Retry transient HTTP errors (502/503/504) and network errors

[0ca]

Summary

• Adds retry logic for transient non-JSON HTTP errors (502, 503, 504) that were previously failing permanently
• Extends network error retries to cover EOF and connection reset errors, not just timeouts

Problem

When Terraform refreshes state for many Doppler resources in parallel (~60+ resources), the API occasionally returns:

• 502 Bad Gateway from Cloudflare — HTML error page (~6443 bytes), not JSON
• EOF / connection reset errors from transient network issues

The current code at api.go:185 returns these errors with RetryAfter: nil, causing the retry loop to exit immediately. The error surfaces as:

Error: Doppler Error: Unable to load response
502 status code; 6439 bytes

Root Cause

Two issues in PerformRequest():

1. Non-JSON error responses (line 185): When the API returns a non-JSON body (e.g., Cloudflare's HTML 502 page), RetryAfter is never set, so the retry loop gives up immediately
2. Network errors (lines 130-136): Only net.Error timeouts trigger a retry. EOF and connection reset errors get RetryAfter: nil and fail permanently

Reproduction

We reproduced this using a Go program that mirrors the provider's exact HTTP client configuration (DisableKeepAlives: true, new http.Client per request, 30s timeout). Running 60 concurrent requests every 3 seconds:

• Captured a 502 after ~6000 requests (response: 6443 bytes, Cloudflare HTML)
• Response header: Proxy-Status: Cloudflare-Proxy;error=http_response_incomplete — the origin sent an incomplete response
• Also observed: 18-22 timeouts per 10-minute run, same class of transient error

Fix

• isTransientStatusCode(): Returns true for 502, 503, 504
• isTransientError(): Returns true for timeouts, EOF, connection reset, connection refused
• Both non-JSON HTTP errors and network errors now set RetryAfter for transient cases, enabling the existing retry loop (up to 10 attempts with 1s backoff)

What this does NOT change

• Retry loop structure and MAX_RETRIES (10) unchanged
• JSON error handling path unchanged
• 429 rate limit handling unchanged
• HTTP client config (DisableKeepAlives, timeouts) unchanged

Test plan

• go build ./... compiles clean
• go test ./... passes (no existing tests broken)
• Reproduced 502 with exact provider HTTP client config before fix
• Manual testing with large Terraform state refresh

🤖 Generated with Claude Code