@verdaccio/store 7.0.0-next.5 → 8.0.0-next-8.0

package/build/storage.js

@@ -14,32 +14,30 @@ var _url = _interopRequireDefault(require("url"));
 var _config = require("@verdaccio/config");
 var _core = require("@verdaccio/core");
 var _loaders = require("@verdaccio/loaders");
-var _logger = require("@verdaccio/logger");
 var _proxy = require("@verdaccio/proxy");
+var _search = _interopRequireDefault(require("@verdaccio/search"));
 var _tarball = require("@verdaccio/tarball");
 var _utils = require("@verdaccio/utils");
 var _2 = require(".");
-var _TransFormResults = require("./lib/TransFormResults");
-var _searchUtils = require("./lib/search-utils");
 var _starUtils = require("./lib/star-utils");
 var _storageUtils = require("./lib/storage-utils");
-var _uplinkUtil = require("./lib/uplink-util");
 var _versionsUtils = require("./lib/versions-utils");
 var _localStorage = require("./local-storage");
 function _getRequireWildcardCache(e) { if ("function" != typeof WeakMap) return null; var r = new WeakMap(), t = new WeakMap(); return (_getRequireWildcardCache = function (e) { return e ? t : r; })(e); }
-function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != typeof e && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && Object.prototype.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u) : null; i && (i.get || i.set) ? Object.defineProperty(n, u, i) : n[u] = e[u]; } return n.default = e, t && t.set(e, n), n; }
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != typeof e && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && {}.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u) : null; i && (i.get || i.set) ? Object.defineProperty(n, u, i) : n[u] = e[u]; } return n.default = e, t && t.set(e, n), n; }
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('verdaccio:storage');
 const noSuchFile = exports.noSuchFile = 'ENOENT';
 const resourceNotAvailable = exports.resourceNotAvailable = 'EAGAIN';
 const PROTO_NAME = exports.PROTO_NAME = '__proto__';
 class Storage {
-  constructor(config) {
+  constructor(config, logger) {
     this.config = config;
-    this.uplinks = (0, _uplinkUtil.setupUpLinks)(config);
-    this.logger = _logger.logger.child({
+    this.logger = logger.child({
       module: 'storage'
     });
+    this.uplinks = (0, _proxy.setupUpLinks)(config, this.logger);
+    this.searchService = new _search.default(config, this.logger);
     this.filters = null;
     // @ts-ignore
     this.localStorage = null;
@@ -54,12 +52,12 @@ class Storage {
    */
   async changePackage(name, metadata, revision) {
     debug('change existing package for package %o revision %o', name, revision);
-    debug(`change manifest tags for %o revision %s`, name, revision);
+    debug(`change manifest tags for %o revision %o`, name, revision);
     if (!_core.validatioUtils.isObject(metadata.versions) || !_core.validatioUtils.isObject(metadata[_core.DIST_TAGS])) {
       debug(`change manifest bad data for %o`, name);
       throw _core.errorUtils.getBadData();
     }
-    debug(`change manifest udapting manifest for %o`, name);
+    debug(`change manifest updating manifest for %o`, name);
     await this.updatePackage(name, async localData => {
       // eslint-disable-next-line guard-for-in
       for (const version in localData.versions) {
@@ -100,12 +98,13 @@ class Storage {
       }
       localData[_core.USERS] = metadata[_core.USERS];
       localData[_core.DIST_TAGS] = metadata[_core.DIST_TAGS];
+      localData[_core.MAINTAINERS] = metadata[_core.MAINTAINERS];
       return localData;
     });
   }
-  async removePackage(name, revision) {
+  async removePackage(name, revision, username) {
     debug('remove package %o', name);
-    await this.removePackageByRevision(name, revision);
+    await this.removePackageByRevision(name, revision, username);
   }
 
   /**
@@ -115,8 +114,9 @@ class Storage {
    versions, i.e. package version should be unpublished first.
