@verdaccio/store 7.0.0-next.6 → 8.0.0-next-8.0

package/src/storage.ts

@@ -2,7 +2,7 @@ import assert from 'assert';
 import buildDebug from 'debug';
 import _, { isEmpty, isNil } from 'lodash';
 import { basename } from 'path';
-import { PassThrough, Readable, Transform, pipeline as streamPipeline } from 'stream';
+import { PassThrough, Readable, Transform } from 'stream';
 import { pipeline } from 'stream/promises';
 import { default as URL } from 'url';
 
@@ -10,9 +10,12 @@ import { hasProxyTo } from '@verdaccio/config';
 import {
   API_ERROR,
   API_MESSAGE,
+  DEFAULT_USER,
   DIST_TAGS,
   HEADER_TYPE,
   HTTP_STATUS,
+  MAINTAINERS,
+  PLUGIN_CATEGORY,
   SUPPORT_ERRORS,
   USERS,
   errorUtils,
@@ -22,12 +25,22 @@ import {
   validatioUtils,
 } from '@verdaccio/core';
 import { asyncLoadPlugin } from '@verdaccio/loaders';
-import { logger } from '@verdaccio/logger';
-import { IProxy, ISyncUplinksOptions, ProxySearchParams, ProxyStorage } from '@verdaccio/proxy';
 import {
+  IProxy,
+  ISyncUplinksOptions,
+  ProxyInstanceList,
+  ProxySearchParams,
+  ProxyStorage,
+  setupUpLinks,
+  updateVersionsHiddenUpLinkNext,
+} from '@verdaccio/proxy';
+import Search from '@verdaccio/search';
+import {
+  TarballDetails,
   convertDistRemoteToLocalTarballUrls,
   convertDistVersionToLocalTarballsUrl,
   extractTarballFromUrl,
+  getTarballDetails,
 } from '@verdaccio/tarball';
 import {
   AbbreviatedManifest,
@@ -52,12 +65,9 @@ import {
   UpdateManifestOptions,
   cleanUpReadme,
   isDeprecatedManifest,
-  mapManifestToSearchPackageBody,
   tagVersion,
   tagVersionNext,
 } from '.';
-import { TransFormResults } from './lib/TransFormResults';
-import { removeDuplicates } from './lib/search-utils';
 import { isPublishablePackage } from './lib/star-utils';
 import { isExecutingStarCommand } from './lib/star-utils';
 import {
@@ -66,16 +76,16 @@ import {
   generatePackageTemplate,
   generateRevision,
   getLatestReadme,
+  mapManifestToSearchPackageBody,
   mergeUplinkTimeIntoLocalNext,
   mergeVersions,
   normalizeDistTags,
   normalizePackage,
   updateUpLinkMetadata,
 } from './lib/storage-utils';
-import { ProxyInstanceList, setupUpLinks, updateVersionsHiddenUpLinkNext } from './lib/uplink-util';
-import { getVersion } from './lib/versions-utils';
+import { getVersion, removeLowerVersions } from './lib/versions-utils';
 import { LocalStorage } from './local-storage';
-import { IGetPackageOptionsNext, StarManifestBody } from './type';
+import { IGetPackageOptionsNext, OwnerManifestBody, StarManifestBody } from './type';
 
 const debug = buildDebug('verdaccio:storage');
 
@@ -90,10 +100,12 @@ class Storage {
   public readonly config: Config;
   public readonly logger: Logger;
   public readonly uplinks: ProxyInstanceList;
-  public constructor(config: Config) {
+  private searchService: Search;
+  public constructor(config: Config, logger: Logger) {
     this.config = config;
-    this.uplinks = setupUpLinks(config);
     this.logger = logger.child({ module: 'storage' });
+    this.uplinks = setupUpLinks(config, this.logger);
+    this.searchService = new Search(config, this.logger);
     this.filters = null;
     // @ts-ignore
     this.localStorage = null;
@@ -109,7 +121,7 @@ class Storage {
    */
   public async changePackage(name: string, metadata: Manifest, revision: string): Promise<void> {
     debug('change existing package for package %o revision %o', name, revision);
-    debug(`change manifest tags for %o revision %s`, name, revision);
+    debug(`change manifest tags for %o revision %o`, name, revision);
     if (
       !validatioUtils.isObject(metadata.versions) ||
       !validatioUtils.isObject(metadata[DIST_TAGS])
@@ -118,7 +130,7 @@ class Storage {
       throw errorUtils.getBadData();
     }
 
