Function answer 

pub fn answer(
    par_store: &dyn ParStore,
    decisions: &dyn DecisionStore,
    request_uri: &str,
    client_id: &str,
    loader: &Loader,
    now: OffsetDateTime,
) -> Result<AuthorizeAnswer, AuthorizeError>

Answers one load of the page for request_uri, by loader, at now.

The page, while the account has not answered. Once it approves, the redirect the approval held for a browser goes to a top-level navigation by a browser signed in as the record’s account, once (DecisionStore::collect). Any other load gets the page, approved and reloading, until the request expires, and then access_denied. An approval that held nothing gets the page, with no code on it: its code went to what approved it. A decline, a verdict that grants nothing, or a request that expired first is a Denial: the browser goes to the client with access_denied (RFC 6749 §4.1.2.1).

RFC 9126 §4 allows a reload of the same request_uri, so nothing here spends it. PKCE leaves a code useless to anything but the client that pushed the request.