-             */
-            if (!!target && !_this.matchTarget(entity, target)) {
-                return;
+        }
+        else if (lowerCaseKey.indexOf(this.clientId.toLowerCase()) === -1) {
+            // Tokens must contain the clientId
+            return false;
+        }
+        return true;
+    };
+    /**
+     * Returns whether or not the given credential entity matches the filter
+     * @param entity
+     * @param filter
+     * @returns
+     */
+    CacheManager.prototype.credentialMatchesFilter = function (entity, filter) {
+        if (!!filter.clientId && !this.matchClientId(entity, filter.clientId)) {
+            return false;
+        }
+        if (!!filter.userAssertionHash && !this.matchUserAssertionHash(entity, filter.userAssertionHash)) {
+            return false;
+        }
+        /*
+         * homeAccountId can be undefined, and we want to filter out cached items that have a homeAccountId of ""
+         * because we don't want a client_credential request to return a cached token that has a homeAccountId
+         */
+        if ((typeof filter.homeAccountId === "string") && !this.matchHomeAccountId(entity, filter.homeAccountId)) {
+            return false;
+        }
+        if (!!filter.environment && !this.matchEnvironment(entity, filter.environment)) {
+            return false;
+        }
+        if (!!filter.realm && !this.matchRealm(entity, filter.realm)) {
+            return false;
+        }
+        if (!!filter.credentialType && !this.matchCredentialType(entity, filter.credentialType)) {
+            return false;
+        }
+        if (!!filter.familyId && !this.matchFamilyId(entity, filter.familyId)) {
+            return false;
+        }
+        /*
+         * idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
+         * Resource specific refresh tokens case will be added when the support is deemed necessary
+         */
+        if (!!filter.target && !this.matchTarget(entity, filter.target)) {
+            return false;
+        }
+        // If request OR cached entity has requested Claims Hash, check if they match
+        if (filter.requestedClaimsHash || entity.requestedClaimsHash) {
+            // Don't match if either is undefined or they are different
+            if (entity.requestedClaimsHash !== filter.requestedClaimsHash) {
+                return false;
             }
-            // If request OR cached entity has requested Claims Hash, check if they match
-            if (requestedClaimsHash || entity.requestedClaimsHash) {
-                // Don't match if either is undefined or they are different
-                if (entity.requestedClaimsHash !== requestedClaimsHash) {
-                    return;
-                }
+        }
+        // Access Token with Auth Scheme specific matching
+        if (entity.credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
+            if (!!filter.tokenType && !this.matchTokenType(entity, filter.tokenType)) {
+                return false;
             }
-            // Access Token with Auth Scheme specific matching
-            if (credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
-                if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
-                    return;
+            // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
+            if (filter.tokenType === AuthenticationScheme.SSH) {
+                if (filter.keyId && !this.matchKeyId(entity, filter.keyId)) {
+                    return false;
                 }
-                // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-                if (tokenType === AuthenticationScheme.SSH) {
-                    if (keyId && !_this.matchKeyId(entity, keyId)) {
-                        return;
-                    }
-                }
-            }
-            // At this point, the entity matches the request, update cache key if key schema has changed
-            var updatedCacheKey = _this.updateCredentialCacheKey(cacheKey, entity);
-            switch (credType) {
-                case CredentialType.ID_TOKEN:
-                    matchingCredentials.idTokens[updatedCacheKey] = entity;
-                    break;
-                case CredentialType.ACCESS_TOKEN:
-                case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                    matchingCredentials.accessTokens[updatedCacheKey] = entity;
-                    break;
-                case CredentialType.REFRESH_TOKEN:
-                    matchingCredentials.refreshTokens[updatedCacheKey] = entity;
-                    break;
             }
-        });
-        return matchingCredentials;
+        }
+        return true;
     };
     /**
      * retrieve appMetadata matching all provided filters; if no filter is set, get all appMetadata