-    debug(`change manifest udapting manifest for %o`, name);
+    debug(`change manifest updating manifest for %o`, name);
     await this.updatePackage(name, async (localData: Manifest): Promise<Manifest> => {
       // eslint-disable-next-line guard-for-in
       for (const version in localData.versions) {
@@ -155,13 +167,14 @@ class Storage {
 
       localData[USERS] = metadata[USERS];
       localData[DIST_TAGS] = metadata[DIST_TAGS];
+      localData[MAINTAINERS] = metadata[MAINTAINERS];
       return localData;
     });
   }
 
-  public async removePackage(name: string, revision): Promise<void> {
+  public async removePackage(name: string, revision: string, username: string): Promise<void> {
     debug('remove package %o', name);
-    await this.removePackageByRevision(name, revision);
+    await this.removePackageByRevision(name, revision, username);
   }
 
   /**
@@ -171,8 +184,13 @@ class Storage {
    versions, i.e. package version should be unpublished first.
    Used storage: local (write)
    */
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  public async removeTarball(name: string, filename: string, _revision: string): Promise<Manifest> {
+  public async removeTarball(
+    name: string,
+    filename: string,
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    _revision: string,
+    username: string
+  ): Promise<Manifest> {
     debug('remove tarball %s for %s', filename, name);
     assert(validatioUtils.validateName(filename));
     const storage: pluginUtils.StorageHandler = this.getPrivatePackageStorage(name);
@@ -187,6 +205,9 @@ class Storage {
       if (!cacheManifest._attachments[filename]) {
         throw errorUtils.getNotFound('no such file available');
       }
+
+      // check if logged in user is allowed to remove tarball
+      await this.checkAllowedToChangePackage(cacheManifest, username);
     } catch (err: any) {
       if (err.code === noSuchFile) {
         throw errorUtils.getNotFound();
@@ -220,63 +241,19 @@ class Storage {
   /**
    * Handle search on packages and proxies.
    * Iterate all proxies configured and search in all endpoints in v2 and pipe all responses
-   * to a stream, once the proxies request has finished search in local storage for all packages
+   *  once the proxies request has finished search in local storage for all packages
    * (privated and cached).
    */
   public async search(options: ProxySearchParams): Promise<searchUtils.SearchPackageItem[]> {
-    const transformResults = new TransFormResults({ objectMode: true });
-    const streamPassThrough = new PassThrough({ objectMode: true });
-    const upLinkList = this.getProxyList();
-    debug('uplinks found %s', upLinkList.length);
-    const searchUplinksStreams = upLinkList.map((uplinkId: string) => {
-      const uplink = this.uplinks[uplinkId];
-      if (!uplink) {
-        // this line should never happens
-        this.logger.error({ uplinkId }, 'uplink @upLinkId not found');
-      }
-      return this.consumeSearchStream(uplinkId, uplink, options, streamPassThrough);
-    });
-
-    try {
-      debug('searching on %s uplinks...', searchUplinksStreams?.length);
-      // only process those streams end successfully, if all request fails
-      // just include local storage results (if local fails then return 500)
-      await Promise.allSettled([...searchUplinksStreams]);
-      debug('searching all uplinks done');
-    } catch (err: any) {
-      this.logger.error({ err: err?.message }, ' error on uplinks search @{err}');
-      streamPassThrough.emit('error', err);
-    }
-    debug('search local');
-    try {
-      await this.searchCachedPackages(streamPassThrough, options.query as searchUtils.SearchQuery);
-    } catch (err: any) {
-      this.logger.error({ err: err?.message }, ' error on local search @{err}');
-      streamPassThrough.emit('error', err);
-    }
-    const data: searchUtils.SearchPackageItem[] = [];
-    const outPutStream = new PassThrough({ objectMode: true });
-    streamPipeline(streamPassThrough, transformResults, outPutStream, (err: any) => {
-      if (err) {
-        this.logger.error({ err: err?.message }, ' error on search @{err}');
-        throw errorUtils.getInternalError(err ? err.message : 'unknown search error');
-      } else {
-        debug('pipeline succeeded');
-      }
-    });
-
-    outPutStream.on('data', (chunk) => {
-      data.push(chunk);
-    });
-
-    return new Promise((resolve) => {
-      outPutStream.on('finish', async () => {
-        const searchFinalResults: searchUtils.SearchPackageItem[] = removeDuplicates(data);
-        debug('search stream total results: %o', searchFinalResults.length);
-        return resolve(searchFinalResults);
-      });
-      debug('search done');
-    });
+    debug('search on cache packages');
+    const cachePackages = await this.getCachedPackages(options.query);
+    debug('search found on cache packages %o', cachePackages.length);
+    const remotePackages = await this.searchService.search(options);
+    debug('search found on remote packages %o', remotePackages.length);
+    const totalResults = [...cachePackages, ...remotePackages];
+    const uniqueResults = removeLowerVersions(totalResults);
+    debug('unique results %o', uniqueResults.length);
+    return uniqueResults;
   }
 
