FEAT(rewrite): Rewrite libnpmaccess

BREAKING CHANGE: the api for libnpmaccess is different now

It is aligned more with how npm uses it, consolidating the mfa functions into a
single command, and renames the functions to be easier to eventually
consolidate into a registry client library.

See the README for the new api.

Author: wraithgar

DEPENDENCIES.md

@@ -323,8 +323,6 @@ graph LR;
   init-package-json-->validate-npm-package-name;
   is-cidr-->cidr-regex;
   is-core-module-->has;
-  libnpmaccess-->aproba;
-  libnpmaccess-->minipass;
   libnpmaccess-->nock;
   libnpmaccess-->npm-package-arg;
   libnpmaccess-->npm-registry-fetch;

package-lock.json

@@ -13917,8 +13917,6 @@
       "version": "7.0.0-pre.0",
       "license": "ISC",
       "dependencies": {
-        "aproba": "^2.0.0",
-        "minipass": "^3.1.1",
         "npm-package-arg": "^9.0.1",
         "npm-registry-fetch": "^13.0.0"
       },

workspaces/libnpmaccess/README.md

@@ -6,241 +6,88 @@
 
 [`libnpmaccess`](https://github.com/npm/libnpmaccess) is a Node.js
 library that provides programmatic access to the guts of the npm CLI's `npm
-access` command and its various subcommands. This includes managing account 2FA,
-listing packages and permissions, looking at package collaborators, and defining
+access` command. This includes managing account mfa settings, listing
+packages and permissions, looking at package collaborators, and defining
 package permissions for users, orgs, and teams.
 
 ## Example
 
 ```javascript
 const access = require('libnpmaccess')
+const opts = { '//registry.npmjs.org/:_authToken: 'npm_token }
 
 // List all packages @zkat has access to on the npm registry.
-console.log(Object.keys(await access.lsPackages('zkat')))
+console.log(Object.keys(await access.getPackages('zkat', opts)))
 ```
 
-## Table of Contents
-
-* [Installing](#install)
-* [Example](#example)
-* [Contributing](#contributing)
-* [API](#api)
-  * [access opts](#opts)
-  * [`public()`](#public)
-  * [`restricted()`](#restricted)
-  * [`grant()`](#grant)
-  * [`revoke()`](#revoke)
-  * [`tfaRequired()`](#tfa-required)
-  * [`tfaNotRequired()`](#tfa-not-required)
-  * [`lsPackages()`](#ls-packages)
-  * [`lsPackages.stream()`](#ls-packages-stream)
-  * [`lsCollaborators()`](#ls-collaborators)
-  * [`lsCollaborators.stream()`](#ls-collaborators-stream)
-
-### Install
-
-`$ npm install libnpmaccess`
-
 ### API
 
-#### <a name="opts"></a> `opts` for `libnpmaccess` commands
+#### `opts` for all `libnpmaccess` commands
 
 `libnpmaccess` uses [`npm-registry-fetch`](https://npm.im/npm-registry-fetch).
-All options are passed through directly to that library, so please refer to [its
-own `opts`
+
+All options are passed through directly to that library, so please refer
+to [its own `opts`
 documentation](https://www.npmjs.com/package/npm-registry-fetch#fetch-options)
 for options that can be passed in.
 
-A couple of options of note for those in a hurry:
-
-* `opts.token` - can be passed in and will be used as the authentication token for the registry. For other ways to pass in auth details, see the n-r-f docs.
-* `opts.otp` - certain operations will require an OTP token to be passed in. If a `libnpmaccess` command fails with `err.code === EOTP`, please retry the request with `{otp: <2fa token>}`
-
-#### <a name="public"></a> `> access.public(spec, [opts]) -> Promise<Boolean>`
+#### `spec` parameter for all `libnpmaccess` commands
 
 `spec` must be an [`npm-package-arg`](https://npm.im/npm-package-arg)-compatible
 registry spec.
 