@@ -340,30 +369,26 @@ var CacheManager = /** @class */ (function () {
      */
     CacheManager.prototype.removeAllAccounts = function () {
         return __awaiter(this, void 0, void 0, function () {
-            var allCacheKeys, removedAccounts;
+            var allAccountKeys, removedAccounts;
             var _this = this;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        allCacheKeys = this.getKeys();
+                        allAccountKeys = this.getAccountKeys();
                         removedAccounts = [];
-                        allCacheKeys.forEach(function (cacheKey) {
-                            var entity = _this.getAccount(cacheKey);
-                            if (!entity) {
-                                return;
-                            }
+                        allAccountKeys.forEach(function (cacheKey) {
                             removedAccounts.push(_this.removeAccount(cacheKey));
                         });
                         return [4 /*yield*/, Promise.all(removedAccounts)];
                     case 1:
                         _a.sent();
-                        return [2 /*return*/, true];
+                        return [2 /*return*/];
                 }
             });
         });
     };
     /**
-     * returns a boolean if the given account is removed
+     * Removes the account and related tokens for a given account key
      * @param account
      */
     CacheManager.prototype.removeAccount = function (accountKey) {
@@ -377,7 +402,10 @@ var CacheManager = /** @class */ (function () {
                             throw ClientAuthError.createNoAccountFoundError();
                         }
                         return [4 /*yield*/, this.removeAccountContext(account)];
-                    case 1: return [2 /*return*/, ((_a.sent()) && this.removeItem(accountKey, CacheSchemaType.ACCOUNT))];
+                    case 1:
+                        _a.sent();
+                        this.removeItem(accountKey);
+                        return [2 /*return*/];
                 }
             });
         });
@@ -388,29 +416,33 @@ var CacheManager = /** @class */ (function () {
      */
     CacheManager.prototype.removeAccountContext = function (account) {
         return __awaiter(this, void 0, void 0, function () {
-            var allCacheKeys, accountId, removedCredentials;
+            var allTokenKeys, accountId, removedCredentials;
             var _this = this;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        allCacheKeys = this.getKeys();
+                        allTokenKeys = this.getTokenKeys();
                         accountId = account.generateAccountId();
                         removedCredentials = [];
-                        allCacheKeys.forEach(function (cacheKey) {
-                            // don't parse any non-credential type cache entities
-                            var credType = CredentialEntity.getCredentialType(cacheKey);
-                            if (credType === Constants.NOT_DEFINED) {
-                                return;
+                        allTokenKeys.idToken.forEach(function (key) {
+                            if (key.indexOf(accountId) === 0) {
+                                _this.removeIdToken(key);
+                            }
+                        });
+                        allTokenKeys.accessToken.forEach(function (key) {
+                            if (key.indexOf(accountId) === 0) {
+                                removedCredentials.push(_this.removeAccessToken(key));
                             }
-                            var cacheEntity = _this.getSpecificCredential(cacheKey, credType);
-                            if (!!cacheEntity && accountId === cacheEntity.generateAccountId()) {
-                                removedCredentials.push(_this.removeCredential(cacheEntity));
+                        });
+                        allTokenKeys.refreshToken.forEach(function (key) {
+                            if (key.indexOf(accountId) === 0) {
+                                _this.removeRefreshToken(key);
                             }
                         });
                         return [4 /*yield*/, Promise.all(removedCredentials)];
                     case 1:
                         _a.sent();
-                        return [2 /*return*/, true];
+                        return [2 /*return*/];
                 }
             });
         });
@@ -419,13 +451,16 @@ var CacheManager = /** @class */ (function () {
      * returns a boolean if the given credential is removed
      * @param credential
      */
-    CacheManager.prototype.removeCredential = function (credential) {
+    CacheManager.prototype.removeAccessToken = function (key) {
