Consent Endpoint

Handle user consent decision (Allow/Deny).

Form Data: auth_context_id: Authorization context ID from Redis action: "allow" or "deny"

Returns: Redirect to client's redirect_uri with: - code and state (if allowed) - error=access_denied and state (if denied)

Flow: 1. Parse form data (auth_context_id, action) 2. Retrieve authorization context from Redis 3. Delete context (single-use) 4. If denied: redirect with error=access_denied 5. If allowed: generate authorization code, store in DB, redirect with code

Security Notes: - Authorization context is single-use (deleted after retrieval) - Authorization code is single-use (128 characters, cryptographically random) - Code expires after 10 minutes - PKCE challenge stored for later verification

Example Redirect (Allow): https://example.com/callback?code=abc...&state=xyz

Example Redirect (Deny): https://example.com/callback?error=access_denied&state=xyz