@wbce-d9/api 12.3.0 → 12.4.2

package/dist/auth/drivers/baseoauth.d.ts

@@ -1,4 +1,4 @@
-import type { Client, TokenSet } from 'openid-client';
+import * as oidc from 'openid-client';
 import { UsersService } from '../../services/users.js';
 import type { User } from '../../types/index.js';
 import { LocalAuthDriver } from './local.js';
@@ -12,12 +12,12 @@ export interface UserPayload {
     auth_data: any;
 }
 export declare abstract class BaseOAuthDriver extends LocalAuthDriver {
-    abstract getClient(): Promise<Client>;
+    abstract getClient(): Promise<oidc.Configuration>;
     abstract getredirectUrl(): string;
     abstract getUserService(): UsersService;
     abstract getConfig(): Record<string, any>;
     abstract getClientName(): string;
-    abstract getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[TokenSet, Record<string, unknown>, UserPayload]>;
+    abstract getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers, Record<string, unknown>, UserPayload]>;
     generateCodeVerifier(): string;
     fetchUserId(identifier: string): Promise<string | undefined>;
     getUserID(payload: Record<string, any>): Promise<string>;

package/dist/auth/drivers/baseoauth.js

@@ -1,5 +1,5 @@
 import { parseJSON } from '@wbce-d9/utils';
-import { errors, generators } from 'openid-client';
+import * as oidc from 'openid-client';
 import getDatabase from '../../database/index.js';
 import emitter from '../../emitter.js';
 import { RecordNotUniqueException } from '../../exceptions/database/record-not-unique.js';
@@ -9,7 +9,7 @@ import { UsersService } from '../../services/users.js';
 import { LocalAuthDriver } from './local.js';
 export class BaseOAuthDriver extends LocalAuthDriver {
     generateCodeVerifier() {
-        return generators.codeVerifier();
+        return oidc.randomPKCECodeVerifier();
     }
     async fetchUserId(identifier) {
         const user = await this.knex.select('id').from('directus_users').where('external_identifier', identifier).first();
@@ -86,9 +86,9 @@ export class BaseOAuthDriver extends LocalAuthDriver {
         if (authData?.['refreshToken']) {
             try {
                 const client = await this.getClient();
-                const tokenSet = await client.refresh(authData['refreshToken']);
+                const tokenSet = await oidc.refreshTokenGrant(client, authData['refreshToken']);
                 if (tokenSet.refresh_token) {
-                    await client.revoke(tokenSet.refresh_token, 'refresh_token');
+                    await oidc.tokenRevocation(client, tokenSet.refresh_token);
                 }
                 await this.getUserService().updateOne(user.id, {
                     auth_data: null,
@@ -119,7 +119,7 @@ export class BaseOAuthDriver extends LocalAuthDriver {
         if (authData?.['refreshToken']) {
             try {
                 const client = await this.getClient();
-                const tokenSet = await client.refresh(authData['refreshToken']);
+                const tokenSet = await oidc.refreshTokenGrant(client, authData['refreshToken']);
                 // Update user refreshToken if provided
                 if (tokenSet.refresh_token) {
                     await this.getUserService().updateOne(user.id, {
@@ -138,7 +138,7 @@ export class BaseOAuthDriver extends LocalAuthDriver {
         }
     }
     handleError = (e) => {
-        if (e instanceof errors.OPError) {
+        if (e instanceof oidc.ResponseBodyError) {
             if (e.error === 'invalid_grant') {
                 // Invalid token
                 logger.trace(e, `[${this.getClientName()}] Invalid grant`);
@@ -151,7 +151,7 @@ export class BaseOAuthDriver extends LocalAuthDriver {
                 message: e.error_description,
             });
         }
-        else if (e instanceof errors.RPError) {
+        else if (e instanceof oidc.ClientError) {
             // Internal client error
             logger.trace(e, `[${this.getClientName()}] Unknown RP error`);
             return new InvalidCredentialsException();