         return __awaiter(this, void 0, void 0, function () {
-            var key, accessTokenWithAuthSchemeEntity, kid;
+            var credential, accessTokenWithAuthSchemeEntity, kid;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        key = credential.generateCredentialKey();
+                        credential = this.getAccessTokenCredential(key);
+                        if (!credential) {
+                            return [2 /*return*/];
+                        }
                         if (!(credential.credentialType.toLowerCase() === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase())) return [3 /*break*/, 4];
                         if (!(credential.tokenType === AuthenticationScheme.POP)) return [3 /*break*/, 4];
                         accessTokenWithAuthSchemeEntity = credential;
@@ -441,7 +476,7 @@ var CacheManager = /** @class */ (function () {
                     case 3:
                         _a.sent();
                         throw ClientAuthError.createBindingKeyNotRemovedError();
-                    case 4: return [2 /*return*/, this.removeItem(key, CacheSchemaType.CREDENTIAL)];
+                    case 4: return [2 /*return*/, this.removeItem(key)];
                 }
             });
         });
@@ -454,7 +489,7 @@ var CacheManager = /** @class */ (function () {
         var allCacheKeys = this.getKeys();
         allCacheKeys.forEach(function (cacheKey) {
             if (_this.isAppMetadata(cacheKey)) {
-                _this.removeItem(cacheKey, CacheSchemaType.APP_METADATA);
+                _this.removeItem(cacheKey);
             }
         });
         return true;
@@ -467,12 +502,13 @@ var CacheManager = /** @class */ (function () {
      * @param environment
      * @param authScheme
      */
-    CacheManager.prototype.readCacheRecord = function (account, clientId, request, environment) {
+    CacheManager.prototype.readCacheRecord = function (account, request, environment) {
+        var tokenKeys = this.getTokenKeys();
         var cachedAccount = this.readAccountFromCache(account);
-        var cachedIdToken = this.readIdTokenFromCache(clientId, account);
-        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, request);
-        var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
-        var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
+        var cachedIdToken = this.getIdToken(account, tokenKeys);
+        var cachedAccessToken = this.getAccessToken(account, request, tokenKeys);
+        var cachedRefreshToken = this.getRefreshToken(account, false, tokenKeys);
+        var cachedAppMetadata = this.readAppMetadataFromCache(environment);
         if (cachedAccount && cachedIdToken) {
             cachedAccount.idTokenClaims = new AuthToken(cachedIdToken.secret, this.cryptoImpl).claims;
         }
@@ -492,51 +528,83 @@ var CacheManager = /** @class */ (function () {
         var accountKey = AccountEntity.generateAccountCacheKey(account);
         return this.getAccount(accountKey);
     };
-    /**
-     * Retrieve AccountEntity from cache
-     * @param nativeAccountId
-     * @returns AccountEntity or Null
-     */
-    CacheManager.prototype.readAccountFromCacheWithNativeAccountId = function (nativeAccountId) {
-        // fetch account from memory
-        var accountFilter = {
-            nativeAccountId: nativeAccountId
-        };
-        var accountCache = this.getAccountsFilteredBy(accountFilter);
-        var accounts = Object.keys(accountCache).map(function (key) { return accountCache[key]; });
-        if (accounts.length < 1) {
-            return null;
-        }
-        else if (accounts.length > 1) {
-            throw ClientAuthError.createMultipleMatchingAccountsInCacheError();
-        }
-        return accounts[0];
-    };
     /**
      * Retrieve IdTokenEntity from cache
      * @param clientId
      * @param account
      * @param inputRealm
      */
-    CacheManager.prototype.readIdTokenFromCache = function (clientId, account) {
+    CacheManager.prototype.getIdToken = function (account, tokenKeys) {
+        this.commonLogger.trace("CacheManager - getIdToken called");
         var idTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
             credentialType: CredentialType.ID_TOKEN,
-            clientId: clientId,
+            clientId: this.clientId,
             realm: account.tenantId,
         };
-        var credentialCache = this.getCredentialsFilteredBy(idTokenFilter);
-        var idTokens = Object.keys(credentialCache.idTokens).map(function (key) { return credentialCache.idTokens[key]; });
+        var idTokens = this.getIdTokensByFilter(idTokenFilter, tokenKeys);
         var numIdTokens = idTokens.length;
         if (numIdTokens < 1) {
+            this.commonLogger.info("CacheManager:getIdToken - No token found");
