Function authorization_response 

pub fn authorization_response(
    redirect_uri: &str,
    mode: ResponseMode,
    result: &[(&str, &str)],
    state: Option<&str>,
    issuer: &str,
) -> Result<Url, ParseError>

The client’s redirect, carrying an authorization response: result (a code, or an error), then state if the client sent one, then iss, in the query or the fragment as mode says.

iss is RFC 9207’s: this server’s issuer, which a client compares with the authorization server it pushed the request to. The metadata’s authorization_response_iss_parameter_supported promises it, and a client that reads that refuses a response without it.

Parsed rather than concatenated: state is whatever the client sent.