@NonNull
  public URI callback(@NonNull CallbackRequest request) {

    var session = mustFindSession(request.sessionId());

    var idToken =
        session
            .trustedSectoralIdpStep()
            .exchangeSectoralIdpCode(request.code(), session.codeVerifier());

    session = removeSession(request.sessionId());
    if (session == null) {
      throw new ValidationException(new Message("error.invalidSession"));
    }

    var issued = tokenIssuer.issueCode(session, idToken);

    return UriBuilder.fromUri(session.redirectUri())
        .queryParam("code", issued.code())
        .queryParam("state", session.state())
        .build();
  }
@Test
  void callback() {

    var config = new RelyingPartyConfig(List.of("code"), List.of(REDIRECT_URI));

    var sessionRepo = mock(SessionRepo.class);
    var tokenIssuer = mock(TokenIssuer.class);

    var sut = new AuthService(BASE_URI, config, null, sessionRepo, tokenIssuer, null);

    var sessionId = UUID.randomUUID().toString();

    var state = "mySuperDuperState";
    var nonce = "20e5ed8b-f96b-48de-ae73-4460bcfc35a1";
    var clientId = "myapp";

    var trustedIdpStep = mock(TrustedSectoralIdpStep.class);

    var session =
        Session.create()
            .id(sessionId)
            .state(state)
            .nonce(nonce)
            .redirectUri(REDIRECT_URI)
            .clientId(clientId)
            .trustedSectoralIdpStep(trustedIdpStep)
            .build();

    when(sessionRepo.load(sessionId)).thenReturn(session);
    when(sessionRepo.remove(sessionId)).thenReturn(session);

    var code = "6238e4504332468aa0c12e300787fded";

    when(trustedIdpStep.exchangeSectoralIdpCode(code, null)).thenReturn(null);

    var issued = new Code(code, null, null, REDIRECT_URI, nonce, clientId, null);
    when(tokenIssuer.issueCode(session, null)).thenReturn(issued);

    var req = new CallbackRequest(sessionId, null);

    // when
    var res = sut.callback(req);

    // then
    assertEquals(
        "https://myapp.example.com?code=6238e4504332468aa0c12e300787fded&state=mySuperDuperState",
        res.toString());

    verify(sessionRepo).remove(sessionId);
  }