package/dist/auth/drivers/oauth2.d.ts

@@ -1,20 +1,20 @@
 import { Router } from 'express';
-import type { BaseClient, Client, TokenSet } from 'openid-client';
+import * as oidc from 'openid-client';
 import { UsersService } from '../../services/users.js';
 import type { AuthDriverOptions } from '../../types/index.js';
 import { BaseOAuthDriver, type UserPayload } from './baseoauth.js';
 export declare class OAuth2AuthDriver extends BaseOAuthDriver {
-    client: Client;
+    client: oidc.Configuration;
     redirectUrl: string;
     usersService: UsersService;
     config: Record<string, any>;
-    getClient(): Promise<BaseClient>;
+    getClient(): Promise<oidc.Configuration>;
     getredirectUrl(): string;
     getUserService(): UsersService;
     getConfig(): Record<string, any>;
     getClientName(): string;
     constructor(options: AuthDriverOptions, config: Record<string, any>);
-    generateAuthUrl(codeVerifier: string, prompt?: boolean): string;
-    getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[TokenSet, Record<string, unknown>, UserPayload]>;
+    generateAuthUrl(codeVerifier: string, prompt?: boolean): Promise<string>;
+    getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers, Record<string, unknown>, UserPayload]>;
 }
 export declare function createOAuth2AuthRouter(providerName: string): Router;

