Start the Google Services (per-user) OAuth consent flow

Begins a Google OAuth 2.0 authorization-code flow scoped to the per-user services the caller requests (Gmail / Drive / Calendar / Sheets / Docs). Generates a CSRF state, stores it in req.session.oauth_state along with the caller’s userId and institution context, then 302-redirects to Google’s consent screen with access_type=offline and prompt=consent to ensure a refresh token is issued.

Storage routing (Option B):

• If the JWT has an institution attached, the resulting token is stored on UserInstitution.googleLoginToken (institution-specific).
• If there is no institution, it goes on User.googleLoginToken (personal).

Origin handling: the origin query param (profile default, chat for the in-chat consent prompt) is preserved in the session so the post-callback redirect returns the user to the right place.

GET /api/auth/google/services/authorize

Start the Google Services (per-user) OAuth consent flow

cURL

curl --request GET \
  --url https://pria.praxislxp.com/api/auth/google/services/authorize \
  --header 'Authorization: Bearer <token>'

400

{
  "error": "No services specified"
}

Authorizations

Authorization · string · header · required

JWT token passed in authorization header

Query Parameters

scopes · string · required

Comma-separated list of Google service names to request. Each name is expanded via GoogleServicesConfig.buildScopes. Common values: gmail, drive, calendar, sheets, docs.

origin · enum<string> · default: profile

Where the user was when they triggered the consent. Controls the post-callback redirect — chat returns to the chat page, profile returns to the profile page.

Available options: profile, chat

Response

302

Redirect to Google's OAuth consent screen.