@mastergnou/auth-server

Shared framework-free auth policy helpers for Mount-family backends.

Current surface:

• deployment-level password-login policy resolution
• tenant auth-mode and SSO-state resolution
• tenant provider eligibility helpers
• tenant auth-config normalization and change-detection helpers
• required-AMR normalization
• bounded integer normalization for auth-related config
• password setup token generation, digesting, and validation helpers
• identity lifecycle policy and deprovision event normalization helpers
• SCIM bearer auth parsing, PATCH parsing, and user normalization helpers
• crypto-free SSO protocol helpers for return-url sanitization, OIDC authorize/logout URL construction, OIDC discovery/token-response normalization, state payload construction, product-verified state/callback payload normalization, SAML RelayState normalization, SAML callback redirect construction, and SAML logout-session normalization
• framework-free SAML metadata/binding/profile helpers for certificate normalization/validity checks, provider endpoint readiness, ACS/logout classification, redirect-query normalization, profile email/logout-session extraction, logout profile projection, and request-correlation cache key contracts
• OIDC provider metadata validation for issuer/client/discovery endpoint readiness, returning stable reason codes that product UI/audit layers can map locally
• JOSE-backed OIDC ID token verification for issuer, audience, authorized party (azp), expiry, not-before, nonce, AMR, ACR, key selection, and signature validation

Current assumption notes:

• resolveDeploymentPasswordLoginEnabled() preserves the current Coachiz default: when no explicit boolean override is configured, password login stays enabled outside the production node environment
• tenant auth-state/provider helpers are mature enough to share because they already match the current Coachiz pure auth-mode.util.ts behavior closely, while still taking plain values instead of Nest ConfigService
• normalizeRequiredAmrInput() is for request/controller-side array cleanup, while resolveRequiredAmr() is for stored-config plus default-policy resolution
• tenant auth-config response shaping is still intentionally local; the shared package only covers normalization and config-drift detection, not consumer DTO assembly or app-URL fallback rules
• SCIM auth helpers stop at parsing and validating the bearer credential shape; tenant lookup and credential persistence stay local
• SCIM PATCH helpers only normalize supported operation structure; they do not apply product mutation semantics
• SCIM user normalization extracts product-neutral fields only; it does not decide local persistence or deprovisioning behavior
• OIDC verification uses jose for protected-header handling, JWK selection, and signature verification; products still own provider discovery fetching/caching, SSO state/nonce single-use storage, local user lookup, session issuing, and audit events
• verifyOidcIdToken() requires azp to match the expected OAuth client when an ID token has multiple audiences. If the verifier is called with multiple acceptable audiences, pass expectedAuthorizedParty explicitly.
• validateOidcProviderMetadata() does not fetch discovery documents or read tenant secrets. Products fetch/cache provider metadata locally, pass it in, and map returned reason codes to product-local operator copy.
• validateOidcProviderMetadata() assumes web SSO redirect URIs for the current CoachMount/Mount360 scope: HTTPS by default, or HTTP only when allowHttp is explicitly enabled for local development. Native/mobile custom-scheme redirects would need a separate reviewed option before use.
• buildOidcStatePayload(), buildSamlStatePayload(), and buildSamlLogoutStatePayload() centralize portable state-token payload shapes before product-local signing. Products still own nonce generation, token signing, token verification, nonce/replay storage, and local session decisions.
• normalizeOidcStatePayload(), normalizeSamlStatePayload(), normalizeSamlLogoutStatePayload(), and normalizeSamlCallbackTokenPayload() expect product-verified token payloads and centralize shape validation after local verification.
• validateSamlProviderMetadata() checks product-supplied SAML metadata and signing certificates, but does not fetch IdP metadata or construct a SAML client.
• SAML helpers intentionally stop before @node-saml validation and storage adapters. Products still own SAML client construction, Redis/cache implementations, IdP request support policy, audit events, and final user/session decisions.
• sanitizeSsoReturnUrl() returns a ready-to-use relative path under the product origin (pathname + search + hash). Consumers should redirect to that returned value as-is; do not decode it again or resolve it against an external base.

Non-goals in this package:

• Nest-specific service wiring
• repository access
• token issuance
• audit logging
• bundled SAML client or Redis adapters
• SCIM runtime endpoints and tenant resolution