Fix: always set Neo4j password on boot + cypher-shell fallback in seeder

docker/entrypoint.sh

@@ -13,15 +13,13 @@ mkdir -p /data/neo4j/data/databases /data/neo4j/data/dbms
 # ── First-boot: set initial password ──────────────────────────────────────────
 NEO4J_PASS="${NEO4J_PASSWORD:-clinicalmatch2024}"
 
-if [ ! -f /data/.neo4j_initialized ]; then
-    log "First boot — setting Neo4j initial password..."
-    # neo4j-admin must write to the same dbms dir Neo4j will use
-    NEO4J_CONF=/opt/neo4j/conf \
-    neo4j-admin dbms set-initial-password "$NEO4J_PASS" 2>&1 || \
-        log "WARNING: set-initial-password failed (may already be set — continuing)"
-    touch /data/.neo4j_initialized
-    log "Password initialisation done."
-fi
+# Always attempt set-initial-password — safe to run every boot:
+#   - Before first Neo4j start: sets the password correctly
+#   - After first start: command fails (db already has auth), || true absorbs the error
+log "Setting Neo4j initial password (safe to re-run)..."
+NEO4J_CONF=/opt/neo4j/conf \
+neo4j-admin dbms set-initial-password "$NEO4J_PASS" 2>&1 || \
+    log "set-initial-password: already initialized, skipping."
 
 # ── Nginx tmp dirs ─────────────────────────────────────────────────────────────
 mkdir -p /tmp/nginx-cache /tmp/nginx-body

docker/seed_on_startup.sh

@@ -36,9 +36,28 @@ wait_for_http() {
     log "$label ready after $((i*2))s"
 }
 
+NEO4J_PASS="${NEO4J_PASSWORD:-clinicalmatch2024}"
+
 log "Waiting for Neo4j bolt on $NEO4J_BOLT..."
 wait_for_tcp 127.0.0.1 7687 "Neo4j bolt" 180
 
+# Extra settle time — bolt port opens before auth subsystem is fully ready
+sleep 10
+
+# Ensure the password is set correctly via cypher-shell.
+# Case 1: DB is brand new → default creds are neo4j/neo4j, change them.
+# Case 2: Password already set to $NEO4J_PASS → first attempt fails, second succeeds (noop).
+log "Ensuring Neo4j password is set to target value..."
+if cypher-shell -u neo4j -p "$NEO4J_PASS" "RETURN 1 AS ok;" > /dev/null 2>&1; then
+    log "Neo4j auth OK — password already matches target."
+else
+    log "Attempting password change from default (neo4j → target)..."
+    cypher-shell -u neo4j -p neo4j \
+        "ALTER CURRENT USER SET PASSWORD FROM 'neo4j' TO '$NEO4J_PASS';" 2>&1 \
+        && log "Password changed successfully." \
+        || log "WARNING: password change failed — may already be set or auth is locked. Continuing."
+fi
+
 log "Waiting for FastAPI backend..."
 wait_for_http "$BACKEND/health" "FastAPI /health" 120