package/dist/auth/drivers/oauth2.js

@@ -2,9 +2,9 @@ import { BaseException } from '@wbce-d9/exceptions';
 import express, { Router } from 'express';
 import flatten from 'flat';
 import jwt from 'jsonwebtoken';
-import { Issuer, generators } from 'openid-client';
+import * as oidc from 'openid-client';
 import { getAuthProvider } from '../../auth.js';
-import { ACCESS_COOKIE_OPTIONS, OAUTH2_COOKIE_CLEAR_OPTIONS, OAUTH2_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS, } from '../../constants.js';
+import { ACCESS_COOKIE_OPTIONS, OAUTH2_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
 import env from '../../env.js';
 import { InvalidConfigException, InvalidCredentialsException, InvalidTokenException, InvalidPayloadException, } from '../../exceptions/index.js';
 import logger from '../../logger.js';
@@ -47,35 +47,31 @@ export class OAuth2AuthDriver extends BaseOAuthDriver {
         this.redirectUrl = redirectUrl.toString();
         this.usersService = new UsersService({ knex: this.knex, schema: this.schema });
         this.config = additionalConfig;
-        const issuer = new Issuer({
+        const clientOptionsOverrides = getConfigFromEnv(`AUTH_${config['provider'].toUpperCase()}_CLIENT_`, [`AUTH_${config['provider'].toUpperCase()}_CLIENT_ID`, `AUTH_${config['provider'].toUpperCase()}_CLIENT_SECRET`], 'underscore');
+        this.client = new oidc.Configuration({
             authorization_endpoint: authorizeUrl,
             token_endpoint: accessUrl,
             userinfo_endpoint: profileUrl,
             issuer: additionalConfig['provider'],
-        });
-        const clientOptionsOverrides = getConfigFromEnv(`AUTH_${config['provider'].toUpperCase()}_CLIENT_`, [`AUTH_${config['provider'].toUpperCase()}_CLIENT_ID`, `AUTH_${config['provider'].toUpperCase()}_CLIENT_SECRET`], 'underscore');
-        this.client = new issuer.Client({
-            client_id: clientId,
-            client_secret: clientSecret,
-            redirect_uris: [this.redirectUrl],
-            response_types: ['code'],
-            ...clientOptionsOverrides,
-        });
+        }, clientId, { client_secret: clientSecret, ...clientOptionsOverrides });
     }
-    generateAuthUrl(codeVerifier, prompt = false) {
+    async generateAuthUrl(codeVerifier, prompt = false) {
         try {
-            const codeChallenge = generators.codeChallenge(codeVerifier);
+            const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
             const paramsConfig = typeof this.config['params'] === 'object' ? this.config['params'] : {};
-            return this.client.authorizationUrl({
+            const params = {
                 scope: this.config['scope'] ?? 'email',
                 access_type: 'offline',
-                prompt: prompt ? 'consent' : undefined,
                 ...paramsConfig,
                 code_challenge: codeChallenge,
                 code_challenge_method: 'S256',
                 // Some providers require state even with PKCE
                 state: codeChallenge,
-            });
+            };
+            if (prompt) {
+                params['prompt'] = 'consent';
+            }
+            return oidc.buildAuthorizationUrl(this.client, params).href;
         }
         catch (e) {
             throw this.handleError(e);
@@ -85,8 +81,13 @@ export class OAuth2AuthDriver extends BaseOAuthDriver {
         let tokenSet;
         let userInfo;
         try {
-            tokenSet = await this.client.oauthCallback(this.redirectUrl, { code: payload['code'], state: payload['state'] }, { code_verifier: payload['codeVerifier'], state: generators.codeChallenge(payload['codeVerifier']) });
-            userInfo = await this.client.userinfo(tokenSet.access_token);
+            const codeChallenge = await oidc.calculatePKCECodeChallenge(payload['codeVerifier']);
+            const callbackUrl = new URL(payload['callbackPath'], this.redirectUrl);
+            tokenSet = await oidc.authorizationCodeGrant(this.client, callbackUrl, {
+                pkceCodeVerifier: payload['codeVerifier'],
+                expectedState: codeChallenge,
+            });
+            userInfo = await oidc.fetchUserInfo(this.client, tokenSet.access_token, oidc.skipSubjectCheck);
         }
         catch (e) {
             throw this.handleError(e);
@@ -115,7 +116,7 @@ export class OAuth2AuthDriver extends BaseOAuthDriver {
 }
 export function createOAuth2AuthRouter(providerName) {
     const router = Router();
-    router.get('/', (req, res) => {
+    router.get('/', asyncHandler(async (req, res) => {
         const provider = getAuthProvider(providerName);
         const codeVerifier = provider.generateCodeVerifier();
         const prompt = !!req.query['prompt'];
@@ -124,12 +125,12 @@ export function createOAuth2AuthRouter(providerName) {
             throw new InvalidPayloadException(`URL "${redirect}" can't be used to redirect after login`);
         }
         const token = jwt.sign({ verifier: codeVerifier, redirect, prompt }, env['SECRET'], {
-            expiresIn: '5m',
+            expiresIn: Math.floor(OAUTH2_COOKIE_OPTIONS.maxAge / 1000),
             issuer: 'directus',
         });
         res.cookie(`oauth2.${providerName}`, token, OAUTH2_COOKIE_OPTIONS);
-        return res.redirect(provider.generateAuthUrl(codeVerifier, prompt));
-    }, respond);
+        return res.redirect(await provider.generateAuthUrl(codeVerifier, prompt));
+    }), respond);
     router.post('/callback', express.urlencoded({ extended: false }), (req, res) => {
         res.redirect(303, `./callback?${new URLSearchParams(req.body)}`);
     }, respond);
@@ -161,8 +162,8 @@ export function createOAuth2AuthRouter(providerName) {
         });
         let authResponse;
         try {
-            res.clearCookie(`oauth2.${providerName}`, OAUTH2_COOKIE_CLEAR_OPTIONS);
             authResponse = await authenticationService.login(providerName, {
+                callbackPath: req.originalUrl,
                 code: req.query['code'],
                 codeVerifier: verifier,
                 state: req.query['state'],

