Fully agree if you need the session. Then yeah some kind of delegation/abstraction is required. Especially for social/3rd party login. The missed I've seen is

Fully agree if you need the session. Then yeah some kind of delegation/abstraction is required. Especially for social/3rd party login. The missed I've seen is simple that oidc was used on multiple levels to facilitate a login flow and the sessions discarded afterwards