    Used storage: local (write)
    */
+  async removeTarball(name, filename,
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  async removeTarball(name, filename, _revision) {
+  _revision, username) {
     debug('remove tarball %s for %s', filename, name);
     (0, _assert.default)(_core.validatioUtils.validateName(filename));
     const storage = this.getPrivatePackageStorage(name);
@@ -130,6 +130,9 @@ class Storage {
       if (!cacheManifest._attachments[filename]) {
         throw _core.errorUtils.getNotFound('no such file available');
       }
+
+      // check if logged in user is allowed to remove tarball
+      await this.checkAllowedToChangePackage(cacheManifest, username);
     } catch (err) {
       if (err.code === noSuchFile) {
         throw _core.errorUtils.getNotFound();
@@ -164,79 +167,24 @@ class Storage {
   /**
    * Handle search on packages and proxies.
    * Iterate all proxies configured and search in all endpoints in v2 and pipe all responses
-   * to a stream, once the proxies request has finished search in local storage for all packages
+   *  once the proxies request has finished search in local storage for all packages
    * (privated and cached).
    */
   async search(options) {
-    const transformResults = new _TransFormResults.TransFormResults({
-      objectMode: true
-    });
-    const streamPassThrough = new _stream.PassThrough({
-      objectMode: true
-    });
-    const upLinkList = this.getProxyList();
-    debug('uplinks found %s', upLinkList.length);
-    const searchUplinksStreams = upLinkList.map(uplinkId => {
-      const uplink = this.uplinks[uplinkId];
-      if (!uplink) {
-        // this line should never happens
-        this.logger.error({
-          uplinkId
-        }, 'uplink @upLinkId not found');
-      }
-      return this.consumeSearchStream(uplinkId, uplink, options, streamPassThrough);
-    });
-    try {
-      debug('searching on %s uplinks...', searchUplinksStreams === null || searchUplinksStreams === void 0 ? void 0 : searchUplinksStreams.length);
-      // only process those streams end successfully, if all request fails
-      // just include local storage results (if local fails then return 500)
-      await Promise.allSettled([...searchUplinksStreams]);
-      debug('searching all uplinks done');
-    } catch (err) {
-      this.logger.error({
-        err: err === null || err === void 0 ? void 0 : err.message
-      }, ' error on uplinks search @{err}');
-      streamPassThrough.emit('error', err);
-    }
-    debug('search local');
-    try {
-      await this.searchCachedPackages(streamPassThrough, options.query);
-    } catch (err) {
-      this.logger.error({
-        err: err === null || err === void 0 ? void 0 : err.message
-      }, ' error on local search @{err}');
-      streamPassThrough.emit('error', err);
-    }
-    const data = [];
-    const outPutStream = new _stream.PassThrough({
-      objectMode: true
-    });
-    (0, _stream.pipeline)(streamPassThrough, transformResults, outPutStream, err => {
-      if (err) {
-        this.logger.error({
-          err: err === null || err === void 0 ? void 0 : err.message
-        }, ' error on search @{err}');
-        throw _core.errorUtils.getInternalError(err ? err.message : 'unknown search error');
-      } else {
-        debug('pipeline succeeded');
-      }
-    });
-    outPutStream.on('data', chunk => {
-      data.push(chunk);
-    });
-    return new Promise(resolve => {
-      outPutStream.on('finish', async () => {
-        const searchFinalResults = (0, _searchUtils.removeDuplicates)(data);
-        debug('search stream total results: %o', searchFinalResults.length);
-        return resolve(searchFinalResults);
-      });
-      debug('search done');
-    });
+    debug('search on cache packages');
+    const cachePackages = await this.getCachedPackages(options.query);
+    debug('search found on cache packages %o', cachePackages.length);
+    const remotePackages = await this.searchService.search(options);
+    debug('search found on remote packages %o', remotePackages.length);
+    const totalResults = [...cachePackages, ...remotePackages];
+    const uniqueResults = (0, _versionsUtils.removeLowerVersions)(totalResults);
+    debug('unique results %o', uniqueResults.length);
+    return uniqueResults;
   }
   async getTarballFromUpstream(name, filename, {
     signal
   }) {
-    var _cachedManifest, _cachedManifest2, _cachedManifest2$_dis;
+    var _cachedManifest, _cachedManifest2;
     let cachedManifest = null;
     try {
       cachedManifest = await this.getPackageLocalMetadata(name);
@@ -244,7 +192,7 @@ class Storage {
       debug('error on get package local metadata %o', err);
     }
     // dist url should be on local cache metadata