   private async getTarballFromUpstream(name: string, filename: string, { signal }) {
@@ -382,7 +359,7 @@ class Storage {
       // should not be the case
       const passThroughRemoteStream = new PassThrough();
       // ensure get the latest data
-      const [updatedManifest] = await this.syncUplinksMetadataNext(name, cachedManifest, {
+      const [updatedManifest] = await this.syncUplinksMetadata(name, cachedManifest, {
         uplinksLook: true,
       });
       const distFile = (updatedManifest as Manifest)._distfiles[filename];
@@ -425,7 +402,7 @@ class Storage {
    * @param param2
    * @returns
    */
-  public async getTarballNext(name: string, filename: string, { signal }): Promise<PassThrough> {
+  public async getTarball(name: string, filename: string, { signal }): Promise<PassThrough> {
     debug('get tarball for package %o filename %o', name, filename);
     // TODO: check if isOpen is need it after all.
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -518,6 +495,17 @@ class Storage {
   public async getPackageManifest(options: IGetPackageOptionsNext): Promise<Manifest> {
     // convert dist remotes to local bars
     const [manifest] = await this.getPackageNext(options);
+
+    // If change access is requested (?write=true), then check if logged in user is allowed to change package
+    if (options.byPassCache === true) {
+      try {
+        await this.checkAllowedToChangePackage(manifest, options.requestOptions.username);
+      } catch (error: any) {
+        this.logger.error({ error: error.message }, 'getting package has failed: @{error}');
+        throw errorUtils.getBadRequest(error.message);
+      }
+    }
+
     const convertedManifest = convertDistRemoteToLocalTarballUrls(
       manifest,
       options.requestOptions,
@@ -536,7 +524,6 @@ class Storage {
         const _version_abbreviated = {
           name: _version.name,
           version: _version.version,
-          description: _version.description,
           deprecated: _version.deprecated,
           bin: _version.bin,
           dist: _version.dist,
@@ -548,6 +535,10 @@ class Storage {
           peerDependencies: _version.peerDependencies,
           optionalDependencies: _version.optionalDependencies,
           bundleDependencies: _version.bundleDependencies,
+          cpu: _version.cpu,
+          os: _version.os,
+          peerDependenciesMeta: _version.peerDependenciesMeta,
+          acceptDependencies: _version.acceptDependencies,
           // npm cli specifics
           _hasShrinkwrap: _version._hasShrinkwrap,
           hasInstallScript: _version.hasInstallScript,
@@ -656,7 +647,7 @@ class Storage {
    */
   public async init(config: Config): Promise<void> {
     if (this.localStorage === null) {
-      this.localStorage = new LocalStorage(this.config, logger);
+      this.localStorage = new LocalStorage(this.config, this.logger);
       await this.localStorage.init();
       debug('local init storage initialized');
       await this.localStorage.getSecret(config);
@@ -674,35 +665,14 @@ class Storage {
         (plugin: pluginUtils.ManifestFilter<Config>) => {
           return typeof plugin.filter_metadata !== 'undefined';
         },
-        this.config?.serverSettings?.pluginPrefix
+        this.config?.serverSettings?.pluginPrefix,
+        PLUGIN_CATEGORY.FILTER
       );
-      debug('filters available %o', this.filters);
+      debug('filters available %o', this.filters.length);
     }
     return;
   }
 
