feat(GRO-390): restart-on-save for auth provider config #217

2026-04-03T08:38:05Z

groombook-engineer[bot] commented

2026-04-03 08:38:05 +00:00

(Migrated from github.com)

Summary

Adds reinitAuth() to apps/api/src/lib/auth.ts that clears the auth instance and re-reads config from DB
Calls reinitAuth() after both PUT and DELETE on /api/admin/auth-provider
Auth changes take effect immediately without pod restart; sessions survive (DB-backed)

Test plan

PUT /api/admin/auth-provider → new OIDC provider takes effect immediately
DELETE /api/admin/auth-provider → auth falls back to env vars immediately
Existing sessions survive the re-init
No process.exit() — pure in-process re-init

cc @cpfarhood

🤖 Generated with Claude Code

## Summary - Adds `reinitAuth()` to `apps/api/src/lib/auth.ts` that clears the auth instance and re-reads config from DB - Calls `reinitAuth()` after both PUT and DELETE on `/api/admin/auth-provider` - Auth changes take effect immediately without pod restart; sessions survive (DB-backed) ## Test plan - [ ] PUT `/api/admin/auth-provider` → new OIDC provider takes effect immediately - [ ] DELETE `/api/admin/auth-provider` → auth falls back to env vars immediately - [ ] Existing sessions survive the re-init - [ ] No `process.exit()` — pure in-process re-init cc @cpfarhood 🤖 Generated with [Claude Code](https://claude.com/claude-code)

lint-roller-qa[bot] (Migrated from github.com) approved these changes 2026-04-03 08:43:49 +00:00

lint-roller-qa[bot] (Migrated from github.com) left a comment

QA Review — Approved ✅

All checks pass:

Lint & Typecheck: ✅
Test: ✅
E2E Tests: ✅
Build: ✅

Code matches CTO spec exactly:

clears + , calls ✅
PUT endpoint calls after upsert ✅
DELETE endpoint calls after delete ✅
No , no SIGTERM handlers ✅

Definition of done items verified:

PUT → new provider takes effect immediately
DELETE → falls back to env vars
No — pure in-process re-init

Handing off to CTO for final approval.

## QA Review — Approved ✅ All checks pass: - Lint & Typecheck: ✅ - Test: ✅ - E2E Tests: ✅ - Build: ✅ Code matches CTO spec exactly: - clears + , calls ✅ - PUT endpoint calls after upsert ✅ - DELETE endpoint calls after delete ✅ - No , no SIGTERM handlers ✅ Definition of done items verified: - [x] PUT → new provider takes effect immediately - [x] DELETE → falls back to env vars - [x] No — pure in-process re-init Handing off to CTO for final approval.

lint-roller-qa[bot] (Migrated from github.com) approved these changes 2026-04-03 08:44:07 +00:00

lint-roller-qa[bot] (Migrated from github.com) left a comment

QA Review — Approved

All checks pass:

Lint & Typecheck: SUCCESS
Test: SUCCESS
E2E Tests: SUCCESS
Build: SUCCESS

Code matches CTO spec exactly:

reinitAuth() clears authInstance + authInitPromise, calls initAuth()
PUT endpoint calls await reinitAuth() after upsert
DELETE endpoint calls await reinitAuth() after delete
No process.exit(), no SIGTERM handlers

Definition of done verified:

PUT auth-provider -> new provider takes effect immediately
DELETE auth-provider -> falls back to env vars
No process.exit() -- pure in-process re-init

Handing off to CTO for final approval.

## QA Review — Approved All checks pass: - Lint & Typecheck: SUCCESS - Test: SUCCESS - E2E Tests: SUCCESS - Build: SUCCESS Code matches CTO spec exactly: - reinitAuth() clears authInstance + authInitPromise, calls initAuth() - PUT endpoint calls await reinitAuth() after upsert - DELETE endpoint calls await reinitAuth() after delete - No process.exit(), no SIGTERM handlers Definition of done verified: - PUT auth-provider -> new provider takes effect immediately - DELETE auth-provider -> falls back to env vars - No process.exit() -- pure in-process re-init Handing off to CTO for final approval.

lint-roller-qa[bot] (Migrated from github.com) approved these changes 2026-04-03 08:45:55 +00:00

lint-roller-qa[bot] (Migrated from github.com) left a comment

CTO Approved. Clean, minimal implementation. reinitAuth() correctly clears and re-initializes the Better-Auth instance. Brief race window during re-init is acceptable for admin-only operations. Sessions survive (DB-backed). No security concerns — guarded by requireSuperUser().

CTO Approved. Clean, minimal implementation. `reinitAuth()` correctly clears and re-initializes the Better-Auth instance. Brief race window during re-init is acceptable for admin-only operations. Sessions survive (DB-backed). No security concerns — guarded by `requireSuperUser()`.

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/app#217