-    if ((_cachedManifest = cachedManifest) !== null && _cachedManifest !== void 0 && _cachedManifest._distfiles && typeof ((_cachedManifest2 = cachedManifest) === null || _cachedManifest2 === void 0 ? void 0 : (_cachedManifest2$_dis = _cachedManifest2._distfiles[filename]) === null || _cachedManifest2$_dis === void 0 ? void 0 : _cachedManifest2$_dis.url) === 'string') {
+    if ((_cachedManifest = cachedManifest) !== null && _cachedManifest !== void 0 && _cachedManifest._distfiles && typeof ((_cachedManifest2 = cachedManifest) === null || _cachedManifest2 === void 0 || (_cachedManifest2 = _cachedManifest2._distfiles[filename]) === null || _cachedManifest2 === void 0 ? void 0 : _cachedManifest2.url) === 'string') {
       var _cachedManifest3;
       debug('dist file found, using it %o', (_cachedManifest3 = cachedManifest) === null || _cachedManifest3 === void 0 ? void 0 : _cachedManifest3._distfiles[filename].url);
       // dist file found, proceed to download
@@ -313,7 +261,7 @@ class Storage {
       // should not be the case
       const passThroughRemoteStream = new _stream.PassThrough();
       // ensure get the latest data
-      const [updatedManifest] = await this.syncUplinksMetadataNext(name, cachedManifest, {
+      const [updatedManifest] = await this.syncUplinksMetadata(name, cachedManifest, {
         uplinksLook: true
       });
       const distFile = updatedManifest._distfiles[filename];
@@ -356,7 +304,7 @@ class Storage {
    * @param param2
    * @returns
    */
-  async getTarballNext(name, filename, {
+  async getTarball(name, filename, {
     signal
   }) {
     debug('get tarball for package %o filename %o', name, filename);
@@ -438,6 +386,18 @@ class Storage {
   async getPackageManifest(options) {
     // convert dist remotes to local bars
     const [manifest] = await this.getPackageNext(options);
+
+    // If change access is requested (?write=true), then check if logged in user is allowed to change package
+    if (options.byPassCache === true) {
+      try {
+        await this.checkAllowedToChangePackage(manifest, options.requestOptions.username);
+      } catch (error) {
+        this.logger.error({
+          error: error.message
+        }, 'getting package has failed: @{error}');
+        throw _core.errorUtils.getBadRequest(error.message);
+      }
+    }
     const convertedManifest = (0, _tarball.convertDistRemoteToLocalTarballUrls)(manifest, options.requestOptions, this.config.url_prefix);
     return convertedManifest;
   }
@@ -449,7 +409,6 @@ class Storage {
       const _version_abbreviated = {
         name: _version.name,
         version: _version.version,
-        description: _version.description,
         deprecated: _version.deprecated,
         bin: _version.bin,
         dist: _version.dist,
@@ -461,6 +420,10 @@ class Storage {
         peerDependencies: _version.peerDependencies,
         optionalDependencies: _version.optionalDependencies,
         bundleDependencies: _version.bundleDependencies,
+        cpu: _version.cpu,
+        os: _version.os,
+        peerDependenciesMeta: _version.peerDependenciesMeta,
+        acceptDependencies: _version.acceptDependencies,
         // npm cli specifics
         _hasShrinkwrap: _version._hasShrinkwrap,
         hasInstallScript: _version.hasInstallScript
@@ -552,7 +515,7 @@ class Storage {
    */
   async init(config) {
     if (this.localStorage === null) {
-      this.localStorage = new _localStorage.LocalStorage(this.config, _logger.logger);
+      this.localStorage = new _localStorage.LocalStorage(this.config, this.logger);
       await this.localStorage.init();
       debug('local init storage initialized');
       await this.localStorage.getSecret(config);
@@ -561,39 +524,18 @@ class Storage {
       debug('storage has been already initialized');
     }
     if (!this.filters) {
-      var _this$config, _this$config$serverSe;
+      var _this$config;
       this.filters = await (0, _loaders.asyncLoadPlugin)(this.config.filters, {
         config: this.config,
         logger: this.logger
       }, plugin => {
         return typeof plugin.filter_metadata !== 'undefined';
-      }, (_this$config = this.config) === null || _this$config === void 0 ? void 0 : (_this$config$serverSe = _this$config.serverSettings) === null || _this$config$serverSe === void 0 ? void 0 : _this$config$serverSe.pluginPrefix);
-      debug('filters available %o', this.filters);
+      }, (_this$config = this.config) === null || _this$config === void 0 || (_this$config = _this$config.serverSettings) === null || _this$config === void 0 ? void 0 : _this$config.pluginPrefix, _core.PLUGIN_CATEGORY.FILTER);
+      debug('filters available %o', this.filters.length);
     }
     return;
   }
 
-  /**
-   * Consume the upstream and pipe it to a transformable stream.
