Unless video is established that we're going to share all of our code during NPM package.
And the first thing I want to discuss around publishing our common library as an NPM package is the
security of our code.
So inside of our common library we're going to have some really common middleware as you're going to
see all over online such as that require authentication middleware and that air handling stuff and so
on but inside of your own personal project you might be working on the future your cum library might
have some very sensitive code inside of it it might contain some very sensitive business logic or something
similar.
And so before even creating this package I just want to have a quick discussion on package security
when we published a package with NPM.
There are really three different options or three very popular options I should say available to us
to make this package available to other people inside of our company or other people who are working
on our project.
We can publish this package to the NPM public registry.
We can publish it to the public registry inside of an organization or we can publish it to a private
registry when we published a package directly to the public registry.
Anyone else can see this package by default.
And so anyone else can take a look at your code and possibly see your business logic inside their if
you instead publish your package to a organization.
We can mark the organization as public enemy it has private and then only people who are a member of
this organization can see the packages inside.
If you want to use a private organization you do have to pay extra money to NPM.
You can also create a private registry and access to this will be limited to whoever you give direct
access to if you try to create a private registry directly through NPM.
You end up having to pay money.
Alternatively you can also host your own open source version of a champion registry which is free but
requires a bit of additional setup.
So in total if we just publish this package directly to NPM it will be public invisible to all.
If we publish it inside of a private organization it will be only accessible by people who are a member
of our organization.
And if we publish it to a private registry then only people who have access to our registry will be
able to see it.
We're going to end up going with the organization option.
So we are going to create a new organization and then publish our package inside there and just you
know there are public and private organizations.
If you create a public organization then everyone else is going to be able to see the package inside
of here.
It's only when we create a private one that the package will be hidden.
Creating a public organization does cost money so we're not going to create a private one.
We're going to create a public one.
But you can very easily turn it into private if you wish to do so.
Let's first get started by creating this organization to do so I can open up a new browser tab and navigate
to NPM JSC dot com once over here.
I'm gonna make sure that I've signed up for an NPM account.
I'll click on myself on the top right hand side and I'll click on Add organization.
I'm going to get prompted to create a new organization as you can see right away that we can create
either a private one or a public one.
If you want a private one you've got to pay some money so we're not going to go with the private one
because honestly there's not really a lot of secure or sensitive code inside of our common module Let's
type in a name for our custom organization.
I'm going to use a name of SMG tickets so that's going to be the name of my organization.
All organization names created on NPM must be unique so you will not be able to use SGI tickets.
You're going to have to come up with your own name for your organization.
Just make sure it's something you can easily remember it just you know I used SGA because those are
my initials.
Stephen Greider after that I click on Create I then get prompted to invite some people.
So if I had marked this organization as private I would have to invite other people in order for them
to see these packages and install them into their own projects.
In this case I don't have anyone else to invite so I'll just click on Skip and that's it.
So now we can create our own packages and push them to this organization.
And if we had Mark this organization as private they'd be great.
No one else will be able to see these.
But again I don't want to pay any money for this.
All right.
So now we've created this organization.
Let's take a pause right here in the next video.
We're going to actually create our common module and make sure that we publish it to this private or
this public organization.