fix: initialize OIDC config for both auth modules

The domains.auth.oidc module had its own oidc_config instance that
wasn't being configured, causing environment endpoint to always use
hardcoded "local" user instead of authenticated user.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.10.3] - 2026-01-07
+
+### Fixed
+
+- **OIDC config not applied to domains module** - Both `src.auth.oidc` and `src.domains.auth.oidc` configs are now initialized
+  - Previously only `src.auth.oidc` was configured, leaving domains tools using hardcoded "local" user
+  - Environment endpoint now correctly uses authenticated user from OIDC token
+
+## [1.10.2] - 2026-01-07
+
+### Changed
+
+- **Enhanced environment endpoint logging** - Added detailed user claim logging for debugging
+  - Logs both `preferred_username` and `sub` claims when resolving user
+  - Distinguishes between authenticated and unauthenticated requests
+
+## [1.10.1] - 2026-01-06
+
+### Fixed
+
+- Fix OIDC import path in tools controller (`src.oidc.dependencies` → `src.auth.oidc`)
+  - Environment endpoint was returning `user: "local"` instead of authenticated username
+  - Caused queries to wrong Qdrant collection (`volatile_local` vs `volatile_{username}`)
+
 ## [1.10.0] - 2026-01-06
 
 ### Added

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "core-api"
-version = "1.10.0"
+version = "1.10.3"
 description = "Core Code API - Infrastructure management and tools API"
 readme = "README.md"
 requires-python = ">=3.12"

src/controllers/tools_controller.py

@@ -16,7 +16,7 @@ from src.dns.service import DNSService
 from src.dns.exceptions import DNSQueryError
 from src.domains.tools.environment.schemas import EnvironmentResponse
 from src.domains.tools.environment.service import get_environment_service
-from src.oidc.dependencies import get_optional_user
+from src.auth.oidc import get_optional_user
 
 logger = get_logger(__name__)
 
@@ -141,9 +141,11 @@ class ToolsController(BaseController):
                 # Determine user identifier
                 user_id = "default"
                 if user:
+                    logger.debug(f"User claims: {user}")
                     user_id = user.get("preferred_username") or user.get("sub", "default")
-
-                logger.info(f"Fetching environment data for user: {user_id}")
+                    logger.info(f"Fetching environment data for user: {user_id} (preferred_username={user.get('preferred_username')}, sub={user.get('sub')})")
+                else:
+                    logger.info(f"Fetching environment data for user: {user_id} (no auth)")
                 result = await self.environment_service.get_current(user_id)
                 return result
 

src/shared/security.py

@@ -17,9 +17,17 @@ def initialize_oidc(settings: Settings) -> None:
         settings: Application settings containing OIDC configuration
     """
     # Import here to avoid circular imports
-    from src.auth.oidc import oidc_config
+    # Configure BOTH oidc modules (src.auth and src.domains.auth)
+    from src.auth.oidc import oidc_config as auth_oidc_config
+    from src.domains.auth.oidc import oidc_config as domains_oidc_config
 
-    oidc_config.configure(
+    auth_oidc_config.configure(
+        enabled=settings.oidc_enabled,
+        issuer=settings.oidc_issuer,
+        audience=settings.oidc_audience
+    )
+
+    domains_oidc_config.configure(
         enabled=settings.oidc_enabled,
         issuer=settings.oidc_issuer,
         audience=settings.oidc_audience