-  /**
-   * Consume the upstream and pipe it to a transformable stream.
-   */
-  private consumeSearchStream(
-    uplinkId: string,
-    uplink: IProxy,
-    options: ProxySearchParams,
-    searchPassThrough: PassThrough
-  ): Promise<any> {
-    return uplink.search({ ...options }).then((bodyStream) => {
-      bodyStream.pipe(searchPassThrough, { end: false });
-      bodyStream.on('error', (err: any): void => {
-        logger.error(
-          { uplinkId, err: err },
-          'search error for uplink @{uplinkId}: @{err?.message}'
-        );
-        searchPassThrough.end();
-      });
-      return new Promise((resolve) => bodyStream.on('end', resolve));
-    });
-  }
-
   /**
    * Retrieve a wrapper that provide access to the package location.
    * @param {Object} pkgName package name.
@@ -734,11 +704,16 @@ class Storage {
     return await storage.readTarball(filename, { signal });
   }
 
-  private async searchCachedPackages(
-    searchStream: PassThrough,
-    query: searchUtils.SearchQuery
-  ): Promise<void> {
-    debug('search on each package');
+  public async getCachedPackages(
+    query?: searchUtils.SearchQuery
+  ): Promise<searchUtils.SearchPackageItem[]> {
+    debug('search on each package', query);
+    const results: searchUtils.SearchPackageItem[] = [];
+    if (typeof query === 'undefined' || typeof query?.text === 'undefined') {
+      debug('search query for cached not found');
+      return results;
+    }
+
     this.logger.info(
       { t: query.text, q: query.quality, p: query.popularity, m: query.maintenance, s: query.size },
       'search by text @{t}| maintenance @{m}| quality @{q}| popularity @{p}'
@@ -746,15 +721,15 @@ class Storage {
 
     if (typeof this.localStorage.getStoragePlugin().search === 'undefined') {
       this.logger.info('plugin search not implemented yet');
-      searchStream.end();
     } else {
-      debug('search on each package by plugin');
+      debug('search on each package by plugin query');
       const items = await this.localStorage.getStoragePlugin().search(query);
       try {
         for (const searchItem of items) {
           const manifest = await this.getPackageLocalMetadata(searchItem.package.name);
           if (_.isEmpty(manifest?.versions) === false) {
             const searchPackage = mapManifestToSearchPackageBody(manifest, searchItem);
+            debug('search local stream found %o', searchPackage.name);
             const searchPackageItem: searchUtils.SearchPackageItem = {
               package: searchPackage,
               score: searchItem.score,
@@ -764,19 +739,25 @@ class Storage {
               // FUTURE: find a better way to calculate the score
               searchScore: 1,
             };
-            searchStream.write(searchPackageItem);
+            results.push(searchPackageItem);
+          } else {
+            debug('local item without versions detected %s', searchItem.package.name);
           }
         }
         debug('search local stream end');
-        searchStream.end();
       } catch (err) {
         this.logger.error({ err, query }, 'error on search by plugin @{err.message}');
-        searchStream.emit('error', err);
+        throw err;
       }
     }
+    return results;
   }
 
