fix(iam): redirect_uri dinamis + validasi CSRF state di OAuthServiceImpl

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

crates/zesdex-iam/src/domain/service.rs

@@ -23,13 +23,28 @@ pub trait SessionService {
 
 /// OAuth flow use-case boundary.
 pub trait OAuthService {
-    /// Start an OAuth authorization-code + PKCE flow.
-    /// Returns the provider's authorization URL to visit.
-    fn start_flow(&self, config: &OAuthConfig) -> anyhow::Result<String>;
+    /// Start an OAuth authorization-code + PKCE flow for the given
+    /// `redirect_uri` (the caller is responsible for actually listening on
+    /// it — e.g. a bound `LoopbackServer`). Returns `(auth_url, state)`:
+    /// the URL to send the user to, and the CSRF state token that must be
+    /// passed back into `complete_flow` unchanged.
+    fn start_flow(
+        &self,
+        config: &OAuthConfig,
+        redirect_uri: &str,
+    ) -> anyhow::Result<(String, String)>;
 
-    /// Complete the OAuth flow by exchanging an authorization code for a
-    /// token.
-    fn complete_flow(&self, config: &OAuthConfig, code: &str) -> anyhow::Result<OAuthToken>;
+    /// Complete the OAuth flow: validates `state` against the value
+    /// persisted during `start_flow` (bailing on mismatch — this is the
+    /// CSRF check), then exchanges `code` for a token using the same
+    /// `redirect_uri` passed to `start_flow`.
+    fn complete_flow(
+        &self,
+        config: &OAuthConfig,
+        redirect_uri: &str,
+        code: &str,
+        state: &str,
+    ) -> anyhow::Result<OAuthToken>;
 
     /// Retrieve the currently stored OAuth token (if any).
     fn get_token(&self) -> anyhow::Result<Option<OAuthToken>>;