getDestination with `useCache: true` returns valid grant token when it should not

Describe the bug I’m using getDestination with useCache: true and am able to get a grant token from the cache, even though I have an invalid token for principal propagation.

I believe this is due to the caching being done on the wrong key: https://github.com/SAP/cloud-sdk-js/blob/b31e3e68065049875b44e077fcb5156a10028fa0/packages/connectivity/src/scp-cf/token-accessor.ts#L49 The serviceCredentials.clientid here is static in my case (destination service credentials are statically stored in the VCAP_SERVICES) and thus is the same on each request. For destination access with principal propagation the token.email (or similar) should be considered.

To Reproduce Steps to reproduce the behavior:

1. Setup application with VCAP_SERVICES.destination...credentials set
2. Get a token not suited for principal proagation (e.g. client credentials instead of authorization code) -> getDestination(..., {useCache: true}) returns 401
3. Get a valid authorization code token -> getDestination is successfull
4. Repeat step 2

Expected behavior A 401 is returned again

Actual behavior A valid grant token is returned from cache

Used Versions:

• node version: v14.16.1
• npm version: 6.14.12
• SAP Cloud SDK version: 1.51.0

Code Examples

 service.destination = await getDestination(service.destinationName, {
        userJwt: getJwt(req),
        useCache: true,
      });

Impact / Priority High - Unauthorized access might be possible

Additional context If necessary I can provide more details and instruction for how to reproduce this behavior.

[FrankEssenberger]

We were able to find the cause in the call, that the wrong token is passed in the cache. I also understood why the alwaysSubscriber did lead to an error. These two PRs should fix it:

• https://github.com/SAP/cloud-sdk-js/pull/1769 -> reason wrong token is passed
• https://github.com/SAP/cloud-sdk-js/pull/1770 -> broken cache keys are not passed

@johenning thanks once more for bringing this up. I hope we do not have things like this so often, but the next time feel free to contact us via an internal channel, then we would do the whole fix and discussion on a private issue and release it once the fix is available.

[FrankEssenberger]

Version 1.52.0 is released and already available on npm. Please migrate to this version to fix the issue.