-  private async removePackageByRevision(pkgName: string, revision: string): Promise<void> {
+  private async removePackageByRevision(
+    pkgName: string,
+    revision: string,
+    username: string
+  ): Promise<void> {
     const storage: pluginUtils.StorageHandler = this.getPrivatePackageStorage(pkgName);
     debug('get package metadata for %o', pkgName);
     if (typeof storage === 'undefined') {
@@ -788,10 +769,10 @@ class Storage {
       manifest = normalizePackage(manifest);
     } catch (err: any) {
       if (err.code === STORAGE.NO_SUCH_FILE_ERROR || err.code === HTTP_STATUS.NOT_FOUND) {
-        logger.info({ pkgName, revision }, 'package not found');
+        this.logger.info({ pkgName, revision }, 'package not found');
         throw errorUtils.getNotFound();
       }
-      logger.error(
+      this.logger.error(
         { pkgName, revision, err: err.message },
         'error @{err} while reading package @{pkgName}-{revision}'
       );
@@ -800,6 +781,9 @@ class Storage {
 
     // TODO:  move this to another method
     try {
+      // check if logged in user is allowed to remove package
+      await this.checkAllowedToChangePackage(manifest, username);
+
       await this.localStorage.getStoragePlugin().remove(pkgName);
       // remove each attachment
       const attachments = Object.keys(manifest._attachments);
@@ -807,7 +791,7 @@ class Storage {
       for (let attachment of attachments) {
         debug('remove attachment %s', attachment);
         await storage.deletePackage(attachment);
-        logger.info({ attachment }, 'attachment @{attachment} removed');
+        this.logger.info({ attachment }, 'attachment @{attachment} removed');
       }
       // remove package.json
       debug('remove package.json');
@@ -815,7 +799,7 @@ class Storage {
       // remove folder
       debug('remove package folder');
       await storage.removePackage();
-      logger.info({ pkgName }, 'package @{pkgName} removed');
+      this.logger.info({ pkgName }, 'package @{pkgName} removed');
     } catch (err: any) {
       this.logger.error({ err }, 'removed package has failed @{err.message}');
       throw errorUtils.getBadData(err.message);
@@ -914,16 +898,17 @@ class Storage {
           cache: true,
         },
         this.config,
-        logger
+        this.logger
       );
     }
     return uplink;
   }
 
   public async updateManifest(
-    manifest: Manifest | StarManifestBody,
+    manifest: Manifest | StarManifestBody | OwnerManifestBody,
     options: UpdateManifestOptions
   ): Promise<string | undefined> {
+    debug('update manifest %o for user %o', manifest._id, options.requestOptions.username);
     if (isDeprecatedManifest(manifest as Manifest)) {
       // if the manifest is deprecated, we need to update the package.json
       await this.deprecate(manifest as Manifest, {
@@ -931,13 +916,22 @@ class Storage {
       });
     } else if (
       isPublishablePackage(manifest as Manifest) === false &&
-      validatioUtils.isObject(manifest.users)
+      validatioUtils.isObject((manifest as StarManifestBody).users)
     ) {
       // if user request to apply a star to the manifest
       await this.star(manifest as StarManifestBody, {
         ...options,
       });
       return API_MESSAGE.PKG_CHANGED;
+    } else if (
+      isPublishablePackage(manifest as Manifest) === false &&
+      Array.isArray((manifest as OwnerManifestBody).maintainers)
+    ) {
+      // if user request to change owners of package
+      await this.changeOwners(manifest as OwnerManifestBody, {
+        ...options,
+      });
+      return API_MESSAGE.PKG_CHANGED;
     } else if (validatioUtils.validatePublishSingleVersion(manifest)) {
       // if continue, the version to be published does not exist
       // we create a new package
@@ -951,14 +945,14 @@ class Storage {
       try {
         const { name } = mergedManifest;
         await this.notify(mergedManifest, `${name}@${version}`);
-        logger.info({ name, version }, 'notify for @{name}@@{version} has been sent');
+        this.logger.info({ name, version }, 'notify for @{name}@@{version} has been sent');
       } catch (error: any) {
-        logger.error({ error: error.message }, 'notify batch service has failed: @{error}');
+        this.logger.error({ error: error.message }, 'notify batch service has failed: @{error}');
       }
       return message;
     } else {
       debug('invalid body format');
-      logger.info(
+      this.logger.warn(
         { packageName: options.name },
         `wrong package format on publish a package @{packageName}`
       );
@@ -1019,6 +1013,36 @@ class Storage {
     return API_MESSAGE.PKG_CHANGED;
   }
 
