fix(pav-6): fix LinkedIn provider signature and add email validation

- Fix exchangeLinkedinCode to match ExchangeCodeParams interface
- Use callbackUrl + expectedState like Google provider
- Add email validation in handleCallback — reject profiles without email
- Add integration tests for LinkedIn callback and email-absent case

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 2 people

backend/src/modules/auth/auth.service.ts

@@ -35,6 +35,10 @@ export class AuthService {
       callbackUrl,
     });
 
+    if (!profile.email) {
+      throw new Error("oauth_email_required");
+    }
+
     const user = await findOrCreateUser({
       provider,
       profile,

backend/src/modules/auth/providers/linkedin.ts

@@ -3,7 +3,7 @@ import {
   buildAuthorizationUrl,
   discovery,
 } from "openid-client";
-import { OAuthProfile } from "../../types/auth.types";
+import { ExchangeCodeParams, OAuthProfile } from "../../types/auth.types";
 
 let _config: Awaited<ReturnType<typeof discovery>> | null = null;
 
@@ -32,20 +32,18 @@ export async function getLinkedinAuthUrl(state: string): Promise<string> {
 }
 
 export async function exchangeLinkedinCode({
-  code,
+  callbackUrl,
   state,
-}: {
-  code: string;
-  state?: string;
-}): Promise<OAuthProfile> {
+}: ExchangeCodeParams): Promise<OAuthProfile> {
   const config = await getConfig();
 
-  const tokens = await authorizationCodeGrant(
-    config,
-    new URL(
-      `${process.env.APP_URL}/auth/linkedin/callback?code=${code}&state=${state}`,
-    ),
-  );
+  if (!state) {
+    throw new Error("State ausente");
+  }
+
+  const tokens = await authorizationCodeGrant(config, new URL(callbackUrl), {
+    expectedState: state,
+  });
 
   const claims = tokens.claims();
 

backend/tests/integration/routes/auth.routes.test.ts

@@ -282,6 +282,33 @@ describe("Integration - Auth Routes", () => {
 
       expect(res.headers.location).toContain("/login?error=oauth_failed");
     });
+
+    it("redireciona ao frontend em callback valido para linkedin", async () => {
+      const res = await request(app)
+        .get(`${BASE}/linkedin/callback?code=li-code-123&state=valid-state-abc123`)
+        .expect(302);
+
+      expect(res.headers.location).toContain("/auth/callback");
+      expect(mockAuthService.handleCallback).toHaveBeenCalledWith(
+        expect.objectContaining({
+          provider: "linkedin",
+          code: "li-code-123",
+          state: "valid-state-abc123",
+        }),
+      );
+    });
+
+    it("redireciona com erro quando profile nao tem email", async () => {
+      mockAuthService.handleCallback.mockRejectedValueOnce(
+        new Error("oauth_email_required"),
+      );
+
+      const res = await request(app)
+        .get(`${BASE}/linkedin/callback?code=abc123&state=valid-state-abc123`)
+        .expect(302);
+
+      expect(res.headers.location).toContain("/login?error=oauth_failed");
+    });
   });
 
   // ── POST /register ────────────────────────────────────────────────────────