@Override
  public Token redeem(@NonNull String code, String redirectUri, String clientId) {

    var redeemed = codeRepo.remove(code).orElse(null);
    if (redeemed == null) {
      return null;
    }

    if (!validateCode(redeemed, redirectUri, clientId)) {
      return null;
    }

    var accessTokenTtl = Duration.ofMinutes(5);
    return new Token(
        issueAccessToken(accessTokenTtl, redeemed.clientId()),
        issueIdToken(redeemed.clientId(), redeemed.nonce(), redeemed.federatedIdToken()),
        accessTokenTtl.getSeconds());
  }
@Test
  void redeem_nonExisting() {
    var issuer = URI.create("https://idp.example.com");
    var keyStore = mock(KeyStore.class);
    var codeRepo = mock(CodeRepo.class);

    var sut = new TokenIssuerImpl(issuer, keyStore, codeRepo);

    var code = UUID.randomUUID().toString();

    var token = sut.redeem(code, null, null);

    verify(codeRepo).remove(code);
    assertNull(token);
  }