fix: default auth-type to legacy if otp is configured

[wraithgar]

Closes npm/statusboard#624

[npm-cli-bot]

found 2 benchmarks with statistically significant performance improvements

• app-large: no-clean:audit
• app-medium: clean

timing results

app-large	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	39.138 ±0.63	15.639 ±0.05	14.517 ±0.06	18.524 ±3.02	2.806 ±0.13	2.649 ±0.02	2.175 ±0.03	10.059 ±0.13	2.180 ±0.04	4.092 ±0.35
#6044	37.253 ±0.78	15.622 ±0.40	14.095 ±0.10	17.101 ±1.16	2.652 ±0.01	2.669 ±0.01	2.048 ±0.01	9.798 ±0.19	2.132 ±0.03	3.550 ±0.14

app-medium	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	26.925 ±0.25	12.531 ±0.09	11.141 ±0.09	12.220 ±0.11	2.408 ±0.01	2.423 ±0.02	2.186 ±0.04	7.656 ±0.05	2.074 ±0.04	4.977 ±2.46
#6044	23.652 ±1.46	11.829 ±0.20	10.869 ±0.07	11.821 ±0.01	2.431 ±0.03	2.441 ±0.02	2.110 ±0.04	7.547 ±0.00	1.987 ±0.03	4.361 ±1.82

[ljharb]

So would this be otp = true instead of auth-type = legacy in .npmrc?

[wraithgar]

I wouldn't recommend that, otp is a type [null, String] so it would coerce otp to "true" and send that as an otp value. If you're setting config just set your auth-type.

[ljharb]

ah, thanks, that clears up my confusion.