fix(auth): fail-fast Better Auth session Redis reads

[Fraol-D]

Description

This PR fixes Better Auth session Redis reads so they fail fast when Redis is unavailable, preventing repeated session lookups from waiting for the full Redis timeout.

The change adds a dedicated auth-cache fail-fast path with a 5-second failure window and a 1500ms operation deadline. The auth failure state is kept independent from the existing link-cache failure state, so a failure in one does not affect the other.

Tests were added to verify the fail-fast behavior, independent failure windows, and recovery/reset behavior.

Slice

• Issue: no dedicated issue filed; leftover from perf(links): fail fast on link cache Redis failures instead of compounding deadlines #677 (Better Auth session Redis reads have no fail-fast)
• Scope / owning surface: packages/auth, packages/redis
• Dependencies or overlapping PRs: None

Checklist

• This branch started from current staging and does not include another unmerged PR unless it is named above.
• This is one independently reviewable slice; unrelated cleanup or refactors are in separate PRs.
• I checked open PRs for overlapping files, contracts, schemas, or deployment configuration and made any dependency explicit above.
• This PR targets staging; after it closes, this branch will not be reused for another change.
• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

---

Summary by cubic

Makes Better Auth session reads fail fast when Redis is down, so requests don't wait out the full timeout on every session lookup.

Bug Fixes

• Wraps auth secondary storage calls in runAuthCacheCommand, which rejects immediately for 5 seconds after a recent Redis failure and enforces a 1500ms operation deadline.
• Keeps the auth cache fail-fast window separate from the link cache window, so a failure in one cache doesn't trip the other.
• Moves the secondary storage setup into createAuthSecondaryStorage with tests covering the fail-fast behavior.

^{Written for commit 4f38c6f. Summary will update on new commits.}

[vercel]

@Fraol-D is attempting to deploy a commit to the Databuddy OSS Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 14e4b11e-8c60-4644-a157-4fd08f9cf311

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR adds a dedicated timeout and fail-fast circuit for Better Auth’s Redis secondary storage.

• Wraps session-cache reads and mutations with a 1.5-second operation deadline and an independent five-second failure window.
• Adds integration and unit coverage for sequential failure and fail-fast behavior.
• Moves Better Auth secondary-storage construction into a dedicated adapter module.

Confidence Score: 4/5

The PR needs a concurrency-safe breaker update before merging because an older successful operation can erase a newer Redis failure and defeat the intended fail-fast behavior.

The shared auth-cache failure deadline is cleared by any success without accounting for overlapping command order, allowing subsequent session reads to re-enter the slow Redis path immediately after a failure.

Files Needing Attention: packages/redis/redis.ts

Important Files Changed

Filename	Overview
packages/redis/redis.ts	Adds the auth-cache deadline and breaker, but its unconditional success reset permits concurrent commands to erase a newer failure.
packages/auth/src/auth-redis-storage.ts	Introduces a wrapper that routes all Better Auth Redis secondary-storage methods through the new breaker.
packages/auth/src/auth.ts	Replaces the direct Redis adapter with the new wrapped secondary-storage factory.
packages/redis/000-redis.test.ts	Covers sequential fail-fast behavior and breaker isolation, but not overlapping command completion order.
packages/auth/src/auth-redis-storage.test.ts	Verifies a later read fails quickly after a Redis error, without exercising concurrent reads.

Sequence Diagram

sequenceDiagram
  participant A as Auth command A
  participant B as Auth command B
  participant R as Redis
  participant F as Shared fail-fast deadline
  A->>R: Start operation
  B->>R: Start operation
  R-->>B: Failure
  B->>F: Set deadline to now + 5s
  R-->>A: Success
  A->>F: Reset deadline to 0
  Note over F: Recent failure is forgotten
  B->>F: Next auth read checks deadline
  F-->>B: Execute Redis operation instead of failing fast

Loading

_{Reviews (1): Last reviewed commit: "fix(auth): fail-fast Better Auth session..." | Re-trigger Greptile}

[greptile-apps]

Concurrent success clears failure

If two auth-cache commands overlap and the newer command fails before the older one succeeds, the unconditional reset on success erases the newer five-second failure window. Subsequent session reads then attempt Redis and can incur the full 1.5-second deadline instead of failing fast.