fix(identity): correct audiusSdk accessor in authMiddleware (.full.users -> .users)

authMiddleware backfills blockchainUserId/handle for users whose identity
row lacks them (the state of any guest / freshly signed-up user) by calling
the SDK. It used `req.app.get('audiusSdk').full.users.getUserAccount(...)`,
but the @audius/sdk instance has no `.full` namespace - `users` is a
top-level API. So `.full` is undefined and `.users` throws a synchronous
TypeError ("Cannot read properties of undefined (reading 'users')") on
EVERY new-user auth request (/users/update, /record_ip, etc).

Confirmed in prod logs:
  TypeError: Cannot read properties of undefined (reading 'users')
    at authMiddleware (build/src/authMiddleware.js:97:68)
  msg: "Failed to update blockchainUserId/handle"

The bad accessor came in with the monorepo import (#14388) and only began
firing once #14474 (6/15) made loadAudiusSdk.cjs available so the SDK
actually initialized - matching the signup regression window. The
surrounding try/catch swallowed the error and called next(), so the
backfill silently never happened for new users.

Fix: use the correct accessor `audiusSdk.users.getUserAccount`. Also wrap
the now-live call in a 3s timeout (deferred into a promise so a
missing/misshapen sdk rejects instead of throwing synchronously), so that
once the call actually runs, a slow discovery lookup for a not-yet-indexed
new user degrades gracefully (logged, then next()) instead of stalling auth.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: dylanjeffers

packages/identity-service/src/authMiddleware.js

@@ -11,6 +11,20 @@ const models = require('./models')
 const audiusLibsWrapper = require('./audiusLibsInstance')
 const { encodeHashId, decodeHashId } = require('./utils/hashIds')
 
+// Upper bound on the discovery/SDK lookup used to backfill blockchainUserId/handle.
+// During signup the on-chain user is often not yet indexed by discovery, so this
+// call can block on the SDK's internal node selection + retries. Without a bound it
+// stalls the entire request (e.g. /users/update) until the client times out.
+const SDK_USER_LOOKUP_TIMEOUT_MS = 3000
+
+const withTimeout = (promise, ms, message) =>
+  Promise.race([
+    promise,
+    new Promise((_resolve, reject) =>
+      setTimeout(() => reject(new Error(message)), ms)
+    )
+  ])
+
 /**
  * Queries for whether the wallet address has privilege to act as actingUserId
  * @param {number} managerWalletAddress
@@ -114,11 +128,20 @@ async function authMiddleware(req, res, next) {
       // ensuring that the user.handle always represents the latest state on chain
       if (!user.blockchainUserId || !user.handle) {
         try {
-          const res = await req.app.get('audiusSdk').full.users.getUserAccount({
-            wallet: walletAddress,
-            encodedDataMessage,
-            encodedDataSignature: signature
-          })
+          const res = await withTimeout(
+            // Defer property access into the promise so a missing/misshapen sdk
+            // surfaces as a rejection (handled below) rather than a synchronous
+            // throw, and so the timeout always applies.
+            Promise.resolve().then(() =>
+              req.app.get('audiusSdk').users.getUserAccount({
+                wallet: walletAddress,
+                encodedDataMessage,
+                encodedDataSignature: signature
+              })
+            ),
+            SDK_USER_LOOKUP_TIMEOUT_MS,
+            'audiusSdk.getUserAccount timed out'
+          )
           const discprovUser = res.data.user
           const userId = decodeHashId(discprovUser.id)
           const handle = discprovUser.handle
@@ -181,11 +204,20 @@ const parameterizedAuthMiddleware = ({ shouldRespondBadRequest }) => {
 
       if (!user.blockchainUserId || !user.handle) {
         try {
-          const res = await req.app.get('audiusSdk').full.users.getUserAccount({
-            wallet: walletAddress,
-            encodedDataMessage,
-            encodedDataSignature: signature
-          })
+          const res = await withTimeout(
+            // Defer property access into the promise so a missing/misshapen sdk
+            // surfaces as a rejection (handled below) rather than a synchronous
+            // throw, and so the timeout always applies.
+            Promise.resolve().then(() =>
+              req.app.get('audiusSdk').users.getUserAccount({
+                wallet: walletAddress,
+                encodedDataMessage,
+                encodedDataSignature: signature
+              })
+            ),
+            SDK_USER_LOOKUP_TIMEOUT_MS,
+            'audiusSdk.getUserAccount timed out'
+          )
           const discprovUser = res.data.user
           const userId = decodeHashId(discprovUser.id)
           const handle = discprovUser.handle