fix: apply 429 backoff to organization connection writes to prevent rate-limit failures

[harshithRai]

🔧 Changes

Organization connection writes were bypassing the CLI's rate-limit protections. The base handler routes all create/update/delete calls through the request pool wrapped in 429 exponential-backoff retry, but OrganizationsHandler manages nested connection writes itself via raw Promise.all, so those calls had no CLI-level backoff. On tenants with many organizations × connections this produces an unthrottled burst that trips Auth0's organization_connections_write group rate limit and fails the import.

This change wraps the organization connection writes in the same exponential-backoff retry used by the base handler:

• src/tools/auth0/handlers/default.ts
  • Exported retryWithExponentialBackoff and the RetryOptions interface for reuse by other handlers.
  • Extracted the retry-config construction into a reusable getRetryConfig() method on the base handler (respects AUTH0_MAX_RETRIES / AUTH0_RETRY_INITIAL_DELAY_MS / AUTH0_RETRY_MAX_DELAY_MS and the existing warn logging). processChanges now calls it — no behavior change there.
• src/tools/auth0/handlers/organizations.ts
  • Wrapped the connection create (create path) and connection update/add/remove (update path) in retryWithExponentialBackoff(..., this.getRetryConfig()), keeping the existing Promise.all structure.

These calls now get proper 429 backoff with Retry-After support. Promise.all is retained deliberately — no calls were added to the shared request pool, avoiding the pool-exhaustion deadlock that a nested-pool approach would introduce.

This is a near-term mitigation (recover from the limit via backoff), not full burst throttling. A follow-up to add a dedicated throttling pool for connection writes is tracked separately.

📚 References

• Auth0 Support KB: https://support.auth0.com/center/s/article/global-per-minute-organization-connections-read-group-limit-has-been-reached-error

🔬 Testing

Unit Tests

• Existing organizations and default handler unit tests pass (test/tools/auth0/handlers/organizations.tests.js, test/tools/auth0/handlers/default.tests.ts).

Manual testing (real tenant)
Deployed against a dev tenant to exercise all three connection write paths through the new backoff wrapper, then re-exported to confirm the writes landed:

• Connection create on a new org
• Connection add on an existing org
• Connection remove

Note: the dev tenant is too small to actually trip the organization_connections_write group limit, so the 429-retry behavior itself is covered by the unit test above rather than the manual run.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A) — N/A (behavioral fix; retry env vars already documented)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 86.36364% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.63%. Comparing base (0a0bd11) to head (c481bd1).

Files with missing lines	Patch %	Lines
src/tools/auth0/handlers/organizations.ts	78.57%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1464      +/-   ##
==========================================
+ Coverage   80.49%   80.63%   +0.13%     
==========================================
  Files         163      163              
  Lines        7741     7750       +9     
  Branches     1719     1719              
==========================================
+ Hits         6231     6249      +18     
+ Misses        810      801       -9     
  Partials      700      700              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.