OAuth 2.0 used for authentication by Google makes sense given that the server and client both trust Google but not each other.
As I understand the authorization code is passed back to the server (in server side flow) as a URL parameter. To prevent security issues like the confused deputy, the authorization code is a one time use and the server can use the authorization code to obtain an access token and refresh token.
My question is why can't this process be simplified if Google (a trusted entity) directly sends the access token to the server (and not through the client)? This would eliminate the need for an authorization code. Google can be sure it's sending the access token to the right place because the client would have registered the
redirect_uri with Google beforehand. It seems to be a general pattern that these protocols have the identity provider only send things to the server through the client.