fix(whatsmeow): reuse shared sqlstore.Container for PostgresAuthDB

[meguisouza]

Problem

When using PostgreSQL for the WhatsApp auth store (POSTGRES_AUTH_DB), every call to StartClient opens a new sqlstore via sqlstore.New(postgres, DSN). That path always runs whatsmeow/dbutil Upgrade (including the version-table check that surfaces as failed to check if version table is up to date / failed to upgrade database).

In production behind PgBouncer we saw:

• Only a few instances reconnecting or generating QR at the same time was enough to hit the pool ceiling (cl_active equal to default_pool_size + reserve_pool_size, e.g. 60+15=75), with clients waiting close to query_wait_timeout.
• Logs: Failed to create container: failed to upgrade database: … driver: bad connection.
• /instance/qr and connect paths stall (e.g. QR returning 400 after ~5s) while the auth pool is saturated.
• Disconnect / reconnect / kill-and-restart do not call container.Close() on the previous store, so each StartClient can leave another *sql.DB behind. The process already opens a pooled authDB in initPostgresAuthDB (SetMaxOpenConns / idle / lifetime), but StartClient never reuses it.

This matches an older incident with the same stuck auth-DB connections at the pool ceiling. PgBouncer only makes the ceiling visible.

Fix

• Single process-wide sqlstore.Container (sharedSQLStore + sync.Once, safe with value-receiver StartClient).
• Postgres: sqlstore.NewWithDB(authDB, "postgres", …) + Upgrade once, reusing initPostgresAuthDB.
• Sqlite fallback: one shared DB with the same pool limits.
• Do not close on instance disconnect — main owns authDB.Close().
• Users/GORM DB stays separate.

How to reproduce

1. POSTGRES_AUTH_DB via PgBouncer with a modest default_pool_size.
2. Connect/QR on 3+ disconnected instances in parallel.
3. SHOW POOLS + logs for Failed to create container / bad connection.

Test plan

• Build/run with POSTGRES_AUTH_DB.
• Parallel reconnects stay within the shared authDB pool limits.
• First start still upgrades schema; later StartClient does not sql.Open new auth pools.
• Single disconnect/reconnect still loads the session.
• Sqlite-only path still works.

Happy to adjust structure if preferred.

Summary by Sourcery

Reuse one upgraded authentication SQL store across client starts to stabilize reconnects and avoid accumulating database pools.

Bug Fixes:

• Reuse a single process-wide WhatsApp authentication SQL store to prevent repeated database upgrades and connection-pool exhaustion during client reconnects.

Enhancements:

• Share the initialized PostgreSQL auth database and configure an equivalent persistent SQLite fallback, while keeping database ownership and the Users/GORM database separate.

[sourcery-ai]

Reviewer's Guide

The PR changes WhatsApp auth-store initialization from per-StartClient sqlstore creation to a process-wide, sync.Once-managed container. PostgreSQL now reuses the existing pooled authDB and upgrades once, while SQLite receives a single similarly bounded pool; instance disconnects no longer need to close the shared store, whose lifecycle remains process-owned.

Sequence diagram for shared WhatsApp auth-store initialization

sequenceDiagram
    participant Caller
    participant Service as whatsmeowService
    participant Store as sharedSQLStore
    participant AuthDB as authDB
    participant Container as sqlstore.Container

    Caller->>Service: StartClient(cd)
    Service->>Store: getSharedSQLStoreContainer()
    Store->>Store: sync.Once.Do
    alt PostgresAuthDB configured
        Store->>AuthDB: NewWithDB(authDB, postgres, dbLog)
        Store->>Container: Upgrade(ctx)
        Container-->>Store: success
    else SQLite fallback
        Store->>Store: sql.Open(sqlite, dsn)
        Store->>Container: NewWithDB(db, sqlite, dbLog)
        Store->>Container: Upgrade(ctx)
        Container-->>Store: success
    end
    Store-->>Service: shared container
    Service-->>Caller: StartClient continues

Loading

File-Level Changes

Change	Details	Files
Reuse one process-wide WhatsApp auth-store container instead of creating a new pooled SQL store for every client start.	Add heap-allocated shared state with sync.Once to support value-receiver StartClient methods. Initialize the container once and return the cached container or initialization error for subsequent calls. Wire the shared state into service construction.	pkg/whatsmeow/service/whatsmeow.go
Reuse the existing PostgreSQL auth database pool and perform schema upgrade only during shared-store initialization.	Construct the store with NewWithDB using the authDB created during service initialization. Upgrade PostgreSQL once without closing the main-owned authDB. Keep the Users/GORM database separate from the WhatsApp auth store.	pkg/whatsmeow/service/whatsmeow.go
Apply equivalent shared-pool lifecycle behavior to the SQLite fallback.	Open one SQLite database with explicit connection, idle, lifetime, and idle-time limits. Upgrade it once and retain the database handle for the shared container. Close the SQLite handle if initial upgrade fails.	pkg/whatsmeow/service/whatsmeow.go

Possibly linked issues

• #Postgres connection pool leak on every StartClient/reconnect cycle: The PR directly fixes the reported leak by reusing the existing auth DB and shared sqlstore container across StartClient calls.
• #unknown: The PR directly fixes the issue by reusing a process-wide sqlstore container and pooled auth database across reconnects.
• #unknown: The PR directly fixes the reported leak by reusing one shared sqlstore container instead of creating pools per reconnect.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. A single shared container and one-time database upgrade now govern all WhatsApp auth sessions, so an initialization or connection-handling defect could prevent every client from connecting or leave persisted auth state needing repair. Reverting stops future use of the shared path, but it does not undo database writes already made.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook