Address review comments

Author: dominic-clerk

packages/backend/src/tokens/__tests__/request.test.ts

@@ -2098,6 +2098,7 @@ describe('tokens.authenticateRequest(options)', () => {
         {
           __session: mockJwt,
           __client_uat: '12345',
+          __clerk_db_jwt: mockJwt,
         },
         'https://primary.com/dashboard',
       );
@@ -2110,7 +2111,11 @@ describe('tokens.authenticateRequest(options)', () => {
         signInUrl: 'https://primary.com/sign-in',
       });
 
-      expect(requestState.reason).not.toBe(AuthErrorReason.PrimaryDomainCrossOriginSync);
+      expect(requestState).toBeSignedIn({
+        domain: 'primary.com',
+        isSatellite: false,
+        signInUrl: 'https://primary.com/sign-in',
+      });
     });
 
     test('does not trigger cross-origin handshake when referer is from dev accounts portal on a dev instance (legacy format)', async () => {
@@ -2123,6 +2128,7 @@ describe('tokens.authenticateRequest(options)', () => {
         {
           __session: mockJwt,
           __client_uat: '12345',
+          __clerk_db_jwt: mockJwt,
         },
         'https://primary.com/dashboard',
       );
@@ -2135,7 +2141,11 @@ describe('tokens.authenticateRequest(options)', () => {
         signInUrl: 'https://primary.com/sign-in',
       });
 
-      expect(requestState.reason).not.toBe(AuthErrorReason.PrimaryDomainCrossOriginSync);
+      expect(requestState).toBeSignedIn({
+        domain: 'primary.com',
+        isSatellite: false,
+        signInUrl: 'https://primary.com/sign-in',
+      });
     });
 
     // A production instance must not trust dev-portal referrers, which are freely obtainable.

packages/backend/src/tokens/authenticateContext.ts

@@ -216,11 +216,11 @@ class AuthenticateContext implements AuthenticateContext {
   }
 
   /**
-   * Determines if the referrer URL is from a Clerk domain (accounts portal or FAPI).
-   * This includes both development and production account portal domains, as well as FAPI domains
-   * used for redirect-based authentication flows.
+   * Determines if the referrer URL is from a Clerk domain: the instance's FAPI domain, the accounts
+   * portal derived from its frontend API, or — on non-production instances only — a development
+   * account-portal domain.
    *
-   * @returns {boolean} True if the referrer is from a Clerk accounts portal or FAPI domain, false otherwise
+   * @returns {boolean} True if the referrer is a trusted Clerk domain, false otherwise
    */
   public isKnownClerkReferrer(): boolean {
     if (!this.referrer) {