+  private async changeOwners(
+    manifest: OwnerManifestBody,
+    options: UpdateManifestOptions
+  ): Promise<string> {
+    const { maintainers } = manifest;
+    const { requestOptions, name } = options;
+    debug('change owners of %o', name);
+    const { username } = requestOptions;
+    if (!username) {
+      throw errorUtils.getBadRequest('update owners only allowed for logged in users');
+    }
+    if (!maintainers || maintainers.length === 0) {
+      throw errorUtils.getBadRequest('maintainers field is required and must not be empty');
+    }
+
+    const localPackage = await this.getPackageManifest({
+      name,
+      requestOptions,
+      uplinksLook: false,
+    });
+
+    await this.changePackage(
+      name,
+      { ...localPackage, maintainers: maintainers as Author[] },
+      options.revision as string
+    );
+
+    return API_MESSAGE.PKG_CHANGED;
+  }
+
   /**
    * Get local package, on fails return null.
    * Errors are considered package not found.
@@ -1076,7 +1100,8 @@ class Storage {
     options: PublishOptions
   ): Promise<[Manifest, string, string]> {
     const { name } = options;
-    debug('publishing a new package for %o', name);
+    const username = options.requestOptions.username;
+    debug('publishing a new package for %o as %o', name, username);
     let successResponseMessage;
     const manifest: Manifest = { ...validatioUtils.normalizeMetadata(body, name) };
     const { _attachments, versions } = manifest;
@@ -1098,43 +1123,47 @@ class Storage {
 
     try {
       // we check if package exist already locally
-      const manifest = await this.getPackagelocalByNameNext(name);
+      const localManifest = await this.getPackagelocalByNameNext(name);
       // if continue, the version to be published does not exist
-      if (manifest?.versions[versionToPublish] != null) {
-        debug('%s version %s already exists', name, versionToPublish);
+      if (localManifest?.versions[versionToPublish] != null) {
+        debug('%s version %s already exists (locally)', name, versionToPublish);
         throw errorUtils.getConflict();
       }
       const uplinksLook = this.config?.publish?.allow_offline === false;
       // if execution get here, package does not exist locally, we search upstream
       const remoteManifest = await this.checkPackageRemote(name, uplinksLook);
       if (remoteManifest?.versions[versionToPublish] != null) {
-        debug('%s version %s already exists', name, versionToPublish);
+        debug('%s version %s already exists (upstream)', name, versionToPublish);
         throw errorUtils.getConflict();
       }
 
       const hasPackageInStorage = await this.hasPackage(name);
       if (!hasPackageInStorage) {
-        await this.createNewLocalCachePackage(name, versionToPublish);
+        await this.createNewLocalCachePackage(name, username);
         successResponseMessage = API_MESSAGE.PKG_CREATED;
       } else {
+        await this.checkAllowedToChangePackage(localManifest as Manifest, username);
         successResponseMessage = API_MESSAGE.PKG_CHANGED;
       }
     } catch (err: any) {
       debug('error on change or update a package with %o', err.message);
-      logger.error({ err: err.message }, 'error on create package: @{err}');
+      this.logger.error({ err: err.message }, 'error on publish new version: @{err}');
       throw err;
     }
 
