How to implement NodeJS OAuth2 for an Angular App? - angularjs

Question

I'm trying to to implement the Resource Owner Password flow with a NodeJS API to authenticate my frontend Angular app.
I'm having problems how to implement how the user sends his credentials (username and password) to the API. The flow I know I'm used to send this body variables:
Request body:
grant_type: password
username: myusername
password: mypassword
client_id: frontendApp
Obs: I don't send the client_secret because It is not important, because It's an Angular app, so eveyone can see, but I created a seed client that represent my frontend client. I also created a flag that only this client (frontendApp) can authenticate without client_secret.
When I come to NodeJS I've been reading some tutorials about how to implement this flow in my API, and I notice that my knowledge of how the authentication flow must ocurs maybe is not a pattern.
I pick these tools to start building the security of the API: passport.js and oauth2orize.
According to the tutorials I do need to protect the token endpoint. I didn't catch the idea of why, because the user will access It to just authenticate, with the grant_type: password or grant_type: refresh_token, so he'll have to send me credentials like username and password in the first case or the refresh token in the second, so why do I need to use passport.js with basic and client password strategy?
Talking about Basic and Client Password strategy... Again according to the tutorials I should implement both, because the Basic strategy authenticates by header and the Client Passport strategy by body content. Here I see some ugly things.
Like I mentioned, I don't see reasons to protect the token endpoint, maybe I'm wrong, maybe exists some security problem that I didn't notice.
Another thing is because the Basic strategy and Client Password have different contexts, the first receive username and password and the second client_id and client_secret. When I want to get access and refresh token for the first time I must send all these things:
Request body:
grant_type: password
username: myusername
password: mypassword
client_id: frontendApp
client_secret: clientsecret
(or with the authentication in the header)
I wouldn't like to send the client_secret, at really nor client_id, but the client password strategy library makes me, and It is something very useless, because everyone can look my frontend code where It is stored, because of It I think It is not necessary to protect the token endpoint.
I'd like to send only the username and password, if the user is sending only username and password I already know that It is an frontend client trying to authenticate. I found an explanation of how Resourse Owner Password should work, and It shows an example of request:
https://oauth.example.com/token?grant_type=password&username=USERNAME&password=PASSWORD&client_id=CLIENT_ID
It shows something like my older ASP.NET app, using username, password and client_id.
Does someone know if I should care about It or I can build It my-like mode, because the NodeJS implementations is not following the way I know.