-   */
-  consumeSearchStream(uplinkId, uplink, options, searchPassThrough) {
-    return uplink.search({
-      ...options
-    }).then(bodyStream => {
-      bodyStream.pipe(searchPassThrough, {
-        end: false
-      });
-      bodyStream.on('error', err => {
-        _logger.logger.error({
-          uplinkId,
-          err: err
-        }, 'search error for uplink @{uplinkId}: @{err?.message}');
-        searchPassThrough.end();
-      });
-      return new Promise(resolve => bodyStream.on('end', resolve));
-    });
-  }
-
   /**
    * Retrieve a wrapper that provide access to the package location.
    * @param {Object} pkgName package name.
@@ -623,8 +565,13 @@ class Storage {
       signal
     });
   }
-  async searchCachedPackages(searchStream, query) {
-    debug('search on each package');
+  async getCachedPackages(query) {
+    debug('search on each package', query);
+    const results = [];
+    if (typeof query === 'undefined' || typeof (query === null || query === void 0 ? void 0 : query.text) === 'undefined') {
+      debug('search query for cached not found');
+      return results;
+    }
     this.logger.info({
       t: query.text,
       q: query.quality,
@@ -634,15 +581,15 @@ class Storage {
     }, 'search by text @{t}| maintenance @{m}| quality @{q}| popularity @{p}');
     if (typeof this.localStorage.getStoragePlugin().search === 'undefined') {
       this.logger.info('plugin search not implemented yet');
-      searchStream.end();
     } else {
-      debug('search on each package by plugin');
+      debug('search on each package by plugin query');
       const items = await this.localStorage.getStoragePlugin().search(query);
       try {
         for (const searchItem of items) {
           const manifest = await this.getPackageLocalMetadata(searchItem.package.name);
           if (_lodash.default.isEmpty(manifest === null || manifest === void 0 ? void 0 : manifest.versions) === false) {
-            const searchPackage = (0, _2.mapManifestToSearchPackageBody)(manifest, searchItem);
+            const searchPackage = (0, _storageUtils.mapManifestToSearchPackageBody)(manifest, searchItem);
+            debug('search local stream found %o', searchPackage.name);
             const searchPackageItem = {
               package: searchPackage,
               score: searchItem.score,
@@ -652,21 +599,23 @@ class Storage {
               // FUTURE: find a better way to calculate the score
               searchScore: 1
             };
-            searchStream.write(searchPackageItem);
+            results.push(searchPackageItem);
+          } else {
+            debug('local item without versions detected %s', searchItem.package.name);
           }
         }
         debug('search local stream end');
-        searchStream.end();
       } catch (err) {
         this.logger.error({
           err,
           query
         }, 'error on search by plugin @{err.message}');
-        searchStream.emit('error', err);
+        throw err;
       }
     }
+    return results;
   }
-  async removePackageByRevision(pkgName, revision) {
+  async removePackageByRevision(pkgName, revision, username) {
     const storage = this.getPrivatePackageStorage(pkgName);
     debug('get package metadata for %o', pkgName);
     if (typeof storage === 'undefined') {
@@ -678,13 +627,13 @@ class Storage {
       manifest = (0, _storageUtils.normalizePackage)(manifest);
     } catch (err) {
       if (err.code === _storageUtils.STORAGE.NO_SUCH_FILE_ERROR || err.code === _core.HTTP_STATUS.NOT_FOUND) {
-        _logger.logger.info({
+        this.logger.info({
           pkgName,
           revision
         }, 'package not found');
         throw _core.errorUtils.getNotFound();
       }
-      _logger.logger.error({
+      this.logger.error({
         pkgName,
         revision,
         err: err.message
@@ -694,6 +643,8 @@ class Storage {
 