package/dist/auth/drivers/openid.d.ts

@@ -1,20 +1,20 @@
 import { Router } from 'express';
-import type { AuthorizationParameters, BaseClient, Client, TokenSet } from 'openid-client';
+import * as oidc from 'openid-client';
 import { UsersService } from '../../services/users.js';
 import type { AuthDriverOptions } from '../../types/index.js';
 import { BaseOAuthDriver, type UserPayload } from './baseoauth.js';
 export declare class OpenIDAuthDriver extends BaseOAuthDriver {
-    client: Promise<Client>;
+    client: Promise<oidc.Configuration>;
     redirectUrl: string;
     usersService: UsersService;
     config: Record<string, any>;
-    getClient(): Promise<BaseClient>;
+    getClient(): Promise<oidc.Configuration>;
     getredirectUrl(): string;
     getUserService(): UsersService;
     getConfig(): Record<string, any>;
     getClientName(): string;
     constructor(options: AuthDriverOptions, config: Record<string, any>);
-    generateAuthUrl(codeVerifier: string, prompt?: boolean, additionalParams?: AuthorizationParameters | undefined): Promise<string>;
-    getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[TokenSet, Record<string, unknown>, UserPayload]>;
+    generateAuthUrl(codeVerifier: string, prompt?: boolean, additionalParams?: Record<string, string>): Promise<string>;
+    getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers, Record<string, unknown>, UserPayload]>;
 }
 export declare function createOpenIDAuthRouter(providerName: string): Router;

