Make translation scripts safer

[ma2ciek]

Translation scripts require safer login and password providing than writing them directly into the scripts params, e.g.:

 gulp traslations:download -u username -p password

I think that https://github.com/flatiron/prompt package could fit this issue very well.

[pomek]

Try to avoid providing the secret data directly in the console. You shouldn't write any password or token in the CLI because it will be stored in your bash history.

In the release tool, in order to create a release on Github, we require a Github Token. In the first version of the script, the token was passed directly from the console. In the second version, I used a package which allows providing the secret data without saving it in history.

This function will be helpful - https://github.com/ckeditor/ckeditor5-dev/blob/master/packages/ckeditor5-dev-env/lib/release-tools/utils/cli.js#L79-L91.

[ma2ciek]

Thanks @pomek.

Try to avoid providing the secret data directly in the console. You shouldn't write any password or token in the CLI because it will be stored in your bash history.

Does it apply to the console prompts as well?

[ma2ciek]

With prompt package I don't see the logs in my ~/.bash_history, but I'm not quite sure about the safety of this solution. With the prompt package the changes are rather cosmetic, they're already on the t/92 branch. I'll move for sure to the inquirer package to do not duplicate packages.

[pomek]

Does it apply to the console prompts as well?

Nope.

I'll move for sure to the inquirer package to do not duplicate packages.

Sounds good.

[fredck]

Hopefully a better authentication solution can be found, like a certificate. Having to provide a password is problematic and it doesn't allow for easy automation of such scripts. If we would have a cron task that daily updates language files, we would have to store the password as plaintext somewhere and this is not good.

[Reinmar]

From what @ma2ciek said there's no other method :(

[ma2ciek]

Actually that has changed few weaks ago (https://fr.transifex.com/blog/2017/api-authentication-tokens/) and It's already in the API https://docs.transifex.com/api/introduction#authentication, so I'll look at it and will try to align it to our scripts.