Patient Portal OAuth Login: Explicit Consent and Refresh Token Rotation in Node.js

When using OAuth to log into a patient portal, it's important to remember that the system should not automatically grant access to specific categories of health data. The developer must keep the decisions about identity, consent, and session lifetime separate. If a highly controlled environment is needed, a programmable solution may be preferable to a managed provider.

When a user logs in through an OAuth callback, the first step is to show them the specific data category they are about to access, along with the purpose and action that will trigger the read. For instance, instead of saying "improve your experience," the system should explain "Medication history, used to pre-fill the refill form when you open it."

After establishing a local account, the system must verify the current consent state before accessing any protected data. This can be a granted, revoked, or absent state, and the UI must reflect that state even if the user has left the browser tab open. If a user revokes consent, any subsequent API call attempting to process data should not be allowed. The audit record should capture the state transition, the category, actor, timestamp, and request identifier.

When implementing refresh token rotation, the system should issue a new refresh token upon refresh and invalidate the previous one. The session should also be revoked if there's suspicion of a replay or stolen device. Old tokens should never appear in logs. In a small Node.js control path, the code checks consent before a data read and provides an explicit session revoke path. It uses only documented auth routes and handles retries according to the Retry-After header, without silently retrying other failures.