Authorize

Check the request, then send the person to Admiral to decide.

Everything that can be validated without knowing who the person is happens here, because an error discovered now can be reported honestly. Once the request is known good it is handed to the web app's consent screen as opaque query parameters; the screen shows the client's name and the accounts this person actually has, and posts back a decision.

A bad redirect_uri never redirects. That is the one error in OAuth that must be shown rather than sent, since sending it is the attack.