     // TODO:  move this to another method
     try {
+      // check if logged in user is allowed to remove package
+      await this.checkAllowedToChangePackage(manifest, username);
       await this.localStorage.getStoragePlugin().remove(pkgName);
       // remove each attachment
       const attachments = Object.keys(manifest._attachments);
@@ -701,7 +652,7 @@ class Storage {
       for (let attachment of attachments) {
         debug('remove attachment %s', attachment);
         await storage.deletePackage(attachment);
-        _logger.logger.info({
+        this.logger.info({
           attachment
         }, 'attachment @{attachment} removed');
       }
@@ -711,7 +662,7 @@ class Storage {
       // remove folder
       debug('remove package folder');
       await storage.removePackage();
-      _logger.logger.info({
+      this.logger.info({
         pkgName
       }, 'package @{pkgName} removed');
     } catch (err) {
@@ -805,11 +756,12 @@ class Storage {
       uplink = new _proxy.ProxyStorage({
         url: distFile.url,
         cache: true
-      }, this.config, _logger.logger);
+      }, this.config, this.logger);
     }
     return uplink;
   }
   async updateManifest(manifest, options) {
+    debug('update manifest %o for user %o', manifest._id, options.requestOptions.username);
     if ((0, _2.isDeprecatedManifest)(manifest)) {
       // if the manifest is deprecated, we need to update the package.json
       await this.deprecate(manifest, {
@@ -821,6 +773,12 @@ class Storage {
         ...options
       });
       return _core.API_MESSAGE.PKG_CHANGED;
+    } else if ((0, _starUtils.isPublishablePackage)(manifest) === false && Array.isArray(manifest.maintainers)) {
+      // if user request to change owners of package
+      await this.changeOwners(manifest, {
+        ...options
+      });
+      return _core.API_MESSAGE.PKG_CHANGED;
     } else if (_core.validatioUtils.validatePublishSingleVersion(manifest)) {
       // if continue, the version to be published does not exist
       // we create a new package
@@ -833,19 +791,19 @@ class Storage {
           name
         } = mergedManifest;
         await this.notify(mergedManifest, `${name}@${version}`);
-        _logger.logger.info({
+        this.logger.info({
           name,
           version
         }, 'notify for @{name}@@{version} has been sent');
       } catch (error) {
-        _logger.logger.error({
+        this.logger.error({
           error: error.message
         }, 'notify batch service has failed: @{error}');
       }
       return message;
     } else {
       debug('invalid body format');
-      _logger.logger.info({
+      this.logger.warn({
         packageName: options.name
       }, `wrong package format on publish a package @{packageName}`);
       throw _core.errorUtils.getBadRequest(_core.API_ERROR.UNSUPORTED_REGISTRY_CALL);
@@ -900,6 +858,35 @@ class Storage {
     }, options.revision);
     return _core.API_MESSAGE.PKG_CHANGED;
   }
+  async changeOwners(manifest, options) {
+    const {
+      maintainers
+    } = manifest;
+    const {
+      requestOptions,
+      name
+    } = options;
+    debug('change owners of %o', name);
+    const {
+      username
+    } = requestOptions;
+    if (!username) {
+      throw _core.errorUtils.getBadRequest('update owners only allowed for logged in users');
+    }
+    if (!maintainers || maintainers.length === 0) {
+      throw _core.errorUtils.getBadRequest('maintainers field is required and must not be empty');
+    }
+    const localPackage = await this.getPackageManifest({
+      name,
+      requestOptions,
+      uplinksLook: false
+    });
+    await this.changePackage(name, {
+      ...localPackage,
+      maintainers: maintainers
+    }, options.revision);
+    return _core.API_MESSAGE.PKG_CHANGED;
+  }
 
   /**
    * Get local package, on fails return null.
