feat: use state for authorization instead of caching email

app/controllers/api/v1/accounts/google/authorizations_controller.rb

@@ -3,7 +3,6 @@ class Api::V1::Accounts::Google::AuthorizationsController < Api::V1::Accounts::B
   before_action :check_authorization
 
   def create
-    email = params[:authorization][:email]
     redirect_url = google_client.auth_code.authorize_url(
       {
         redirect_uri: "#{base_url}/google/callback",
@@ -11,19 +10,24 @@ class Api::V1::Accounts::Google::AuthorizationsController < Api::V1::Accounts::B
         response_type: 'code',
         prompt: 'consent', # the oauth flow does not return a refresh token, this is supposed to fix it
         access_type: 'offline', # the default is 'online'
+        state: state,
         client_id: GlobalConfigService.load('GOOGLE_OAUTH_CLIENT_ID', nil)
       }
     )
 
     if redirect_url
-      cache_key = "google::#{email.downcase}"
-      ::Redis::Alfred.setex(cache_key, Current.account.id, 5.minutes)
       render json: { success: true, url: redirect_url }
     else
       render json: { success: false }, status: :unprocessable_entity
     end
   end
 
+  def state
+    # return a signed id for the current account
+    # this is cryptographically verifyable
+    Current.account.to_sgid(expires_in: 15.minutes).to_s
+  end
+
   private
 
   def check_authorization

app/controllers/api/v1/accounts/microsoft/authorizations_controller.rb

@@ -3,23 +3,27 @@ class Api::V1::Accounts::Microsoft::AuthorizationsController < Api::V1::Accounts
   before_action :check_authorization
 
   def create
-    email = params[:authorization][:email]
     redirect_url = microsoft_client.auth_code.authorize_url(
       {
         redirect_uri: "#{base_url}/microsoft/callback",
         scope: 'offline_access https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send openid profile',
+        state: state,
         prompt: 'consent'
       }
     )
     if redirect_url
-      cache_key = "microsoft::#{email.downcase}"
-      ::Redis::Alfred.setex(cache_key, Current.account.id, 5.minutes)
       render json: { success: true, url: redirect_url }
     else
       render json: { success: false }, status: :unprocessable_entity
     end
   end
 
+  def state
+    # return a signed id for the current account
+    # this is cryptographically verifyable
+    Current.account.to_sgid(expires_in: 15.minutes).to_s
+  end
+
   private
 
   def check_authorization