The authorization endpoint (RFC 6749 §4.1.1, OAuth 2.1) and the consent decision that goes with it.

Mounted by Noizu.MCP.Auth.Server.Router at GET /oauth/authorize and POST /oauth/consent. Needs a session pipeline (it redirects a browser through your login and renders a form) but must not require an authenticated user — resolving that is this endpoint's job.

The flow

1. Validate the request. client_id resolves to a client (a stored one, or a CIMD document fetched under the SSRF guard); redirect_uri matches one the client registered. Until both hold, every error is a rendered page — never a redirect. Afterwards, errors go back to the validated URI as ?error=, which is what a client needs to fail cleanly.
2. PKCE, mandatory. code_challenge with code_challenge_method=S256. Absent or plain is invalid_request, for confidential clients too.
3. Park the request. Everything is written to login state under a random key; only that key travels in URLs, so no scope, challenge or state ends up in the host's access logs.
4. Authenticate the human through Noizu.MCP.Auth.Server.Upstream — normally the host's own session. Not logged in ⇒ redirect to the host's login with a return_to that lands back here.
5. Consent, mandatory for registered and CIMD clients, CSRF-protected, and re-prompted when the requested scope broadens.
6. Issue the code and redirect with code, the client's state, and iss (RFC 9207).

An inbound Authorization header is never consulted for identity: an access token this server issued must not be usable to mint another.