package/dist/auth/drivers/openid.js

@@ -2,9 +2,9 @@ import { BaseException } from '@wbce-d9/exceptions';
 import express, { Router } from 'express';
 import flatten from 'flat';
 import jwt from 'jsonwebtoken';
-import { Issuer, generators } from 'openid-client';
+import * as oidc from 'openid-client';
 import { getAuthProvider } from '../../auth.js';
-import { ACCESS_COOKIE_OPTIONS, OAUTH2_COOKIE_CLEAR_OPTIONS, OAUTH2_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS, } from '../../constants.js';
+import { ACCESS_COOKIE_OPTIONS, OAUTH2_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
 import env from '../../env.js';
 import { InvalidConfigException, InvalidCredentialsException, InvalidTokenException, InvalidPayloadException, } from '../../exceptions/index.js';
 import logger from '../../logger.js';
@@ -48,55 +48,48 @@ export class OpenIDAuthDriver extends BaseOAuthDriver {
         this.redirectUrl = redirectUrl.toString();
         this.usersService = new UsersService({ knex: this.knex, schema: this.schema });
         this.config = additionalConfig;
-        this.client = new Promise((resolve, reject) => {
-            Issuer.discover(issuerUrl)
-                .then((issuer) => {
-                const supportedTypes = issuer.metadata['response_types_supported'];
-                if (!supportedTypes?.includes('code')) {
-                    reject(new InvalidConfigException('OpenID provider does not support required code flow', {
-                        provider: additionalConfig['provider'],
-                    }));
-                }
-                resolve(new issuer.Client({
-                    client_id: clientId,
+        this.client = (async () => {
+            let config;
+            try {
+                config = await oidc.discovery(new URL(issuerUrl), clientId, {
                     client_secret: clientSecret,
-                    redirect_uris: [this.redirectUrl],
-                    response_types: ['code'],
                     ...clientOptionsOverrides,
-                }));
-            })
-                .catch((e) => {
+                });
+            }
+            catch (e) {
                 logger.error(e, '[OpenID] Failed to fetch provider config');
                 process.exit(1);
-            });
-        });
+            }
+            const supportedTypes = config.serverMetadata().response_types_supported;
+            if (supportedTypes && !supportedTypes.includes('code')) {
+                throw new InvalidConfigException('OpenID provider does not support required code flow', {
+                    provider: additionalConfig['provider'],
+                });
+            }
+            return config;
+        })();
     }
     async generateAuthUrl(codeVerifier, prompt = false, additionalParams) {
         try {
             const client = await this.client;
-            const codeChallenge = generators.codeChallenge(codeVerifier);
+            const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
             const paramsConfig = typeof this.config['params'] === 'object' ? this.config['params'] : {};
-            const redirectAfterLogin = additionalParams?.['redirect'];
-            delete additionalParams?.['redirect'];
-            let finalRedirectUri = this.redirectUrl;
-            if (redirectAfterLogin) {
-                const redirectUriWithParams = new URL(this.redirectUrl);
-                redirectUriWithParams.searchParams.set('redirect', redirectAfterLogin);
-                finalRedirectUri = redirectUriWithParams.toString();
-            }
-            return client.authorizationUrl({
+            const params = {
                 scope: this.config['scope'] ?? 'openid profile email',
                 access_type: 'offline',
-                prompt: prompt ? 'consent' : undefined,
                 ...paramsConfig,
                 code_challenge: codeChallenge,
                 code_challenge_method: 'S256',
                 // Some providers require state even with PKCE
                 state: codeChallenge,
                 nonce: codeChallenge,
-                redirect_uri: finalRedirectUri,
+                redirect_uri: this.redirectUrl,
                 ...additionalParams,
-            });
+            };
+            if (prompt) {
+                params.prompt = 'consent';
+            }
+            return oidc.buildAuthorizationUrl(client, params).href;
         }
         catch (e) {
             throw this.handleError(e);
@@ -107,19 +100,18 @@ export class OpenIDAuthDriver extends BaseOAuthDriver {
         let userInfo;
         try {
             const client = await this.client;
-            const codeChallenge = generators.codeChallenge(payload['codeVerifier']);
-            let finalRedirectUri = this.redirectUrl;
-            if (payload['redirect']) {
-                const redirectUriWithParams = new URL(this.redirectUrl);
-                redirectUriWithParams.searchParams.set('redirect', payload['redirect']);
-                finalRedirectUri = redirectUriWithParams.toString();
-            }
-            tokenSet = await client.callback(finalRedirectUri, { code: payload['code'], state: payload['state'], iss: payload['iss'] }, { code_verifier: payload['codeVerifier'], state: codeChallenge, nonce: codeChallenge });
-            userInfo = tokenSet.claims();
-            if (client.issuer.metadata['userinfo_endpoint']) {
+            const codeChallenge = await oidc.calculatePKCECodeChallenge(payload['codeVerifier']);
+            const callbackUrl = new URL(payload['callbackPath'], this.redirectUrl);
+            tokenSet = await oidc.authorizationCodeGrant(client, callbackUrl, {
+                pkceCodeVerifier: payload['codeVerifier'],
+                expectedState: codeChallenge,
+                expectedNonce: codeChallenge,
+            });
+            userInfo = (tokenSet.claims() ?? {});
+            if (client.serverMetadata().userinfo_endpoint) {
                 userInfo = {
                     ...userInfo,
-                    ...(await client.userinfo(tokenSet.access_token)),
+                    ...(await oidc.fetchUserInfo(client, tokenSet.access_token, tokenSet.claims()?.sub ?? oidc.skipSubjectCheck)),
                 };
             }
         }
@@ -159,11 +151,12 @@ export function createOpenIDAuthRouter(providerName) {
             throw new InvalidPayloadException(`URL "${redirect}" can't be used to redirect after login`);
         }
         const token = jwt.sign({ verifier: codeVerifier, redirect, prompt }, env['SECRET'], {
-            expiresIn: '5m',
+            expiresIn: Math.floor(OAUTH2_COOKIE_OPTIONS.maxAge / 1000),
             issuer: 'directus',
         });
-        const additionalParams = { ...req.query };
-        delete additionalParams['prompt'];
+        const additionalParams = Object.fromEntries(Object.entries(req.query)
+            .filter(([k, v]) => k !== 'prompt' && k !== 'redirect' && typeof v === 'string')
+            .map(([k, v]) => [k, v]));
         const authUrl = await provider.generateAuthUrl(codeVerifier, prompt, additionalParams);
         const urlParams = new URL(authUrl);
         const state = urlParams.searchParams.get('state');
@@ -211,13 +204,13 @@ export function createOpenIDAuthRouter(providerName) {
         });
         let authResponse;
         try {
-            res.clearCookie(cookieName, OAUTH2_COOKIE_CLEAR_OPTIONS);
             authResponse = await authenticationService.login(providerName, {
                 code: req.query['code'],
                 codeVerifier: verifier,
                 state: req.query['state'],
                 iss: req.query['iss'],
                 redirect: validRedirectUrl,
+                callbackPath: req.originalUrl,
             });
         }
         catch (error) {

