Presentation-only consent UI for the HDIG SMART App Launch flow (ADR-0057F-PA-07). hdig-auth-server owns the OAuth flow, the consent challenge lifecycle, the HRex Consent write, and token issuance — this service only renders the consent form and relays the patient's decision.
GET /consent?consent_challenge={opaque} — renders the consent form. The single-use, 15-minute consent_challenge is issued by hdig-auth-server; it is the only parameter and the only consent-related value that ever appears in a browser URL.POST /api/consent/decision — CSRF-protected form post (approve/deny + selected scopes). The decision is relayed to hdig-auth-server, which responds with a consent_verifier; the browser is then redirected to /oauth2/authorize/consent-callback to resume the code grant.