             return null;
         }
         else if (numIdTokens > 1) {
             throw ClientAuthError.createMultipleMatchingTokensInCacheError();
         }
+        this.commonLogger.info("CacheManager:getIdToken - Returning id token");
         return idTokens[0];
     };
+    /**
+     * Gets all idTokens matching the given filter
+     * @param filter
+     * @returns
+     */
+    CacheManager.prototype.getIdTokensByFilter = function (filter, tokenKeys) {
+        var _this = this;
+        var idTokenKeys = tokenKeys && tokenKeys.idToken || this.getTokenKeys().idToken;
+        var idTokens = [];
+        idTokenKeys.forEach(function (key) {
+            if (!_this.idTokenKeyMatchesFilter(key, __assign({ clientId: _this.clientId }, filter))) {
+                return;
+            }
+            var idToken = _this.getIdTokenCredential(key);
+            if (idToken && _this.credentialMatchesFilter(idToken, filter)) {
+                idTokens.push(idToken);
+            }
+        });
+        return idTokens;
+    };
+    /**
+     * Validate the cache key against filter before retrieving and parsing cache value
+     * @param key
+     * @param filter
+     * @returns
+     */
+    CacheManager.prototype.idTokenKeyMatchesFilter = function (inputKey, filter) {
+        var key = inputKey.toLowerCase();
+        if (filter.clientId && key.indexOf(filter.clientId.toLowerCase()) === -1) {
+            return false;
+        }
+        if (filter.homeAccountId && key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
+            return false;
+        }
+        return true;
+    };
+    /**
+     * Removes idToken from the cache
+     * @param key
+     */
+    CacheManager.prototype.removeIdToken = function (key) {
+        this.removeItem(key);
+    };
+    /**
+     * Removes refresh token from the cache
+     * @param key
+     */
+    CacheManager.prototype.removeRefreshToken = function (key) {
+        this.removeItem(key);
+    };
     /**
      * Retrieve AccessTokenEntity from cache
      * @param clientId
@@ -544,8 +612,10 @@ var CacheManager = /** @class */ (function () {
      * @param scopes
      * @param authScheme
      */
-    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, request) {
-        var scopes = new ScopeSet(request.scopes || []);
+    CacheManager.prototype.getAccessToken = function (account, request, tokenKeys) {
+        var _this = this;
+        this.commonLogger.trace("CacheManager - getAccessToken called");
+        var scopes = ScopeSet.createSearchScopes(request.scopes);
         var authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;
         /*
          * Distinguish between Bearer and PoP/SSH token cache types
@@ -556,55 +626,156 @@ var CacheManager = /** @class */ (function () {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
             credentialType: credentialType,
-            clientId: clientId,
+            clientId: this.clientId,
             realm: account.tenantId,
-            target: scopes.printScopesLowerCase(),
+            target: scopes,
             tokenType: authScheme,
             keyId: request.sshKid,
             requestedClaimsHash: request.requestedClaimsHash,
         };
-        var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
-        var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
+        var accessTokenKeys = tokenKeys && tokenKeys.accessToken || this.getTokenKeys().accessToken;
+        var accessTokens = [];
+        accessTokenKeys.forEach(function (key) {
+            // Validate key
+            if (_this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
+                var accessToken = _this.getAccessTokenCredential(key);
+                // Validate value
+                if (accessToken && _this.credentialMatchesFilter(accessToken, accessTokenFilter)) {
+                    accessTokens.push(accessToken);
+                }
+            }
+        });
         var numAccessTokens = accessTokens.length;
         if (numAccessTokens < 1) {
+            this.commonLogger.info("CacheManager:getAccessToken - No token found");
             return null;
         }
         else if (numAccessTokens > 1) {
             throw ClientAuthError.createMultipleMatchingTokensInCacheError();
         }
+        this.commonLogger.info("CacheManager:getAccessToken - Returning access token");
         return accessTokens[0];
     };
+    /**
+     * Validate the cache key against filter before retrieving and parsing cache value
+     * @param key
+     * @param filter
+     * @param keyMustContainAllScopes
+     * @returns
+     */
+    CacheManager.prototype.accessTokenKeyMatchesFilter = function (inputKey, filter, keyMustContainAllScopes) {
+        var key = inputKey.toLowerCase();