@@ -957,7 +944,8 @@ class Storage {
     const {
       name
     } = options;
-    debug('publishing a new package for %o', name);
+    const username = options.requestOptions.username;
+    debug('publishing a new package for %o as %o', name, username);
     let successResponseMessage;
     const manifest = {
       ..._core.validatioUtils.normalizeMetadata(body, name)
@@ -982,47 +970,51 @@ class Storage {
     const [firstAttachmentKey] = Object.keys(_attachments);
     const buffer = this.getBufferManifest(body._attachments[firstAttachmentKey].data);
     try {
-      var _this$config2, _this$config2$publish;
+      var _this$config2;
       // we check if package exist already locally
-      const manifest = await this.getPackagelocalByNameNext(name);
+      const localManifest = await this.getPackagelocalByNameNext(name);
       // if continue, the version to be published does not exist
-      if ((manifest === null || manifest === void 0 ? void 0 : manifest.versions[versionToPublish]) != null) {
-        debug('%s version %s already exists', name, versionToPublish);
+      if ((localManifest === null || localManifest === void 0 ? void 0 : localManifest.versions[versionToPublish]) != null) {
+        debug('%s version %s already exists (locally)', name, versionToPublish);
         throw _core.errorUtils.getConflict();
       }
-      const uplinksLook = ((_this$config2 = this.config) === null || _this$config2 === void 0 ? void 0 : (_this$config2$publish = _this$config2.publish) === null || _this$config2$publish === void 0 ? void 0 : _this$config2$publish.allow_offline) === false;
+      const uplinksLook = ((_this$config2 = this.config) === null || _this$config2 === void 0 || (_this$config2 = _this$config2.publish) === null || _this$config2 === void 0 ? void 0 : _this$config2.allow_offline) === false;
       // if execution get here, package does not exist locally, we search upstream
       const remoteManifest = await this.checkPackageRemote(name, uplinksLook);
       if ((remoteManifest === null || remoteManifest === void 0 ? void 0 : remoteManifest.versions[versionToPublish]) != null) {
-        debug('%s version %s already exists', name, versionToPublish);
+        debug('%s version %s already exists (upstream)', name, versionToPublish);
         throw _core.errorUtils.getConflict();
       }
       const hasPackageInStorage = await this.hasPackage(name);
       if (!hasPackageInStorage) {
-        await this.createNewLocalCachePackage(name, versionToPublish);
+        await this.createNewLocalCachePackage(name, username);
         successResponseMessage = _core.API_MESSAGE.PKG_CREATED;
       } else {
+        await this.checkAllowedToChangePackage(localManifest, username);
         successResponseMessage = _core.API_MESSAGE.PKG_CHANGED;
       }
     } catch (err) {
       debug('error on change or update a package with %o', err.message);
-      _logger.logger.error({
+      this.logger.error({
         err: err.message
-      }, 'error on create package: @{err}');
+      }, 'error on publish new version: @{err}');
       throw err;
     }
 
     // 1. after tarball has been successfully uploaded, we update the version
     try {
-      // TODO: review why do this
-      versions[versionToPublish].readme = _lodash.default.isNil(manifest.readme) === false ? String(manifest.readme) : '';
-      await this.addVersion(name, versionToPublish, versions[versionToPublish], null);
+      const tarballStats = await this.getTarballStats(versions[versionToPublish], buffer);
+      // Older package managers like npm6 do not send readme content as part of version but include it on root level
+      if (_lodash.default.isEmpty(versions[versionToPublish].readme)) {
+        versions[versionToPublish].readme = _lodash.default.isNil(manifest.readme) === false ? String(manifest.readme) : '';
+      }
+      // addVersion will move the readme from the the published version to the root level
+      await this.addVersion(name, versionToPublish, versions[versionToPublish], null, tarballStats);
     } catch (err) {
-      _logger.logger.error({
+      this.logger.error({
         err: err.message
       }, 'updated version has failed: @{err}');
       debug('error on create a version for %o with error %o', name, err.message);
-      // TODO: remove tarball if add version fails
       throw err;
     }
 
@@ -1033,16 +1025,15 @@ class Storage {
       // 1. add version
       // 2. merge versions
       // 3. upload tarball
-      // 3.update once to the storage (easy peasy)
+      // 4. update once to the storage (easy peasy)
       mergedManifest = await this.mergeTagsNext(name, manifest[_core.DIST_TAGS]);
     } catch (err) {
-      _logger.logger.error({
+      this.logger.error({
         err: err.message
       }, 'merge version has failed: @{err}');
       debug('error on create a version for %o with error %o', name, err.message);
       // TODO: undo if this fails
-      // 1. remove tarball
-      // 2. remove updated version
+      // 1. remove updated version
       throw err;
     }
 
@@ -1053,12 +1044,15 @@ class Storage {
         signal: options.signal
       });