package/dist/constants.js

@@ -85,7 +85,7 @@ export const ACCESS_COOKIE_CLEAR_OPTIONS = (() => {
 export const OAUTH2_COOKIE_OPTIONS = {
     httpOnly: true,
     domain: env['OAUTH2_TOKEN_COOKIE_DOMAIN'] || env['ACCESS_TOKEN_COOKIE_DOMAIN'],
-    maxAge: getMilliseconds(env['OAUTH2_TOKEN_TTL'] || env['ACCESS_TOKEN_TTL']),
+    maxAge: getMilliseconds(env['OAUTH2_TOKEN_TTL']),
     secure: (env['OAUTH2_TOKEN_COOKIE_SECURE'] || env['ACCESS_TOKEN_COOKIE_SECURE']) ?? false,
     sameSite: env['OAUTH2_TOKEN_COOKIE_SAME_SITE'] || 'lax',
     path: '/auth',

package/dist/env.js

@@ -49,6 +49,10 @@ const allowedEnvironmentVars = [
     'REFRESH_TOKEN_COOKIE_SAME_SITE',
     'REFRESH_TOKEN_COOKIE_NAME',
     'REFRESH_TOKEN_OVERLAP_DURATION',
+    'OAUTH2_TOKEN_TTL',
+    'OAUTH2_TOKEN_COOKIE_DOMAIN',
+    'OAUTH2_TOKEN_COOKIE_SECURE',
+    'OAUTH2_TOKEN_COOKIE_SAME_SITE',
     'LOGIN_STALL_TIME',
     'PASSWORD_RESET_URL_ALLOW_LIST',
     'USER_INVITE_URL_ALLOW_LIST',
@@ -235,6 +239,7 @@ const defaults = {
     REFRESH_TOKEN_COOKIE_SAME_SITE: 'lax',
     REFRESH_TOKEN_COOKIE_NAME: 'directus_refresh_token',
     REFRESH_TOKEN_OVERLAP_DURATION: '10s',
+    OAUTH2_TOKEN_TTL: '1d',
     LOGIN_STALL_TIME: 500,
     SERVER_SHUTDOWN_TIMEOUT: 1000,
     ROOT_REDIRECT: './admin',

package/dist/exceptions/forbidden.js

@@ -7,7 +7,7 @@ export class ForbiddenException extends BaseException {
          * We currently don't show the reason for a forbidden exception in the API output, as that
          * has the potential to leak schema information (eg a "No permission" vs "No permission to files"
          * would leak that a thing called "files" exists.
-         * Ref https://github.com/LaWebcapsule/directus9/discussions/4368
+         * Ref https://github.com/LaWebcapsule/d9/discussions/4368
          */
     }
 }

