Empty update in auth drivers thows an error, preventing login

[florisdipt]

Describe the Bug

I plan to make a PR to replicate the fix for: directus/directus#18595
Since I am encountering it when having google as my only Oauth provider.

Which is:
https://github.com/directus/directus/pull/18607/files

A quick search on this repo yields this result:
https://github.com/search?q=repo%3ALaWebcapsule%2Fdirectus9%20auth_data%3A%20userPayload.auth_data&type=code

Making me think that this fix was never applied here.
Let me know if i oversaw anything.

Here is some off my logs for those interested:

[18:00:37.955] WARN: [OpenID] Unexpected error during OpenID login
    err: {
      "type": "Error",
      "message": "Empty .update() call detected! Update data does not contain any values to update. This will result in a faulty query. Table: directus_users. Columns: auth_data.",
      "stack":
          Error: Empty .update() call detected! Update data does not contain any values to update. This will result in a faulty query. Table: directus_users. Columns: auth_data.
              at QueryCompiler_MySQL._prepUpdate (/node_modules/knex/lib/query/querycompiler.js:1365:13)
              at QueryCompiler_MySQL.update (/node_modules/knex/lib/dialects/mysql/query/mysql-querycompiler.js:108:26)
              at QueryCompiler_MySQL.toSQL (/node_modules/knex/lib/query/querycompiler.js:75:29)
              at QueryBuilder_MySQL.toSQL (/node_modules/knex/lib/query/querybuilder.js:84:44)
              at ensureConnectionCallback (/node_modules/knex/lib/execution/internal/ensure-connection-callback.js:4:30)
              at Runner.ensureConnection (/node_modules/knex/lib/execution/runner.js:318:20)
              at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
              at async Runner.run (/node_modules/knex/lib/execution/runner.js:30:19)
              at async file:///node_modules/@wbce-d9/api/dist/services/items.js:471:21
    }

From my package-lock.json:

    "node_modules/@wbce-d9/directus9": {
      "version": "10.3.4",
      "resolved": "https://registry.npmjs.org/@wbce-d9/directus9/-/directus9-10.3.4.tgz",
      "integrity": "sha512-GO+eiSg/YAICDmXwcOFfHGoWnUA7ejdgDmXatVp421Nks0dW1f6DKLm6jSqTzcrX/4TXeDKk9mTdSXzmFBzdxw==",
      

To Reproduce

Login with google, log out, attempt to login again

Directus Version

@wbce-d9/directus9 10.3.4

Hosting Strategy

Self-Hosted (Custom)

[florisdipt]

I've tried to fix this by replicating the "fix" to api/src/auth/drivers/baseoauth.ts:87 but it did not fix the issue unfortunately, at this moment I do not the time to setup a full testing env to test this throughly locally, but i have reproduced this multiple times. Im quite confident this a bug right now unless i'm missing something.

I am thus no longer planning to make a PR

[sofiachakir]

Hello @florisdipt,

Thank you for raising this issue.
Regarding the fix that's already available in the official Directus repository, we are unable to copy it due to the repository's Business Source License.
That said, we welcome contributions — feel free to open a pull request if you'd like to help address this problem. On our side, we fix all security issues and any functional issues we run into during development. However, we haven’t encountered the specific issue you mentioned so far.

Thanks again for your input!

[ps-rseidl]

We hit the same issue with Azure AD (Microsoft Entra ID) as the OpenID provider and traced the root cause.

Root Cause

In baseoauth.ts → getUserID(), the auth_data from getTokenSetAndUserInfo() is undefined when the provider doesn't return a refresh_token. This gets passed directly to Knex's .updateOne():

// baseoauth.ts, getUserID()
await this.getUserService().updateOne(userId, {
    ...updatedUserPayload,
    auth_data: userPayload.auth_data,  // undefined when no refresh_token
});

Knex rejects the empty update → crash.

Fix

auth_data: userPayload.auth_data ?? null

Sends explicit null instead of undefined. Knex accepts null for nullable columns. In my opinion, the ?? null fix is trivially independent of the BSL-licensed Directus fix — it's the only way to handle a nullable column with Knex.

Important: This alone is not enough

Even after fixing the crash, the else branch in refresh() (added in PR #45) (Lines 196–200 in api/src/auth/drivers/baseoauth.ts) will throw InvalidCredentialsException immediately after login if no refresh token was stored — because login() delegates to refresh().

The complete solution is two-fold:

1. Apply the ?? null fix to prevent the Knex crash
2. Ensure the OAuth provider is configured to return a refresh token:
   • Azure AD / Microsoft Entra ID: Add offline_access to the scope:

     AUTH_MICROSOFT_SCOPE env var contains 'offline_access'
     

   • Google: Add offline_access to the scope or configure access_type=offline

Without a refresh token, the strict session enforcement in refresh() correctly rejects the session — the provider just needs to be configured to supply one.

Additional issue: redirect_uri breaks strict OAuth providers

Separately, PR #163 appends ?redirect=<url> to the redirect_uri sent to the OAuth provider. Azure AD enforces exact redirect_uri matching and rejects this with [AADSTS50011](https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-code-aadsts50011-redirect-uri-mismatch). The redirect target should be stored in the JWT cookie/state only (as original Directus 9 did), not appended to the callback URL.

PRs for fixing both issues

• Fix login crash for OAuth/OpenID providers that don't return a refresh token: Fix login crash for OAuth/OpenID providers that don't return a refresh token (#127) #251

• Fix OpenID login failure caused by dynamic redirect_uri breaking strict providers like Azure AD: Fix OpenID login failure caused by dynamic redirect_uri breaking strict providers like Azure AD #252