     } catch (err) {
-      _logger.logger.error({
+      this.logger.error({
         err: err.message
       }, 'upload tarball has failed: @{err}');
+      // TODO: undo if this fails
+      // 1. remove updated version
+      // 2. remove new dist tags
       throw err;
     }
-    _logger.logger.info({
+    this.logger.info({
       name,
       version: versionToPublish
     }, 'package @{name}@@{version} has been published');
@@ -1198,22 +1192,31 @@ class Storage {
    * @param metadata version metadata
    * @param tag tag of the version
    */
-  async addVersion(name, version, metadata, tag) {
+  async addVersion(name, version, metadata, tag, tarballStats) {
     debug(`add version %s package for %s`, version, name);
     await this.updatePackage(name, async data => {
       // keep only one readme per package
       data.readme = metadata.readme;
-      debug('%s` readme mutated', name);
+      debug('%s readme mutated', name);
       // TODO: lodash remove
       metadata = (0, _2.cleanUpReadme)(metadata);
       metadata.contributors = (0, _utils.normalizeContributors)(metadata.contributors);
-      debug('%s` contributors normalized', name);
+      debug('%s contributors normalized', name);
+
+      // Copy current owners to version
+      metadata.maintainers = data.maintainers;
+
+      // Update tarball stats
+      if (metadata.dist) {
+        metadata.dist.fileCount = tarballStats.fileCount;
+        metadata.dist.unpackedSize = tarballStats.unpackedSize;
+      }
 
       // if uploaded tarball has a different shasum, it's very likely that we
       // have some kind of error
       if (_core.validatioUtils.isObject(metadata.dist) && _lodash.default.isString(metadata.dist.tarball)) {
         var _data$time;
-        const tarball = metadata.dist.tarball.replace(/.*\//, '');
+        const tarball = (0, _tarball.extractTarballFromUrl)(metadata.dist.tarball);
         if (_core.validatioUtils.isObject(data._attachments[tarball])) {
           if (_lodash.default.isNil(data._attachments[tarball].shasum) === false && _lodash.default.isNil(metadata.dist.shasum) === false) {
             if (data._attachments[tarball].shasum != metadata.dist.shasum) {
@@ -1254,7 +1257,7 @@ class Storage {
       // TODO: review this method, it's a bit ugly
       (0, _2.tagVersion)(data, version, tag);
       try {
-        debug('%s` add on database', name);
+        debug('%s add on database', name);
         await this.localStorage.getStoragePlugin().add(name);
         this.logger.debug({
           name,
@@ -1272,7 +1275,7 @@ class Storage {
    * @param name name of the package
    * @returns
    */
-  async createNewLocalCachePackage(name, latestVersion) {
+  async createNewLocalCachePackage(name, username) {
     const storage = this.getPrivatePackageStorage(name);
     if (!storage) {
       debug(`storage is missing for %o package cannot be added`, name);
@@ -1283,10 +1286,19 @@ class Storage {
       ...(0, _storageUtils.generatePackageTemplate)(name),
       time: {
         created: currentTime,
-        modified: currentTime,
-        [latestVersion]: currentTime
+        modified: currentTime
       }
     };
+
+    // Set initial package owner
+    // TODO: Add email of user
+    packageData.maintainers = username && username.length > 0 ? [{
+      name: username,
+      email: ''
+    }] : [{
+      name: _core.DEFAULT_USER,
+      email: ''
+    }];
     try {
       await storage.createPackage(name, packageData);
       this.logger.info({
@@ -1311,7 +1323,7 @@ class Storage {
   async checkPackageRemote(name, uplinksLook) {
     try {
       // we provide a null manifest, thus the manifest returned will be the remote one
-      const [remoteManifest, upLinksErrors] = await this.syncUplinksMetadataNext(name, null, {
+      const [remoteManifest, upLinksErrors] = await this.syncUplinksMetadata(name, null, {
         uplinksLook
       });
 
@@ -1416,7 +1428,7 @@ class Storage {
     // if we can't get the local metadata, we try to get the remote metadata
     // if we do to have local metadata, we try to update it with the upstream registry
     debug('sync uplinks for %o', name);
-    const [remoteManifest, upLinksErrors] = await this.syncUplinksMetadataNext(name, data, {
+    const [remoteManifest, upLinksErrors] = await this.syncUplinksMetadata(name, data, {
       uplinksLook: options.uplinksLook,
       retry: options.retry,
       remoteAddress: options.requestOptions.remoteAddress
@@ -1438,7 +1450,7 @@ class Storage {
       ...(0, _storageUtils.normalizeDistTags)((0, _storageUtils.cleanUpLinksRef)(remoteManifest, options.keepUpLinkData)),
       _attachments: {}
     });
-    debug('no. sync uplinks errors %o for %s', upLinksErrors === null || upLinksErrors === void 0 ? void 0 : upLinksErrors.length, name);
+    debug('no sync uplinks errors %o for %s', upLinksErrors === null || upLinksErrors === void 0 ? void 0 : upLinksErrors.length, name);
     return [normalizedPkg, upLinksErrors];
   }
 
@@ -1462,7 +1474,7 @@ class Storage {
     in that case the request returns empty body and we want ask next on the list if has fresh
     updates.