-Makes package described by `spec` public.
-
-##### Example
-
-```javascript
-await access.public('@foo/bar', {token: 'myregistrytoken'})
-// `@foo/bar` is now public
-```
-
-#### <a name="restricted"></a> `> access.restricted(spec, [opts]) -> Promise<Boolean>`
-
-`spec` must be an [`npm-package-arg`](https://npm.im/npm-package-arg)-compatible
-registry spec.
-
-Makes package described by `spec` private/restricted.
-
-##### Example
+#### `access.getCollaborators(spec, opts) -> Promise<Object>`
 
-```javascript
-await access.restricted('@foo/bar', {token: 'myregistrytoken'})
-// `@foo/bar` is now private
-```
+Gets collaborators for a given package
 
-#### <a name="grant"></a> `> access.grant(spec, team, permissions, [opts]) -> Promise<Boolean>`
+#### `access.getPackages(user|scope|team, opts) -> Promise<Object>`
 
-`spec` must be an [`npm-package-arg`](https://npm.im/npm-package-arg)-compatible
-registry spec. `team` must be a fully-qualified team name, in the `scope:team`
-format, with or without the `@` prefix, and the team must be a valid team within
-that scope. `permissions` must be one of `'read-only'` or `'read-write'`.
+Gets all packages for a given user, scope, or team.
 
-Grants `read-only` or `read-write` permissions for a certain package to a team.
+Teams should be in the format `scope:team` or `@scope:team`
 
-##### Example
+Users and scopes can be in the format `@scope` or `scope`
 
-```javascript
-await access.grant('@foo/bar', '@foo:myteam', 'read-write', {
-  token: 'myregistrytoken'
-})
-// `@foo/bar` is now read/write enabled for the @foo:myteam team.
-```
+#### `access.getVisibility(spec, opts) -> Promise<Object>`
 
-#### <a name="revoke"></a> `> access.revoke(spec, team, [opts]) -> Promise<Boolean>`
+Gets the visibility of a given package
 
-`spec` must be an [`npm-package-arg`](https://npm.im/npm-package-arg)-compatible
-registry spec. `team` must be a fully-qualified team name, in the `scope:team`
-format, with or without the `@` prefix, and the team must be a valid team within
-that scope. `permissions` must be one of `'read-only'` or `'read-write'`.
+#### `access.removePermissions(team, spec, opts) -> Promise<Boolean>`
 
-Removes access to a package from a certain team.
+Removes the access for a given team to a package.
 
-##### Example
+Teams should be in the format `scope:team` or `@scope:team`
 
-```javascript
-await access.revoke('@foo/bar', '@foo:myteam', {
-  token: 'myregistrytoken'
-})
-// @foo:myteam can no longer access `@foo/bar`
-```
+#### `access.setAccess(package, access, opts) -> Promise<Boolean>`
 
-#### <a name="tfa-required"></a> `> access.tfaRequired(spec, [opts]) -> Promise<Boolean>`
+Sets access level for package described by `spec`.
 
-`spec` must be an [`npm-package-arg`](https://npm.im/npm-package-arg)-compatible
-registry spec.
-
-Makes it so publishing or managing a package requires using 2FA tokens to
-complete operations.
+The npm registry accepts the following `access` levels:
 
-##### Example
+`public`: package is public
+`private`: package is private
 
-```javascript
-await access.tfaRequires('lodash', {token: 'myregistrytoken'})
-// Publishing or changing dist-tags on `lodash` now require OTP to be enabled.
-```
+The npm registry also only allows scoped packages to have their access
+level set.
 
-#### <a name="tfa-not-required"></a> `> access.tfaNotRequired(spec, [opts]) -> Promise<Boolean>`
+#### access.setMfa(spec, level, opts) -> Promise<Boolean>`
 
-`spec` must be an [`npm-package-arg`](https://npm.im/npm-package-arg)-compatible
-registry spec.
+Sets the publishing mfa requirements for a given package.  Level must be one of the
+following
 
-Disabled the package-level 2FA requirement for `spec`. Note that you will need
-to pass in an `otp` token in `opts` in order to complete this operation.
+`none`: mfa is not required to publish this package.
+`publish`: mfa is required to publish this package, automation tokens
+cannot be used to publish.
+`automation`: mfa is required to publish this package, automation tokens
+may also be used for publishing from continuous integration workflows.
 
