Validate authorization response state in MSAL Node middleware

[Robbie-Microsoft]

Pull Request

Purpose

• Validate that the authorization response state matches the state stored in the session before redeeming the authorization code.
• Use the documented one-argument ConfidentialClientApplication.acquireTokenByCode API.
• Add focused tests for matching, missing, and mismatched state values and the token redemption call shape.

Does this introduce a breaking change

    [ ] Yes
    [x] No

Pull request type

    [x] Bugfix
    [ ] Feature
    [ ] Code style update (formatting, local variables)
    [ ] Documentation content changes
    [ ] Other... Please describe:

How to test

• From Common/msal-node-wrapper, run:

    npm ci
    npm test -- --runInBand test/middleware/handlers/redirectHandler.spec.ts
    npx tsc --noEmit
    npx eslint src/middleware/handlers/redirectHandler.ts test/middleware/handlers/redirectHandler.spec.ts

What to check

• A matching authorization response state allows token redemption and redirect handling to continue.
• Missing or mismatched state is rejected before token redemption.
• acquireTokenByCode receives only the authorization code request.

Other Information

N/A

assistance: agentic-cli
type: bug
agent-tool: copilot-cli
agent-model: gpt-5.6-sol
work-item: AB#n/a