Mint Wasp sessions for external auth providers, with dual sign-out

[FranjoMindek]

Part of the pluggable auth provider stack (9/9, on top of #4730).

Description

Wasp now mints its own first-party session for external auth providers, the way Rails, Django, and ASP.NET Core do it. The provider is consulted exactly twice:

• Login: POST /auth/login exchanges the provider's credential (Clerk token, Better Auth token) for a Wasp session, JIT-provisioning the local user in the same step. Every subsequent request authenticates against Wasp's own Session row — the provider is off the request hot path, so per-request latency and provider outages no longer touch request auth.
• Logout: dual sign-out, modeled on ASP.NET Core's two-scheme SignOut (and laravel/workos). Wasp always revokes its own session, and — where the provider implements SupportsSessionRevocation — best-effort revokes the provider session the login was exchanged from (its id is stored on the Wasp session row in the new nullable providerSessionId column). Upstream failure is logged, never blocks logout. A logout inside the provider's own UI also ends the Wasp session (the client adapter observes the credential disappearing).

The session machinery behind all this is extracted into wasp/server/auth/sessionStore — Wasp's own create/validate/revoke API, with lucia as the private implementation detail behind one module (also the seam for migrating off the deprecated lucia later). waspAuthProvider and the exchange both sit on it, so Wasp's own auth and external providers now share one session layer, one Session table, and one logout path.

Client side: apps with a client adapter get the exchange automatically (single-flight, on the first API call after a provider login); hand-written integrations call the new public exchangeCredentialForSession(credential).

Documented, accepted gap (shared by every framework that mints its own sessions; it is why OIDC has four logout specs): revoking a session on the provider's side does not end an already-exchanged Wasp session — it lives until expiry or app logout. session.ts and the example READMEs state this explicitly.

Verified live with the Better Auth example: exchange mints a Session row pointing at the BA session; the BA token no longer authenticates requests directly (401); POST /auth/logout deletes both rows; the old Wasp session and a re-exchange of the revoked BA token both 401. See examples/auth-providers/better-auth/README.md for the transcript.

Existing apps need a wasp db migrate-dev for the additive nullable column (migrations included for all four example apps).

Type of change

• 🔧 Just code/docs improvement
• 🐞 Bug fix
• 🚀 New/improved feature
• 💥 Breaking change

Checklist

• I tested my change in a Wasp app to verify that it works as intended.

• 🧪 Tests and apps:

  • I added unit tests for my change.
  • (if you fixed a bug) I added a regression test for the bug I fixed.
  • (if you added/updated a feature) I added/updated e2e tests in examples/kitchen-sink/e2e-tests.
  • (if you added/updated a feature) I updated the starter templates in waspc/data/Cli/templates, as needed.
  • (if you added/updated a feature) I updated the example apps in examples/, as needed.
    • (if you updated examples/tutorials) I updated the tutorial in the docs (and vice versa).

• 📜 Documentation:

  • (if you added/updated a feature) I added/updated the documentation in web/docs/.

• 🆕 Changelog: (if change is more than just code/docs improvement)

  • I updated waspc/ChangeLog.md with a user-friendly description of the change.
  • (if you did a breaking change) I added a step to the current migration guide in web/docs/migration-guides/.
  • I bumped the version in waspc/waspc.cabal to reflect the changes I introduced.

[pkg-pr-new]

Open in StackBlitz

@wasp.sh/spec

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/spec@4764

@wasp.sh/wasp-cli

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/wasp-cli@4764

@wasp.sh/wasp-cli-darwin-arm64-unknown

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/wasp-cli-darwin-arm64-unknown@4764

@wasp.sh/wasp-cli-darwin-x64-unknown

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/wasp-cli-darwin-x64-unknown@4764

@wasp.sh/wasp-cli-linux-arm64-glibc

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/wasp-cli-linux-arm64-glibc@4764

@wasp.sh/wasp-cli-linux-x64-glibc

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/wasp-cli-linux-x64-glibc@4764

@wasp.sh/wasp-cli-linux-x64-musl

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/wasp-cli-linux-x64-musl@4764

commit: 4b8744f