-##### Example
+#### access.setPermissions(team, spec, permssions, opts) -> Promise<Boolean>`
 
-```javascript
-await access.tfaNotRequired('lodash', {otp: '123654', token: 'myregistrytoken'})
-// Publishing or editing dist-tags on `lodash` no longer requires OTP to be
-// enabled.
-```
+Sets permissions levels for a given team to a package.
 
-#### <a name="ls-packages"></a> `> access.lsPackages(entity, [opts]) -> Promise<Object | null>`
+Teams should be in the format `scope:team` or `@scope:team`
 
-`entity` must be either a valid org or user name, or a fully-qualified team name
-in the `scope:team` format, with or without the `@` prefix.
+The npm registry accepts the following `permissions`:
 
-Lists out packages a user, org, or team has access to, with corresponding
-permissions. Packages that the access token does not have access to won't be
-listed.
-
-In order to disambiguate between users and orgs, two requests may end up being
-made when listing orgs or users.
-
-For a streamed version of these results, see
-[`access.lsPackages.stream()`](#ls-package-stream).
-
-##### Example
-
-```javascript
-await access.lsPackages('zkat', {
-  token: 'myregistrytoken'
-})
-// Lists all packages `@zkat` has access to on the registry, and the
-// corresponding permissions.
-```
-
-#### <a name="ls-packages-stream"></a> `> access.lsPackages.stream(scope, [team], [opts]) -> Stream`
-
-`entity` must be either a valid org or user name, or a fully-qualified team name
-in the `scope:team` format, with or without the `@` prefix.
-
-Streams out packages a user, org, or team has access to, with corresponding
-permissions, with each stream entry being formatted like `[packageName,
-permissions]`. Packages that the access token does not have access to won't be
-listed.
-
-In order to disambiguate between users and orgs, two requests may end up being
-made when listing orgs or users.
-
-The returned stream is a valid `asyncIterator`.
-
-##### Example
-
-```javascript
-for await (let [pkg, perm] of access.lsPackages.stream('zkat')) {
-  console.log('zkat has', perm, 'access to', pkg)
-}
-// zkat has read-write access to eggplant
-// zkat has read-only access to @npmcorp/secret
-```
-
-#### <a name="ls-collaborators"></a> `> access.lsCollaborators(spec, [user], [opts]) -> Promise<Object | null>`
-
-`spec` must be an [`npm-package-arg`](https://npm.im/npm-package-arg)-compatible
-registry spec. `user` must be a valid user name, with or without the `@`
-prefix.
-
-Lists out access privileges for a certain package. Will only show permissions
-for packages to which you have at least read access. If `user` is passed in, the
-list is filtered only to teams _that_ user happens to belong to.
-
-For a streamed version of these results, see [`access.lsCollaborators.stream()`](#ls-collaborators-stream).
-
-##### Example
-
-```javascript
-await access.lsCollaborators('@npm/foo', 'zkat', {
-  token: 'myregistrytoken'
-})
-// Lists all teams with access to @npm/foo that @zkat belongs to.
-```
-
-#### <a name="ls-collaborators-stream"></a> `> access.lsCollaborators.stream(spec, [user], [opts]) -> Stream`
-
-`spec` must be an [`npm-package-arg`](https://npm.im/npm-package-arg)-compatible
-registry spec. `user` must be a valid user name, with or without the `@`
-prefix.
-
-Stream out access privileges for a certain package, with each entry in `[user,
-permissions]` format. Will only show permissions for packages to which you have
-at least read access. If `user` is passed in, the list is filtered only to teams
-_that_ user happens to belong to.
-
-The returned stream is a valid `asyncIterator`.
-
-##### Example
-
-```javascript
-for await (let [usr, perm] of access.lsCollaborators.stream('npm')) {
-  console.log(usr, 'has', perm, 'access to npm')
-}
-// zkat has read-write access to npm
-// iarna has read-write access to npm
-```
+`read-only`: Read only permissions
+`read-write`: Read and write (aka publish) permissions