From 632dadd0644f49ee3e6af06aca9a3c46ccccdfe2 Mon Sep 17 00:00:00 2001
From: Flea Flicker <22+gb_flea@noreply.git.farh.net>
Date: Wed, 5 Aug 2026 08:17:31 +0000
Subject: [PATCH] fix(GRO-2652): retry DB query in initAuth on transient
 ECONNRESET

The auth_provider_config DB query at boot has no error handling;
a transient ECONNRESET causes authInitPromise to reject, propagating
to the top-level await initAuth() and crashing the process (exit 1).

Add up to 5 retry attempts with exponential backoff (1 s, 2 s, 4 s, 8 s)
so a single connection reset does not abort initialization.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 src/lib/auth.ts | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index b28153d..9ec3520 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -124,13 +124,28 @@ export async function initAuth(): Promise<void> {
       return;
     }
 
-    // Step 1: Try to load config from DB
+    // Step 1: Try to load config from DB, with retry-with-backoff for transient ECONNRESET (GRO-2652).
+    // A single connection reset during boot must not abort initialization.
     const db = getDb();
-    const [dbConfig] = await db
-      .select()
-      .from(authProviderConfig)
-      .where(eq(authProviderConfig.enabled, true))
-      .limit(1);
+    let dbQueryRows: (typeof authProviderConfig.$inferSelect)[] = [];
+    let dbAttempt = 0;
+    while (true) {
+      try {
+        dbQueryRows = await db
+          .select()
+          .from(authProviderConfig)
+          .where(eq(authProviderConfig.enabled, true))
+          .limit(1);
+        break;
+      } catch (err) {
+        dbAttempt++;
+        if (dbAttempt >= 5) throw err;
+        const delay = Math.min(1000 * 2 ** (dbAttempt - 1), 8_000);
+        console.warn(`[auth] DB query attempt ${dbAttempt} failed (${err}), retrying in ${delay}ms`);
+        await new Promise((r) => setTimeout(r, delay));
+      }
+    }
+    const [dbConfig] = dbQueryRows;
 
     let providerConfig: {
       providerId: string;