feat: implement refresh token revocation

[yogeshchoudhary147]

Summary

Adds a revoke() method to Auth0Client that allows applications to explicitly revoke refresh tokens via the OAuth 2.0 /oauth/revoke endpoint.

• Revokes refresh tokens for the default or a specific audience/scope
• Preserves the still-valid access token in cache after revocation — only refresh_token is cleared, allowing continued use until natural expiry
• Handles MRRT — all cache entries sharing the same refresh token are revoked together
• Supports both worker (memory) and non-worker (localStorage/sessionStorage) storage modes
• When the access token eventually expires and the refresh token has been revoked, the SDK falls back to silent auth (useRefreshTokensFallback) or surfaces a missing_refresh_token error for the app to handle

Usage

// Revoke refresh token for default audience/scope
await auth0.revoke();

// Revoke refresh token for a specific audience/scope
await auth0.revoke({
  authorizationParams: {
    audience: 'https://api.example.com',
    scope: 'read:users'
  }
});

Test plan

• Unit tests for Auth0Client.revoke(), revokeMessageHandler, revokeToken, and removeByRefreshToken covering success, error, timeout, MRRT, and edge cases
• Manual testing against a real Auth0 tenant

In general, to fix a missing origin verification in a postMessage handler you must (a) restrict which senders are trusted (by checking event.origin and/or event.source in window contexts), and (b) validate that the incoming data is of the expected structure before using it. In a worker context, origin may not always be present, but we can still defend by checking for the presence of origin when available and by validating the message type.

For this code, the minimal and safest fix without changing functionality is:

1. Guard messageRouter so it only processes messages whose data object is of the expected shape and explicitly matches the allowed type values ('revoke' or 'refresh').
2. Add an origin check that:
   • If event.origin is defined (e.g., in environments where workers do get an origin), requires it to match a whitelist of trusted origins.
   • If event.origin is undefined, we fall back to existing behavior to avoid breaking dedicated-worker usage, but we still benefit from strict type checks.
3. Optionally, ignore or log all messages that fail these checks instead of routing them.

Because we must not assume anything about configuration elsewhere, we’ll define a small local helper to decide whether an event is trusted and use it inside messageRouter. All changes are confined to src/worker/token.worker.ts, around the messageRouter definition (lines 268–275). No new imports or external libraries are required.

---