Add support for publish authentication

[carlosouro]

Hi,

the idea is to add the support for npm adduser and npm owner interfaces (which already support --registry), and protect write APIs enforcing authentication by default.

I am assuming that with multiple npm registry support, ~/.npmrc will also support users per registry? If not we might have to discuss how to handle it.

Reggie is the main contender for a lightweight private registry companies can use to publish their private stuff and we really need one, so, glad to help out :)

Cheers

[bajtos]

I am assuming that with multiple npm registry support, ~/.npmrc will also support users per registry? If not we might have to discuss how to handle it.

Unfortunately npm cache does not support multiple registries. If you use the same login & password for npmjs.org and your Reggie server, then the authentication may work. Though not very efficiently, as npm will have to renegotiate the session every time you switch between registries.

A better solution might be to add a command-line argument --cache={dir} to force npm to use a different cache for your proxy. I suppose it's not that bad, as one can easily create an alias for this:

$ alias npm-priv=npm --registry={reggie-url} --cache=$HOME/.npm-private
$ npm-priv add-user
$ npm-priv owner
# etc.

[carlosouro]

I am perfectly ok with this registry/cache solution being the standard.

If all agree with the solution, I'll start hacking it on a fork

[bajtos]

If all agree with the solution, I'll start hacking it on a fork

I suppose "all" means me and @mbrevoort. Since Mike has other commitments and might not have time to look at this issue, feel free to start hacking on this even if he doesn't comment. Maybe wait until the end of this week to give him a chance to express his opinion.

Please read the Contributing guide and don't forget to write tests for the new functionality.

[carlosouro]

Will do.
Not going to start before the weekend anyway :)

Cheers guys.