fix(auth0-server-js): treat session with no stored domain as mismatch in resolver mode

Author: jd3vi1

packages/auth0-server-js/src/server-client.spec.ts

@@ -7003,6 +7003,39 @@ describe('revokeRefreshToken', () => {
     await expect(serverClient.revokeRefreshToken()).resolves.toBeUndefined();
     expect(revokeCalled).toBe(false);
   });
+
+  test('should skip revocation in resolver mode when session has no stored domain', async () => {
+    const domainResolver = vi.fn().mockResolvedValue('resolver.local');
+    let revokeCalled = false;
+
+    server.use(
+      http.post('https://resolver.local/oauth/revoke', () => {
+        revokeCalled = true;
+        return new HttpResponse(null, { status: 200 });
+      })
+    );
+
+    const stateData: StateData = {
+      user: { sub: '<sub>' },
+      idToken: '<id_token>',
+      refreshToken: '<refresh_token>',
+      tokenSets: [],
+      // no domain field
+      internal: { sid: '<sid>', createdAt: Date.now() },
+    };
+
+    const serverClient = new ServerClient({
+      domain: domainResolver,
+      clientId: '<client_id>',
+      clientSecret: '<client_secret>',
+      discoveryCache: { ttl: 0 },
+      transactionStore: { get: vi.fn(), set: vi.fn(), delete: vi.fn() },
+      stateStore: { get: vi.fn().mockResolvedValue(stateData), set: vi.fn(), delete: vi.fn(), deleteByLogoutToken: vi.fn() },
+    });
+
+    await expect(serverClient.revokeRefreshToken()).resolves.toBeUndefined();
+    expect(revokeCalled).toBe(false);
+  });
 });
 
 describe('logout revocation', () => {

packages/auth0-server-js/src/server-client.ts

@@ -1113,8 +1113,8 @@ export class ServerClient<TStoreOptions = unknown> {
     if (this.#isResolverMode()) {
       const resolvedDomain = await this.#resolveDomain(storeOptions);
       const sessionDomain = stateData ? this.#getSessionDomain(stateData) : undefined;
-      if (sessionDomain && sessionDomain !== resolvedDomain) {
-        // Session belongs to a different tenant; do not revoke against the wrong domain.
+      if (stateData && sessionDomain !== resolvedDomain) {
+        // Session exists but its domain is unknown or belongs to a different tenant; do not revoke.
         return;
       }
       authClient = this.#getAuthClient(sessionDomain ?? resolvedDomain);