I am writing an App and am trying to leverage Google for A&A. The app itself relies on access to the users Google Calendar, and so initially I leveraged their updated OAUTH2 library for A&A.

Here is my flow:

User goes to the index.html which has "https://accounts.google.com/gsi/client" script and google.accounts.oauth2.initCodeClient is called with my client_id, scopes, redirect url

    <script src="https://accounts.google.com/gsi/client"></script>
    <script>
      let client;
      function initClient() {
        client = google.accounts.oauth2.initCodeClient({
          client_id: 'xxxxx-xxxx.apps.googleusercontent.com',
          scope:
            'https://www.googleapis.com/auth/userinfo.profile \
           https://www.googleapis.com/auth/userinfo.email \
           https://www.googleapis.com/auth/calendar.readonly \
           https://www.googleapis.com/auth/calendar.events',
          ux_mode: 'redirect',
          redirect_uri: 'http://localhost:5000/oauth2callback',
        });
      }
      // Request an access token
      function getAuthCode() {
        client.requestCode();
      }

The user clicks the login button, which kicks off requestCode() and they begin the login flow. They login or select their google account, then besides the unapproved app screen, they get to the consent screen with my requested scopes.

After, they are redirected to my expressjs endpoint and using the "googleapis" library I exchange with id_token for the access and refresh tokens.

...
 const { tokens } = await oauth2Client.getToken(req.query.code); //exchange code for tokens
  const userInfo = (
    await oauth2Client.verifyIdToken({
      idToken: tokens.id_token,
      audience: config.google.clientID,
    })
  ).payload;

  if (!indexBy.email[userInfo.email]) { // check if user exists 
    const newUser = {
      name: userInfo.name,
      email: userInfo.email,
      o_id: userInfo.sub,
      picture: userInfo.picture,
      r_token: tokens.refresh_token,
    };
...

Ok, all good.... but not quite. The problem is, that next time the user wants to login to the app, they go through the entire flow again, including the consent screen (again).

So, after going through more docs, even looking at examples from google. I was surprised and I noticed that many of those apps used the passport oauth2 plugin :( Something i've done in the past, but was hoping to avoid that with the recently updated Google client and nodejs libraries.

Ok, how to not prompt for consent screen on subsequent logins?

Maybe separate A&A, so first I use "Sign In With Google" for Authentication, then when I get the user info, check if the user is already registered (hence I have already saved the refresh token) and they start the app.

On the other hand, if they are new (not in existing app user collection), after authenticating, I will then call the OAUTH2 authorization redirect, so again they on Googles site, this time to do the scopes api confirmation.

So, first question, is that the best practice with most apps with leverage a Google API via OAuth? To first Authenticate, then possibility Authorize (as needed). Hopefully this will still work ok when things come up with expired/invalid refresh token (fingers crossed the default google library handles that).

When doing the Authorize for consent, can I pass something from the previous Authenticate flow so they don't need to do that again.

Or maybe when doing the Authenticate process (Google Identity Service), there is some flag or param so that if they have already consented, they don't have to do that again on subsequent logins.

Incase I wasn't clear, in a nutshell the question is: should I be doing Authenticate for login, separately from Authorization (oauth2 token). Or should I go right into the Authorization flow, which first Authenticates the user, and can I skip the Authorization consent screens if they've already done that. Or maybe there's another way which is the best practice.

Thanks for your attention.