@GET
  @Produces(MediaType.TEXT_HTML)
  public Response auth(
      @QueryParam("scope") String scope,
      @QueryParam("state") String state,
      @QueryParam("response_type") String responseType,
      @QueryParam("client_id") String clientId,
      @QueryParam("redirect_uri") String redirectUri,
      @QueryParam("nonce") String nonce,
      @HeaderParam("Accept-Language") @DefaultValue("de-DE") String acceptLanguage) {

    var uri = mustParse(redirectUri);

    var res =
        authService.auth(
            new AuthorizationRequest(scope, state, responseType, clientId, uri, nonce));

    var locale = getNegotiatedLocale(acceptLanguage);
    var form = pages.selectIdpForm(res.identityProviders(), locale);

    return Response.ok(form, MediaType.TEXT_HTML_TYPE)
        .cookie(createSessionCookie(res.sessionId()))
        .build();
  }
@Test
  void auth_badRequest() {

    var authService = mock(AuthService.class);
    doThrow(ValidationException.class).when(authService).auth(any());
    var sut = new AuthEndpoint(authService);

    var scope = "openid";
    var state = UUID.randomUUID().toString();
    var nonce = UUID.randomUUID().toString();
    var responseType = "badtype";
    var clientId = "myapp";
    var language = "de-DE";

    // when & then
    assertThrows(
        ValidationException.class,
        () -> sut.auth(scope, state, responseType, clientId, REDIRECT_URI, nonce, language));
  }