From 4df5cfc106f891a69ad847d7279a29dc950b14b2 Mon Sep 17 00:00:00 2001
From: Jeroen Schweitzer <jeroen@imagin.studio>
Date: Wed, 7 Jan 2026 16:00:14 +0100
Subject: [PATCH] fix: initialize OIDC config for both auth modules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The domains.auth.oidc module had its own oidc_config instance that
wasn't being configured, causing environment endpoint to always use
hardcoded "local" user instead of authenticated user.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 CHANGELOG.md           |  8 ++++++++
 pyproject.toml         |  2 +-
 src/shared/security.py | 12 ++++++++++--
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6e52421..13d1c09 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.10.3] - 2026-01-07
+
+### Fixed
+
+- **OIDC config not applied to domains module** - Both `src.auth.oidc` and `src.domains.auth.oidc` configs are now initialized
+  - Previously only `src.auth.oidc` was configured, leaving domains tools using hardcoded "local" user
+  - Environment endpoint now correctly uses authenticated user from OIDC token
+
 ## [1.10.2] - 2026-01-07
 
 ### Changed
diff --git a/pyproject.toml b/pyproject.toml
index 27459f1..3d601f1 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "core-api"
-version = "1.10.2"
+version = "1.10.3"
 description = "Core Code API - Infrastructure management and tools API"
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/src/shared/security.py b/src/shared/security.py
index be446dc..8f95b15 100644
--- a/src/shared/security.py
+++ b/src/shared/security.py
@@ -17,9 +17,17 @@ def initialize_oidc(settings: Settings) -> None:
         settings: Application settings containing OIDC configuration
     """
     # Import here to avoid circular imports
-    from src.auth.oidc import oidc_config
+    # Configure BOTH oidc modules (src.auth and src.domains.auth)
+    from src.auth.oidc import oidc_config as auth_oidc_config
+    from src.domains.auth.oidc import oidc_config as domains_oidc_config
 
-    oidc_config.configure(
+    auth_oidc_config.configure(
+        enabled=settings.oidc_enabled,
+        issuer=settings.oidc_issuer,
+        audience=settings.oidc_audience
+    )
+
+    domains_oidc_config.configure(
         enabled=settings.oidc_enabled,
         issuer=settings.oidc_issuer,
         audience=settings.oidc_audience