+        if (filter.clientId && key.indexOf(filter.clientId.toLowerCase()) === -1) {
+            return false;
+        }
+        if (filter.homeAccountId && key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
+            return false;
+        }
+        if (filter.realm && key.indexOf(filter.realm.toLowerCase()) === -1) {
+            return false;
+        }
+        if (filter.requestedClaimsHash && key.indexOf(filter.requestedClaimsHash.toLowerCase()) === -1) {
+            return false;
+        }
+        if (filter.target) {
+            var scopes = filter.target.asArray();
+            for (var i = 0; i < scopes.length; i++) {
+                if (keyMustContainAllScopes && !key.includes(scopes[i].toLowerCase())) {
+                    // When performing a cache lookup a missing scope would be a cache miss
+                    return false;
+                }
+                else if (!keyMustContainAllScopes && key.includes(scopes[i].toLowerCase())) {
+                    // When performing a cache write, any token with a subset of requested scopes should be replaced
+                    return true;
+                }
+            }
+        }
+        return true;
+    };
+    /**
+     * Gets all access tokens matching the filter
+     * @param filter
+     * @returns
+     */
+    CacheManager.prototype.getAccessTokensByFilter = function (filter) {
+        var _this = this;
+        var tokenKeys = this.getTokenKeys();
+        var accessTokens = [];
+        tokenKeys.accessToken.forEach(function (key) {
+            if (!_this.accessTokenKeyMatchesFilter(key, filter, true)) {
+                return;
+            }
+            var accessToken = _this.getAccessTokenCredential(key);
+            if (accessToken && _this.credentialMatchesFilter(accessToken, filter)) {
+                accessTokens.push(accessToken);
+            }
+        });
+        return accessTokens;
+    };
     /**
      * Helper to retrieve the appropriate refresh token from cache
      * @param clientId
      * @param account
      * @param familyRT
      */
-    CacheManager.prototype.readRefreshTokenFromCache = function (clientId, account, familyRT) {
+    CacheManager.prototype.getRefreshToken = function (account, familyRT, tokenKeys) {
+        var _this = this;
+        this.commonLogger.trace("CacheManager - getRefreshToken called");
         var id = familyRT ? THE_FAMILY_ID : undefined;
         var refreshTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
             credentialType: CredentialType.REFRESH_TOKEN,
-            clientId: clientId,
+            clientId: this.clientId,
             familyId: id,
         };
-        var credentialCache = this.getCredentialsFilteredBy(refreshTokenFilter);
-        var refreshTokens = Object.keys(credentialCache.refreshTokens).map(function (key) { return credentialCache.refreshTokens[key]; });
+        var refreshTokenKeys = tokenKeys && tokenKeys.refreshToken || this.getTokenKeys().refreshToken;
+        var refreshTokens = [];
+        refreshTokenKeys.forEach(function (key) {
+            // Validate key
+            if (_this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
+                var refreshToken = _this.getRefreshTokenCredential(key);
+                // Validate value
+                if (refreshToken && _this.credentialMatchesFilter(refreshToken, refreshTokenFilter)) {
+                    refreshTokens.push(refreshToken);
+                }
+            }
+        });
         var numRefreshTokens = refreshTokens.length;
         if (numRefreshTokens < 1) {
+            this.commonLogger.info("CacheManager:getRefreshToken - No refresh token found.");
             return null;
         }
         // address the else case after remove functions address environment aliases
+        this.commonLogger.info("CacheManager:getRefreshToken - returning refresh token");
         return refreshTokens[0];
     };
+    /**
+     * Validate the cache key against filter before retrieving and parsing cache value
+     * @param key
+     * @param filter
+     */
+    CacheManager.prototype.refreshTokenKeyMatchesFilter = function (inputKey, filter) {
+        var key = inputKey.toLowerCase();
+        if (filter.familyId && key.indexOf(filter.familyId.toLowerCase()) === -1) {
+            return false;
+        }
+        // If familyId is used, clientId is not in the key
+        if (!filter.familyId && filter.clientId && key.indexOf(filter.clientId.toLowerCase()) === -1) {
+            return false;
+        }
+        if (filter.homeAccountId && key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
+            return false;
+        }
+        return true;
+    };
     /**
      * Retrieve AppMetadataEntity from cache
      */
