Enumerate key-bound ATs on sign-out and account removal

Gate the ext_cache_key and key_id cache-isolation filters in
TokenCache.search() on a non-empty target. Scoped token retrieval keeps
the mtls_pop / FMI isolation intact, but broad target-less searches (used
by _sign_out and remove_account) now enumerate key-bound access tokens so
they are removed from the cache instead of being left behind.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Robbie-Microsoft

msal/token_cache.py

@@ -288,15 +288,21 @@ def search(self, credential_type, target=None, query=None, *, now=None):  # O(n)
                 ):
                     # Cache isolation for extended cache keys (e.g., FMI path).
                     # Entries with ext_cache_key must not match queries without one.
+                    # Gated on target so broad target-less searches (sign-out /
+                    # account removal) still enumerate these ATs and can delete them.
                     if (credential_type == self.CredentialType.ACCESS_TOKEN
+                        and target
                         and "ext_cache_key" in entry
                         and "ext_cache_key" not in (query or {})
                     ):
                         continue
                     # Cache isolation for key-bound tokens (e.g. mtls_pop, SSH-cert).
                     # An entry bound to a key_id must not satisfy a query without
                     # one, so a Bearer lookup never returns a PoP/mtls_pop token.
+                    # Gated on target so broad target-less searches (sign-out /
+                    # account removal) still enumerate key-bound ATs and can delete them.
                     if (credential_type == self.CredentialType.ACCESS_TOKEN
+                        and target
                         and "key_id" in entry
                         and "key_id" not in (query or {})
                     ):

tests/test_token_cache.py

@@ -294,6 +294,33 @@ def test_bearer_and_mtls_pop_tokens_coexist_and_isolate(self):
         self.assertEqual("mtls_at", pop["secret"])
         self.assertEqual("mtls_pop", pop["token_type"])
 
+    def test_broad_search_without_target_enumerates_key_bound_tokens(self):
+        # Removal paths (e.g. ClientApplication._sign_out) enumerate ATs by
+        # account with no target and no key_id. Such a broad search must still
+        # surface key-bound (mtls_pop) ATs; otherwise sign-out / remove_account
+        # would leave them behind. Regression guard for the key_id isolation gate.
+        scopes = ["s2", "s1", "s3"]
+        now = 1000
+        common = dict(
+            client_id="my_client_id", scope=scopes,
+            token_endpoint="https://login.example.com/contoso/v2/token")
+        self.cache.add(dict(common, data={}, response=build_response(
+            uid="uid", utid="utid", expires_in=3600,
+            access_token="bearer_at", token_type="Bearer")), now=now)
+        self.cache.add(dict(common, data={"key_id": "THUMB"}, response=build_response(
+            uid="uid", utid="utid", expires_in=3600,
+            access_token="mtls_at", token_type="mtls_pop")), now=now)
+        owned_by_account = dict(
+            client_id="my_client_id", environment="login.example.com",
+            realm="contoso", home_account_id="uid.utid")
+        # Broad search: no target/scopes and no key_id -> BOTH ATs, incl. mtls_pop
+        found = list(self.cache.search(
+            TokenCache.CredentialType.ACCESS_TOKEN, query=owned_by_account, now=now))
+        secrets = {at["secret"] for at in found}
+        self.assertIn("mtls_at", secrets,
+            "A target-less search must enumerate key-bound ATs so they can be removed")
+        self.assertIn("bearer_at", secrets)
+
     def test_refresh_in_should_be_recorded_as_refresh_on(self):  # Sounds weird. Yep.
         scopes = ["s2", "s1", "s3"]  # Not in particular order
         self.cache.add({