Add OIDC issuer discovery retry with caching

src/lib/server/auth.ts

@@ -122,8 +122,29 @@ export async function generateCsrfToken(sessionId: string, redirectUrl: string):
 	).toString("base64");
 }
 
+let cachedIssuer: Issuer | undefined;
+
+async function discoverIssuerWithRetry(providerUrl: string, retries = 3): Promise<Issuer> {
+	if (cachedIssuer) return cachedIssuer;
+
+	for (let attempt = 1; attempt <= retries; attempt++) {
+		try {
+			cachedIssuer = await Issuer.discover(providerUrl);
+			return cachedIssuer;
+		} catch (err) {
+			logger.warn(
+				{ attempt, retries, code: (err as NodeJS.ErrnoException).code },
+				"OIDC issuer discovery failed, retrying…"
+			);
+			if (attempt === retries) throw err;
+			await new Promise((r) => setTimeout(r, 1000 * attempt));
+		}
+	}
+	throw new Error("Unreachable");
+}
+
 async function getOIDCClient(settings: OIDCSettings): Promise<BaseClient> {
-	const issuer = await Issuer.discover(OIDConfig.PROVIDER_URL);
+	const issuer = await discoverIssuerWithRetry(OIDConfig.PROVIDER_URL);
 
 	const client_config: ConstructorParameters<typeof issuer.Client>[0] = {
 		client_id: OIDConfig.CLIENT_ID,