Reference parent-consent authorize leg (sandbox)

Sandbox only. The reference OAuth provider is hosted on the census host root (not /api/v1) and gated on PHOSRA_ENV==sandbox — 404 on dev, staging, and production.

The first leg of the sandbox reference OAuth flow, seeded with the test family (Mia / Leo / Ava). With no decision it renders an HTML consent page. Its machine-usable contract: add decision=approve and the census issues an authorization code and 302-redirects to redirect_uri?code=…&state=… — so CI can automate approval with no HTML scraping. decision=deny redirects with error=access_denied&state=…. Custom mobile schemes (e.g. propagate://) are allowed as redirect_uri.

Phosra sandbox reference-provider consent page: a card titled 'Connect your family to this app?' with a 'Sandbox reference provider' pill and Approve / Deny buttons. — The seeded sandbox consent page rendered by GET /oauth/authorize (no decision param).

Worked example

Fully runnable — this leg is unsigned:

bash
# Render the consent page (200, text/html):
curl "https://phosra-api-sandbox-production.up.railway.app/oauth/authorize?redirect_uri=https://example.com/cb&state=xyz123"
 
# Machine path — approve and capture the 302 Location header:
curl -sD - -o /dev/null \
  "https://phosra-api-sandbox-production.up.railway.app/oauth/authorize?redirect_uri=https://example.com/cb&state=xyz123&decision=approve" \
  | grep -i '^location:'

Example 302 on approve (one-time code redacted):

http

HTTP/2 302
location: https://example.com/cb?code=sbxauth_REDACTED_ONE_TIME_CODE&state=xyz123

Exchange the sbxauth_… code at POST /oauth/token.