    */
-  async syncUplinksMetadataNext(name, localManifest, options = {}) {
+  async syncUplinksMetadata(name, localManifest, options = {}) {
     let found = localManifest !== null;
     let syncManifest = null;
     const upLinks = [];
@@ -1578,7 +1590,7 @@ class Storage {
     // merge time field cache and remote
     _cacheManifest = (0, _storageUtils.mergeUplinkTimeIntoLocalNext)(_cacheManifest, remoteManifest);
     // update the _uplinks field in the cache
-    _cacheManifest = (0, _uplinkUtil.updateVersionsHiddenUpLinkNext)(_cacheManifest, uplink);
+    _cacheManifest = (0, _proxy.updateVersionsHiddenUpLinkNext)(_cacheManifest, uplink);
     try {
       // merge versions from remote into the cache
       _cacheManifest = (0, _storageUtils.mergeVersions)(_cacheManifest, remoteManifest);
@@ -1697,7 +1709,7 @@ class Storage {
     for (const versionId in remoteManifest.versions) {
       // if detect a new remote version does not exist cache
       if (_lodash.default.isNil(cacheManifest.versions[versionId])) {
-        var _version2, _version2$dist;
+        var _version2;
         debug('new version from upstream %o', versionId);
         let version = remoteManifest.versions[versionId];
 
@@ -1709,7 +1721,7 @@ class Storage {
         version.contributors = (0, _utils.normalizeContributors)(version.contributors);
         change = true;
         cacheManifest.versions[versionId] = version;
-        if ((_version2 = version) !== null && _version2 !== void 0 && (_version2$dist = _version2.dist) !== null && _version2$dist !== void 0 && _version2$dist.tarball) {
+        if ((_version2 = version) !== null && _version2 !== void 0 && (_version2 = _version2.dist) !== null && _version2 !== void 0 && _version2.tarball) {
           const filename = _core.pkgUtils.extractTarballName(version.dist.tarball);
           // store a fast access to the dist file by tarball name
           // it does NOT overwrite any existing records
@@ -1758,6 +1770,31 @@ class Storage {
       return cacheManifest;
     }
   }
+  async getTarballStats(version, buffer) {
+    var _version$dist, _version$dist2;
+    if (version.dist == undefined || ((_version$dist = version.dist) === null || _version$dist === void 0 ? void 0 : _version$dist.fileCount) == undefined || ((_version$dist2 = version.dist) === null || _version$dist2 === void 0 ? void 0 : _version$dist2.unpackedSize) == undefined) {
+      debug('tarball stats not found, calculating');
+      return await (0, _tarball.getTarballDetails)(buffer);
+    } else {
+      debug('tarball stats found');
+      return {
+        fileCount: version.dist.fileCount,
+        unpackedSize: version.dist.unpackedSize
+      };
+    }
+  }
+  async checkAllowedToChangePackage(manifest, username) {
+    var _this$config3;
+    // Checks to perform if config "publish:check_owners" is true
+    debug('check if user %o is an owner and allowed to change package', username);
+    // if name of owner is not included in list of maintainers, then throw an error
+    if (((_this$config3 = this.config) === null || _this$config3 === void 0 || (_this$config3 = _this$config3.publish) === null || _this$config3 === void 0 ? void 0 : _this$config3.check_owners) === true && manifest.maintainers && manifest.maintainers.length > 0 && !manifest.maintainers.some(maintainer => maintainer.name === username)) {
+      this.logger.error({
+        username
+      }, '@{username} is not a maintainer (package owner)');
+      throw Error('only owners are allowed to change package');
+    }
+  }
 }
 exports.Storage = Storage;
 //# sourceMappingURL=storage.js.map