     // 1. after tarball has been successfully uploaded, we update the version
     try {
-      // TODO: review why do this
-      versions[versionToPublish].readme =
-        _.isNil(manifest.readme) === false ? String(manifest.readme) : '';
-      await this.addVersion(name, versionToPublish, versions[versionToPublish], null);
+      const tarballStats = await this.getTarballStats(versions[versionToPublish], buffer);
+      // Older package managers like npm6 do not send readme content as part of version but include it on root level
+      if (_.isEmpty(versions[versionToPublish].readme)) {
+        versions[versionToPublish].readme =
+          _.isNil(manifest.readme) === false ? String(manifest.readme) : '';
+      }
+      // addVersion will move the readme from the the published version to the root level
+      await this.addVersion(name, versionToPublish, versions[versionToPublish], null, tarballStats);
     } catch (err: any) {
-      logger.error({ err: err.message }, 'updated version has failed: @{err}');
+      this.logger.error({ err: err.message }, 'updated version has failed: @{err}');
       debug('error on create a version for %o with error %o', name, err.message);
-      // TODO: remove tarball if add version fails
       throw err;
     }
 
@@ -1145,14 +1174,13 @@ class Storage {
       // 1. add version
       // 2. merge versions
       // 3. upload tarball
-      // 3.update once to the storage (easy peasy)
+      // 4. update once to the storage (easy peasy)
       mergedManifest = await this.mergeTagsNext(name, manifest[DIST_TAGS]);
     } catch (err: any) {
-      logger.error({ err: err.message }, 'merge version has failed: @{err}');
+      this.logger.error({ err: err.message }, 'merge version has failed: @{err}');
       debug('error on create a version for %o with error %o', name, err.message);
       // TODO: undo if this fails
-      // 1. remove tarball
-      // 2. remove updated version
+      // 1. remove updated version
       throw err;
     }
 
@@ -1163,11 +1191,14 @@ class Storage {
         signal: options.signal,
       });
     } catch (err: any) {
-      logger.error({ err: err.message }, 'upload tarball has failed: @{err}');
+      this.logger.error({ err: err.message }, 'upload tarball has failed: @{err}');
+      // TODO: undo if this fails
+      // 1. remove updated version
+      // 2. remove new dist tags
       throw err;
     }
 
-    logger.info(
+    this.logger.info(
       { name, version: versionToPublish },
       'package @{name}@@{version} has been published'
     );
@@ -1331,17 +1362,27 @@ class Storage {
     name: string,
     version: string,
     metadata: Version,
-    tag: StringValue
+    tag: StringValue,
+    tarballStats: TarballDetails
   ): Promise<void> {
     debug(`add version %s package for %s`, version, name);
     await this.updatePackage(name, async (data: Manifest): Promise<Manifest> => {
       // keep only one readme per package
       data.readme = metadata.readme;
-      debug('%s` readme mutated', name);
+      debug('%s readme mutated', name);
       // TODO: lodash remove
       metadata = cleanUpReadme(metadata);
       metadata.contributors = normalizeContributors(metadata.contributors as Author[]);
-      debug('%s` contributors normalized', name);
+      debug('%s contributors normalized', name);
+
+      // Copy current owners to version
+      metadata.maintainers = data.maintainers;
+
+      // Update tarball stats
+      if (metadata.dist) {
+        metadata.dist.fileCount = tarballStats.fileCount;
+        metadata.dist.unpackedSize = tarballStats.unpackedSize;
+      }
 