package/dist/utils/generate-hash.js

@@ -1,7 +1,7 @@
 import argon2 from 'argon2';
 import { getConfigFromEnv } from './get-config-from-env.js';
 export function generateHash(stringToHash) {
-    const argon2HashConfigOptions = getConfigFromEnv('HASH_', 'HASH_RAW'); // Disallow the HASH_RAW option, see https://github.com/LaWebcapsule/directus9/discussions/7670#discussioncomment-1255805
+    const argon2HashConfigOptions = getConfigFromEnv('HASH_', 'HASH_RAW'); // Disallow the HASH_RAW option, see https://github.com/LaWebcapsule/d9/discussions/7670#discussioncomment-1255805
     // associatedData, if specified, must be passed as a Buffer to argon2.hash, see https://github.com/ranisalt/node-argon2/wiki/Options#associateddata
     'associatedData' in argon2HashConfigOptions &&
         (argon2HashConfigOptions['associatedData'] = Buffer.from(argon2HashConfigOptions['associatedData']));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.3.0",
+  "version": "12.4.2",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -22,16 +22,16 @@
     "framework",
     "vue"
   ],
-  "homepage": "https://github.com/LaWebcapsule/directus9",
+  "homepage": "https://github.com/LaWebcapsule/d9",
   "bugs": {
-    "url": "https://github.com/LaWebcapsule/directus9/issues"
+    "url": "https://github.com/LaWebcapsule/d9/issues"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/LaWebcapsule/directus9.git",
+    "url": "https://github.com/LaWebcapsule/d9.git",
     "directory": "api"
   },
-  "funding": "https://github.com/LaWebcapsule/directus9?sponsor=1",
+  "funding": "https://github.com/LaWebcapsule/d9?sponsor=1",
   "license": "GPL-3.0-only",
   "author": {
     "name": "Monospace Inc",
@@ -85,7 +85,7 @@
     "openapi3-ts": "3.2.0",
     "ora": "6.3.0",
     "pino": "8.11.0",
-    "rollup": "3.29.5",
+    "rollup": "3.30.0",
     "uuid": "9.0.0",
     "wellknown": "0.5.0",
     "@authenio/samlify-node-xmllint": "2.0.0",
@@ -127,7 +127,7 @@
     "node-machine-id": "1.1.12",
     "nodemailer": "7.0.11",
     "object-hash": "3.0.0",
-    "openid-client": "5.4.0",
+    "openid-client": "6.8.2",
     "otplib": "12.0.1",
     "pino-http": "8.3.3",
     "pino-http-print": "3.1.0",
@@ -143,20 +143,20 @@
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
-    "@wbce-d9/app": "10.0.0",
-    "@wbce-d9/exceptions": "10.0.0",
-    "@wbce-d9/extensions-sdk": "10.0.2",
+    "@wbce-d9/app": "10.0.2",
     "@wbce-d9/constants": "10.0.0",
+    "@wbce-d9/exceptions": "10.0.0",
     "@wbce-d9/schema": "10.0.0",
     "@wbce-d9/specs": "9.26.5",
     "@wbce-d9/storage": "10.0.0",
     "@wbce-d9/storage-driver-azure": "10.0.1",
+    "@wbce-d9/storage-driver-cloudinary": "10.0.1",
+    "@wbce-d9/extensions-sdk": "10.0.2",
     "@wbce-d9/storage-driver-gcs": "10.0.1",
-    "@wbce-d9/storage-driver-s3": "10.0.1",
     "@wbce-d9/storage-driver-local": "10.0.1",
-    "@wbce-d9/utils": "10.0.1",
+    "@wbce-d9/storage-driver-s3": "10.0.1",
     "@wbce-d9/update-check": "10.0.1",
-    "@wbce-d9/storage-driver-cloudinary": "10.0.1"
+    "@wbce-d9/utils": "10.0.1"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
@@ -170,11 +170,11 @@
     "@types/supertest": "2.0.12",
     "@types/uuid": "9.0.1",
     "@types/wellknown": "0.5.4",
-    "@vitest/coverage-v8": "4.1.0",
+    "@vitest/coverage-v8": "4.1.4",
     "@wbce-d9/tsconfig": "2.0.0",
     "supertest": "6.3.3",
     "typescript": "5.0.4",
-    "vitest": "4.1.0",
+    "vitest": "4.1.4",
     "@types/async": "3.2.19",
     "@types/busboy": "1.5.0",
     "@types/bytes": "3.1.1",