Function oauth_authorize 

pub(crate) async fn oauth_authorize(
    __arg0: State<AppState>,
    peer: Peer,
    query: Result<Query<OAuthAuthorizeQuery>, QueryRejection>,
    headers: HeaderMap,
) -> Response

GET /oauth/authorize

Answers every load of a pushed request this server holds, which RFC 9126 §4 allows, with what crate::oauth::authorize::answer decides: the page while the account has not answered, and after it approved.

A code an approval held for a browser goes, as 303 See Other to the client’s redirect, to a top-level navigation by a browser whose crate::oauth::browser::COOKIE names a session signed in as the account, once. Sec-Fetch-Dest tells a navigation apart where a browser sends it. Any other browser gets the page, approved and reloading, until the request expires, which is logged with the account. A decline, a verdict that grants nothing, or an expiry answers 303 See Other to the client’s redirect with access_denied.

A load that meets crate::oauth::authorize::confirms_unasked first approves the sign-in on the account’s remembered approval, so that browser collects the code without the account being asked.

Nothing is decided here: see crate::oauth::decision for why the verdict is reached at PAR. Every answer carries Cache-Control: no-store, since the page changes when the account answers, and the landing page’s content security policy.