feat: Add --auth-type=webauthn flag

[jumoel]

What

Add --auth-type=webauthn flag to npm.

Why

We want user to be able to opt-in to web logins.

References

• Closes: github/npm#5294
• Related: feat: set 'npm-use-webauthn' header depending on option npm-profile#48
• Parent issue: github/npm#4897

[jumoel]

For this PR to actually do anything, it requires changes to npm-profile.

Should I raise and merge a PR to npm-profile before this PR is merged, or how should I proceed?

Edit: Clarified with @darcyclarke regarding process. npm-profile changes should land before this is merged. 🙂

[nlf]

we might need to do a little bike shedding of the option name, i almost wonder if adding web to --auth-type is better. i'll bounce that around in the team while you work on the npm-profile changes and circle back here.

other than that, this looks great!

[jumoel]

Added the related npm-profile PR: npm/npm-profile#48.

[nlf]

ok, so we talked it out and i think what we'd rather do here is modify the auth-type config definition such that webauthn is a new allowed value for it. if you can make that adjustment i think we're ready to land this right after the npm-profile update lands (i'll post a review over there detailing the necessary changes on that end)

thanks!

[jumoel]

@nlf

Thanks for the feedback!

Given that the behavior is exactly the same as legacy, do you prefer that I make an alias for legacy in https://github.com/npm/cli/blob/latest/lib/commands/adduser.js#L4-L9 or that I add lib/auth/webauthn.js that uses legacy.js#login directly?

[nlf]

Given that the behavior is exactly the same as legacy, do you prefer that I make an alias for legacy in https://github.com/npm/cli/blob/latest/lib/commands/adduser.js#L4-L9 or that I add lib/auth/webauthn.js that uses legacy.js#login directly?

i think making it an alias for legacy makes sense, seeing as they call identical code. we can always break it up later if we have a need to.

[jumoel]

i think making it an alias for legacy makes sense, seeing as they call identical code. we can always break it up later if we have a need to.

Alright, got it, thanks! 🙂

[jumoel]

I changed the flag to be a variation of auth-type. Please re-review @nlf 🙂

[nlf]

this looks good!