From f14affcc1eb8a0db0debf958c20cf674903016d8 Mon Sep 17 00:00:00 2001
From: hsiegeln <37154749+hsiegeln@users.noreply.github.com>
Date: Tue, 7 Apr 2026 18:18:08 +0200
Subject: [PATCH] fix: verify Management API readiness before proceeding in
 bootstrap

Logto's OIDC endpoint may respond before the Management API is fully
initialized. Add a retry loop that checks GET /api/roles returns valid
JSON before making any API calls. Fixes intermittent bootstrap failure
on cold starts with 'Cannot index string with string "name"'.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 docker/logto-bootstrap.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/docker/logto-bootstrap.sh b/docker/logto-bootstrap.sh
index f2bcd38..73da618 100644
--- a/docker/logto-bootstrap.sh
+++ b/docker/logto-bootstrap.sh
@@ -121,6 +121,18 @@ TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token' 2>/dev/null)
 [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ] && { log "ERROR: Failed to get token"; exit 1; }
 log "Got Management API token."
 
+# Verify Management API is fully ready (Logto may still be initializing internally)
+log "Verifying Management API is responsive..."
+for i in $(seq 1 30); do
+  VERIFY_RESPONSE=$(curl -s -H "Authorization: Bearer $TOKEN" -H "Host: ${HOST}" "${LOGTO_ENDPOINT}/api/roles" 2>/dev/null)
+  if echo "$VERIFY_RESPONSE" | jq -e 'type == "array"' >/dev/null 2>&1; then
+    log "Management API is ready."
+    break
+  fi
+  [ "$i" -eq 30 ] && { log "ERROR: Management API not responsive after 30s"; exit 1; }
+  sleep 1
+done
+
 # --- Helper: Logto API calls ---
 api_get() {
   curl -s -H "Authorization: Bearer $TOKEN" -H "Host: ${HOST}" "${LOGTO_ENDPOINT}${1}" 2>/dev/null || echo "[]"