fix(iam): redirect_uri dinamis + validasi CSRF state di OAuthServiceImpl

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

crates/zesdex-iam/src/infrastructure/http/dto.rs

@@ -41,19 +41,23 @@ pub struct SessionListResponse {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct OAuthStartRequest {
     pub config: OAuthConfig,
+    pub redirect_uri: String,
 }
 
-/// Response containing the authorization URL for an OAuth flow.
+/// Response containing the authorization URL and CSRF state for an OAuth flow.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct OAuthStartResponse {
     pub auth_url: String,
+    pub state: String,
 }
 
 /// Request body for completing an OAuth flow with an authorization code.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct OAuthCompleteRequest {
     pub config: OAuthConfig,
+    pub redirect_uri: String,
     pub code: String,
+    pub state: String,
 }
 
 /// Response containing the acquired OAuth token.

crates/zesdex-iam/src/infrastructure/http/handlers.rs

@@ -49,8 +49,8 @@ pub fn handle_start_oauth<O: OAuthService>(
     service: &O,
     req: OAuthStartRequest,
 ) -> anyhow::Result<OAuthStartResponse> {
-    let auth_url = service.start_flow(&req.config)?;
-    Ok(OAuthStartResponse { auth_url })
+    let (auth_url, state) = service.start_flow(&req.config, &req.redirect_uri)?;
+    Ok(OAuthStartResponse { auth_url, state })
 }
 
 /// Handle a complete-OAuth-flow request.
@@ -58,7 +58,7 @@ pub fn handle_complete_oauth<O: OAuthService>(
     service: &O,
     req: OAuthCompleteRequest,
 ) -> anyhow::Result<OAuthTokenResponse> {
-    let token = service.complete_flow(&req.config, &req.code)?;
+    let token = service.complete_flow(&req.config, &req.redirect_uri, &req.code, &req.state)?;
     Ok(OAuthTokenResponse { token })
 }