fix: cleanup star/unstar (#4868)

It was querying whoami once for every package you starred/unstarred, and
incorrectly trying to determine if you weren't logged in.  In fact the
function throws a descriptive message if you're not logged in already.
The whoami check was also racing with the fetch of the packument for
each package you were starring/unstarring meaning you could also get a
random 401 for a private package instead of the 'you need to log in'
message.

unstar was setting an undocumented config item to get the
shared code to unstar.  The command already has a name attribute that
tells us what action we are doing so we can just use that.

Finally, the duplicated (and differing) params between the two commands
were consolidated.

1 files changed, 14 insertions, 0 deletions

diff --git a/docs/content/commands/npm-star.md b/docs/content/commands/npm-star.md
index bbec7ac5f..00ef17a81 100644
--- a/docs/content/commands/npm-star.md
+++ b/docs/content/commands/npm-star.md
@@ -69,6 +69,20 @@ false, it uses ascii characters instead of unicode glyphs.
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->
 
+#### `otp`
+
+* Default: null
+* Type: null or String
+
+This is a one-time password from a two-factor authenticator. It's needed
+when publishing or changing package permissions with `npm access`.
+
+If not set, and a registry response fails with a challenge for a one-time
+password, npm will prompt on the command line for one.
+
+<!-- automatically generated, do not edit manually -->
+<!-- see lib/utils/config/definitions.js -->
+
 <!-- AUTOGENERATED CONFIG DESCRIPTIONS END -->
 
 ### See Also