fix: separate httpx and SQLAlchemy async contexts in bulk sync

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.5] - 2026-01-01
+
+### Fixed
+
+- Separate httpx and SQLAlchemy async contexts in bulk sync (fixes greenlet error)
+
 ## [1.4.4] - 2026-01-01
 
 ### Fixed

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "core-api"
-version = "1.4.4"
+version = "1.4.5"
 description = "Core Code API - Infrastructure management and tools API"
 readme = "README.md"
 requires-python = ">=3.12"

src/auth/service.py

@@ -369,6 +369,8 @@ class AuthService:
         errors = []
         total_in_authentik = 0
 
+        # Step 1: Fetch all user data from Authentik API
+        authentik_users = []
         try:
             async with httpx.AsyncClient(timeout=30.0, follow_redirects=True) as client:
                 # Authenticate with Authentik to get session cookie
@@ -393,6 +395,12 @@ class AuthService:
                 authentik_users = data.get("results", [])
                 total_in_authentik = data.get("pagination", {}).get("count", len(authentik_users))
 
+        except httpx.HTTPStatusError as e:
+            raise ValueError(f"Authentik API error: {e.response.status_code}")
+        except httpx.RequestError as e:
+            raise ValueError(f"Failed to connect to Authentik: {str(e)}")
+
+        # Step 2: Sync users to database (outside of httpx context to avoid greenlet issues)
         for auth_user in authentik_users:
             try:
                 # Skip service accounts and inactive users
@@ -454,11 +462,6 @@ class AuthService:
         # Commit all changes
         await self.session.commit()
 
-        except httpx.HTTPStatusError as e:
-            raise ValueError(f"Authentik API error: {e.response.status_code}")
-        except httpx.RequestError as e:
-            raise ValueError(f"Failed to connect to Authentik: {str(e)}")
-
         return BulkSyncResultSchema(
             created=created,
             updated=updated,