npm: Support two-factor authentication: ask for a one-time password

[mgol]

Keywords: 2FA, OTP, npm

I tried to not add any new packages and use the native readline API but the most basic example in the API docs cause the provided output to be printed twice. I was testing various workarounds but I couldn't make it work.

This increases the checked-in node_modules size from 584 KB to 932 KB. Way better than inquirer that increases it to 23 MB. 😮

[timmywil]

How would we feel about removing node_modules from tracking and committing a package-lock.json? I understand that precludes yarn usage, but I'd rather do that than continue to commit the node modules. Besides, yarn 2 is moving away from using the node_modules folder at all.

[mgol]

@timmywil That's a possibility. I can't speak for what exactly were Scott's idea here to skip it other than the lack of a lockfile and reducing dependency on external code during the release - but we have such a dependency anyway as the release process needs to download dependencies of the project it releases.

One caveat is package-lock.json is not stable when installation is done via a different npm version than the one used to generate the lockfile. But maybe that's a lesser evil here.

What do others think?

[mgol]

BTW, @timmywil, regardless of the decision, I feel this may be a matter to settle separately to this PR to not block its merge. What do you think?

[timmywil]

I agree, but it'd be a nice-to-have before the next jQuery release.

[timmywil]

The mixture of const and var is a bit odd to me. Perhaps we should stick with var and then convert everything in another PR?

[mgol]

I'm not sure if I have resources right now to convert everything. Would converting vars in the _publishNpm method be enough here?

[timmywil]

I think we can use eslint and just run the auto fix to do the conversion.

[timmywil]

I can do that btw. For this PR, I'd say switch consts to vars.

[mgol]

Cool.

About the rule:

The --fix option on the command line can automatically fix some of the problems reported by this rule.

I wonder how much it can actually auto-convert. An autofixer that fixes all the occurrences would most likely be impossible.

[mgol]

PR updated, all consts removed.