Add typed OAuth with session support

[zibet27]

Subsystem
Server Auth

Motivation
https://github.com/ktorio/ktor-klip/blob/zibet27/auth-3.5/proposals/0006-auth-3.5.md

Why oauthWithSession

The existing OAuth provider is useful for completing the OAuth callback and obtaining an OAuthAccessTokenResponse, but it is easy to read it as a provider that can protect application routes directly.

That is misleading for typical web login flows: OAuth authenticates only the callback request. It does not persist the login state, create an application principal, or protect later requests. Applications still need to map the token response to their own session/principal and then use session authentication for protected routes.

oauthWithSession makes this pattern explicit:

• OAuth handles the redirect/callback flow.
• The callback maps the OAuth token response to an application session.
• Protected routes authenticate via that session and expose a typed principal.

This keeps the OAuth provider focused on OAuth, while giving users a typed, end-to-end login flow that matches how OAuth is commonly used in server-side applications.

This is still a question if we want to just provide typed DSL for oauth or oauthWithSession, as shown in this PR

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 30be41e1-ed04-4937-8754-b3bc14a3a90d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch typed-oauth-with-session

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[osipxd]

Could you pull the latest main? Failing tests seem to be fixed in the main branch.