open-index/open-npm huggingface dataset:
npm package: @mastergnou/auth-contracts
Description: Shared Mount auth contracts, DTOs, enums, and storage keys.
Latest version: 0.2.0

# @mastergnou/auth-contracts

Shared DTOs, enums, auth provider types, and browser storage-key constants for Mount-family auth flows.

Current surface:

- auth provider and session-provider types
- browser auth storage keys
- password-login, refresh-token, and SSO-callback request DTOs
- logout DTOs
- password setup/reset DTOs
- tenant auth mode / SSO status enums
- identity lifecycle and deprovision contract types
- SCIM error/list DTOs plus normalized patch/user helper types
- tenant auth management DTOs
- shared string sanitization decorator and utility

Current caution:

- `AuthTokenPairDTO` still includes `tenantId` because the first extraction slice is Coachiz-led
- revisit that contract before claiming full single-tenant neutrality
npm package: @mastergnou/auth-server
Description: Shared server-side auth policy helpers for Mount-family products.
Latest version: 0.2.0

# @mastergnou/auth-server

Shared framework-free auth policy helpers for Mount-family backends.

Current surface:

- deployment-level password-login policy resolution
- tenant auth-mode and SSO-state resolution
- tenant provider eligibility helpers
- tenant auth-config normalization and change-detection helpers
- required-AMR normalization
- bounded integer normalization for auth-related config
- password setup token generation, digesting, and validation helpers
- identity lifecycle policy and deprovision event normalization helpers
- SCIM bearer auth parsing, PATCH parsing, and user normalization helpers

Current assumption notes:

- `resolveDeploymentPasswordLoginEnabled()` preserves the current Coachiz default: when no explicit boolean override is configured, password login stays enabled outside the production node environment
- tenant auth-state/provider helpers are mature enough to share because they already match the current Coachiz pure `auth-mode.util.ts` behavior closely, while still taking plain values instead of Nest `ConfigService`
- `normalizeRequiredAmrInput()` is for request/controller-side array cleanup, while `resolveRequiredAmr()` is for stored-config plus default-policy resolution
- tenant auth-config response shaping is still intentionally local; the shared package only covers normalization and config-drift detection, not consumer DTO assembly or app-URL fallback rules
- SCIM auth helpers stop at parsing and validating the bearer credential shape; tenant lookup and credential persistence stay local
- SCIM PATCH helpers only normalize supported operation structure; they do not apply product mutation semantics
- SCIM user normalization extracts product-neutral fields only; it does not decide local persistence or deprovisioning behavior

Non-goals in this package:

- Nest-specific service wiring
- repository access
- token issuance
- audit logging
- SCIM runtime endpoints and tenant resolution
npm package: @mastergnou/auth-web
Description: Shared browser auth helpers for Mount-family web products.
Latest version: 0.2.0

# @mastergnou/auth-web

Shared browser-side auth helpers for Mount-family web products.

Current surface:

- canonical `BrowserStorageLike` abstraction for browser persistence
- generic auth request-header builder with optional tenant-header emission
- headless logout flow orchestration
- headless password-login flow orchestration
- session-provider storage helpers
- token and tenant persistence helpers
- SSO login URL construction
- SSO callback request mapping helper for backend transport DTOs
- headless SSO callback completion flow orchestration
- safe auth redirect normalization for relative or same-origin destinations
- SSO callback query parsing and redirect resolution
- logout redirect decision helpers

Redirect safety note:

- `resolveAuthRedirectUrl()` rejects absolute URLs unless the consumer provides `appOrigin`
- `resolveSsoCallbackDestination()` only applies same-origin reduction when `appOrigin` is passed explicitly

Request header note:

- `buildAuthRequestHeaders()` always adds `Authorization` when an access token exists
- tenant headers are only emitted when the caller provides `tenantHeaderName`

Failure handling note:

- `performPasswordLoginFlow()` and `completeSsoCallbackFlow()` preserve existing shared auth state by default if the executor fails
- callers can opt into clearing shared auth state on failure with `clearExistingAuthOnFailure`
- `performPasswordLoginFlow()` can optionally run a consumer-provided post-login completion callback after shared auth persistence
- `completeSsoCallbackFlow()` also lets consumers override validation-stage error copy without replacing callback parsing/persistence logic
- `performLogoutFlow()` treats federated logout initiation failures as non-fatal, clears shared local auth state anyway, and can report the raw failure back through `onFederatedLogoutFailure`
- `performLogoutFlow()` also supports async `clearAdditionalState()` so consumers can finish product-local cleanup before redirecting

SSO callback transport note:

- `completeSsoCallbackFlow()` works with `code` because it starts from browser callback query params
- backend transport DTOs use `assertion`, so `buildSsoCallbackRequest()` maps `code -> assertion` explicitly

Non-goals in this package:

- branded page components
- direct HTTP client wiring
- product route definitions
- profile-fetching or React app wiring