@NonNull
  public URI callback(@NonNull CallbackRequest request) {

    var session = mustFindSession(request.sessionId());

    var idToken =
        session
            .trustedSectoralIdpStep()
            .exchangeSectoralIdpCode(request.code(), session.codeVerifier());

    session = removeSession(request.sessionId());
    if (session == null) {
      throw new ValidationException(new Message("error.invalidSession"));
    }

    var issued = tokenIssuer.issueCode(session, idToken);

    return UriBuilder.fromUri(session.redirectUri())
        .queryParam("code", issued.code())
        .queryParam("state", session.state())
        .build();
  }
@Test
  void callback_unknownSession() {

    var config = new RelyingPartyConfig(null, null);

    var sessionRepo = mock(SessionRepo.class);

    var sut = new AuthService(BASE_URI, config, null, sessionRepo, null, null);

    var sessionId = UUID.randomUUID().toString();

    when(sessionRepo.load(sessionId)).thenReturn(null);

    var req = new CallbackRequest(sessionId, null);

    // when & then
    assertThrows(ValidationException.class, () -> sut.callback(req));
  }