@NonNull
  public URI selectedIdentityProvider(@NonNull SelectedIdpRequest request) {

    var selectedIdp = request.selectedIdentityProvider();
    if (selectedIdp == null || selectedIdp.isBlank()) {
      throw new ValidationException(new Message("error.noProvider"));
    }

    var session = mustFindSession(request.sessionId());

    var step2 = session.selectSectoralIdpStep().redirectToSectoralIdp(selectedIdp);

    var federatedLogin = step2.idpRedirectUri();

    var newSession = session.toBuilder().trustedSectoralIdpStep(step2).build();

    sessionRepo.save(newSession);

    return federatedLogin;
  }
@Test
  void selectIdp() {

    var sessionRepo = mock(SessionRepo.class);

    var sessionId = IdGenerator.generateID();
    var selectIdpStep = mock(SelectSectoralIdpStep.class);

    var selectedIdpIssuer = "https://aok-testfalen.example.com";

    var idpRedirect = URI.create(selectedIdpIssuer).resolve("/auth/login");

    var trustedIdpStep = mock(TrustedSectoralIdpStep.class);
    when(selectIdpStep.redirectToSectoralIdp(selectedIdpIssuer)).thenReturn(trustedIdpStep);
    when(trustedIdpStep.idpRedirectUri()).thenReturn(idpRedirect);

    var session = Session.create().id(sessionId).selectSectoralIdpStep(selectIdpStep).build();
    when(sessionRepo.load(sessionId)).thenReturn(session);

    var sut = new AuthService(BASE_URI, null, null, sessionRepo, null, null);

    var req = new SelectedIdpRequest(sessionId, selectedIdpIssuer);

    // when
    var res = sut.selectedIdentityProvider(req);

    // then
    assertEquals(idpRedirect, res);

    var captor = ArgumentCaptor.forClass(Session.class);
    verify(sessionRepo).save(captor.capture());

    var savedSession = captor.getValue();
    assertEquals(trustedIdpStep, savedSession.trustedSectoralIdpStep());
  }