-    CacheManager.prototype.readAppMetadataFromCache = function (environment, clientId) {
+    CacheManager.prototype.readAppMetadataFromCache = function (environment) {
         var appMetadataFilter = {
             environment: environment,
-            clientId: clientId,
+            clientId: this.clientId,
         };
         var appMetadata = this.getAppMetadataFilteredBy(appMetadataFilter);
         var appMetadataEntries = Object.keys(appMetadata).map(function (key) { return appMetadata[key]; });
@@ -622,8 +793,8 @@ var CacheManager = /** @class */ (function () {
      * @param environment
      * @param clientId
      */
-    CacheManager.prototype.isAppMetadataFOCI = function (environment, clientId) {
-        var appMetadata = this.readAppMetadataFromCache(environment, clientId);
+    CacheManager.prototype.isAppMetadataFOCI = function (environment) {
+        var appMetadata = this.readAppMetadataFromCache(environment);
         return !!(appMetadata && appMetadata.familyId === THE_FAMILY_ID);
     };
     /**
@@ -634,6 +805,24 @@ var CacheManager = /** @class */ (function () {
     CacheManager.prototype.matchHomeAccountId = function (entity, homeAccountId) {
         return !!((typeof entity.homeAccountId === "string") && (homeAccountId === entity.homeAccountId));
     };
+    /**
+     * helper to match account ids
+     * @param entity
+     * @param localAccountId
+     * @returns
+     */
+    CacheManager.prototype.matchLocalAccountId = function (entity, localAccountId) {
+        return !!((typeof entity.localAccountId === "string") && (localAccountId === entity.localAccountId));
+    };
+    /**
+     * helper to match usernames
+     * @param entity
+     * @param username
+     * @returns
+     */
+    CacheManager.prototype.matchUsername = function (entity, username) {
+        return !!((typeof entity.username === "string") && (username.toLowerCase() === entity.username.toLowerCase()));
+    };
     /**
      * helper to match assertion
      * @param value
@@ -706,14 +895,7 @@ var CacheManager = /** @class */ (function () {
             return false;
         }
         var entityScopeSet = ScopeSet.fromString(entity.target);
-        var requestTargetScopeSet = ScopeSet.fromString(target);
-        if (!requestTargetScopeSet.containsOnlyOIDCScopes()) {
-            requestTargetScopeSet.removeOIDCScopes(); // ignore OIDC scopes
-        }
-        else {
-            requestTargetScopeSet.removeScope(Constants.OFFLINE_ACCESS_SCOPE);
-        }
-        return entityScopeSet.containsScopeSet(requestTargetScopeSet);
+        return entityScopeSet.containsScopeSet(target);
     };
     /**
      * Returns true if the credential's tokenType or Authentication Scheme matches the one in the request, false otherwise
@@ -751,27 +933,6 @@ var CacheManager = /** @class */ (function () {
     CacheManager.prototype.generateAuthorityMetadataCacheKey = function (authority) {
         return AUTHORITY_METADATA_CONSTANTS.CACHE_KEY + "-" + this.clientId + "-" + authority;
     };
-    /**
-     * Returns the specific credential (IdToken/AccessToken/RefreshToken) from the cache
-     * @param key
-     * @param credType
-     */
-    CacheManager.prototype.getSpecificCredential = function (key, credType) {
-        switch (credType) {
-            case CredentialType.ID_TOKEN: {
-                return this.getIdTokenCredential(key);
-            }
-            case CredentialType.ACCESS_TOKEN:
-            case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME: {
-                return this.getAccessTokenCredential(key);
-            }
-            case CredentialType.REFRESH_TOKEN: {
-                return this.getRefreshTokenCredential(key);
-            }
-            default:
-                return null;
-        }
-    };
     /**
      * Helper to convert serialized data to object
      * @param obj
@@ -870,6 +1031,14 @@ var DefaultStorageClass = /** @class */ (function (_super) {
         var notImplErr = "Storage interface - getKeys() has not been implemented for the cacheStorage interface.";
         throw AuthError.createUnexpectedError(notImplErr);
     };
+    DefaultStorageClass.prototype.getAccountKeys = function () {
+        var notImplErr = "Storage interface - getAccountKeys() has not been implemented for the cacheStorage interface.";
+        throw AuthError.createUnexpectedError(notImplErr);
+    };
+    DefaultStorageClass.prototype.getTokenKeys = function () {
+        var notImplErr = "Storage interface - getTokenKeys() has not been implemented for the cacheStorage interface.";
+        throw AuthError.createUnexpectedError(notImplErr);
+    };
     DefaultStorageClass.prototype.clear = function () {
         return __awaiter(this, void 0, void 0, function () {
             var notImplErr;