       // if uploaded tarball has a different shasum, it's very likely that we
       // have some kind of error
@@ -1396,7 +1437,7 @@ class Storage {
       tagVersion(data, version, tag);
 
       try {
-        debug('%s` add on database', name);
+        debug('%s add on database', name);
         await this.localStorage.getStoragePlugin().add(name);
         this.logger.debug({ name, version }, 'version @{version} added to database for @{name}');
       } catch (err: any) {
@@ -1411,7 +1452,10 @@ class Storage {
    * @param name name of the package
    * @returns
    */
-  private async createNewLocalCachePackage(name: string, latestVersion: string): Promise<void> {
+  private async createNewLocalCachePackage(
+    name: string,
+    username: string | undefined
+  ): Promise<void> {
     const storage: pluginUtils.StorageHandler = this.getPrivatePackageStorage(name);
 
     if (!storage) {
@@ -1425,10 +1469,16 @@ class Storage {
       time: {
         created: currentTime,
         modified: currentTime,
-        [latestVersion]: currentTime,
       },
     };
 
+    // Set initial package owner
+    // TODO: Add email of user
+    packageData.maintainers =
+      username && username.length > 0
+        ? [{ name: username, email: '' }]
+        : [{ name: DEFAULT_USER, email: '' }];
+
     try {
       await storage.createPackage(name, packageData);
       this.logger.info({ name }, 'created new package @{name}');
@@ -1454,7 +1504,7 @@ class Storage {
   private async checkPackageRemote(name: string, uplinksLook: boolean): Promise<Manifest | null> {
     try {
       // we provide a null manifest, thus the manifest returned will be the remote one
-      const [remoteManifest, upLinksErrors] = await this.syncUplinksMetadataNext(name, null, {
+      const [remoteManifest, upLinksErrors] = await this.syncUplinksMetadata(name, null, {
         uplinksLook,
       });
 
@@ -1567,7 +1617,7 @@ class Storage {
     // if we can't get the local metadata, we try to get the remote metadata
     // if we do to have local metadata, we try to update it with the upstream registry
     debug('sync uplinks for %o', name);
-    const [remoteManifest, upLinksErrors] = await this.syncUplinksMetadataNext(name, data, {
+    const [remoteManifest, upLinksErrors] = await this.syncUplinksMetadata(name, data, {
       uplinksLook: options.uplinksLook,
       retry: options.retry,
       remoteAddress: options.requestOptions.remoteAddress,
@@ -1590,7 +1640,7 @@ class Storage {
       _attachments: {},
     });
 
-    debug('no. sync uplinks errors %o for %s', upLinksErrors?.length, name);
+    debug('no sync uplinks errors %o for %s', upLinksErrors?.length, name);
     return [normalizedPkg, upLinksErrors];
   }
 
@@ -1618,7 +1668,7 @@ class Storage {
     in that case the request returns empty body and we want ask next on the list if has fresh
     updates.
    */
-  public async syncUplinksMetadataNext(
+  public async syncUplinksMetadata(
     name: string,
     localManifest: Manifest | null,
     options: Partial<ISyncUplinksOptions> = {}
@@ -1954,6 +2004,35 @@ class Storage {
       return cacheManifest;
     }
   }
+
+  private async getTarballStats(version: Version, buffer: Buffer): Promise<TarballDetails> {
+    if (
+      version.dist == undefined ||
+      version.dist?.fileCount == undefined ||
+      version.dist?.unpackedSize == undefined
+    ) {
+      debug('tarball stats not found, calculating');
+      return await getTarballDetails(buffer);
+    } else {
+      debug('tarball stats found');
+      return { fileCount: version.dist.fileCount, unpackedSize: version.dist.unpackedSize };
+    }
+  }
+
+  private async checkAllowedToChangePackage(manifest: Manifest, username: string | undefined) {
+    // Checks to perform if config "publish:check_owners" is true
+    debug('check if user %o is an owner and allowed to change package', username);
+    // if name of owner is not included in list of maintainers, then throw an error
+    if (
+      this.config?.publish?.check_owners === true &&
+      manifest.maintainers &&
+      manifest.maintainers.length > 0 &&
+      !manifest.maintainers.some((maintainer) => maintainer.name === username)
+    ) {
+      this.logger.error({ username }, '@{username} is not a maintainer (package owner)');
+      throw Error('only owners are allowed to change package');
+    }
+  }
 }
 
 export { Storage };