@verdaccio/store 7.0.0-next.6 → 8.0.0-next-8.0

package/test/storage.spec.ts

@@ -24,7 +24,14 @@ import {
   generateRemotePackageMetadata,
   getDeprecatedPackageMetadata,
 } from '@verdaccio/test-helper';
-import { AbbreviatedManifest, ConfigYaml, Manifest, PackageUsers, Version } from '@verdaccio/types';
+import {
+  AbbreviatedManifest,
+  Author,
+  ConfigYaml,
+  Manifest,
+  PackageUsers,
+  Version,
+} from '@verdaccio/types';
 
 import { Storage } from '../src';
 import manifestFooRemoteNpmjs from './fixtures/manifests/foo-npmjs.json';
@@ -37,7 +44,7 @@ function generateRandomStorage() {
   return path.join(tempRoot, tempStorage);
 }
 
-setup({ type: 'stdout', format: 'pretty', level: 'trace' });
+const logger = setup({ type: 'stdout', format: 'pretty', level: 'trace' });
 
 const domain = 'https://registry.npmjs.org';
 const fakeHost = 'localhost:4873';
@@ -89,6 +96,31 @@ const executeStarPackage = async (
   });
 };
 
+const executeChangeOwners = async (
+  storage,
+  options: {
+    maintainers: Author[];
+    username: string;
+    name: string;
+    _rev: string;
+    _id?: string;
+  }
+) => {
+  const { name, _rev, _id, maintainers, username } = options;
+  const ownerManifest = {
+    _rev,
+    _id,
+    maintainers,
+  };
+  return storage.updateManifest(ownerManifest, {
+    signal: new AbortController().signal,
+    name,
+    uplinksLook: true,
+    revision: '1',
+    requestOptions: { ...defaultRequestOptions, username },
+  });
+};
+
 describe('storage', () => {
   beforeEach(() => {
     nock.cleanAll();
@@ -117,7 +149,7 @@ describe('storage', () => {
             __dirname
           )
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
         await storage.updateManifest(bodyNewManifest, {
@@ -141,6 +173,8 @@ describe('storage', () => {
           modified: mockDate,
         });
         expect(manifest[DIST_TAGS]).toEqual({ latest: '1.0.0' });
+        // verdaccio keeps latest version of readme on manifest level but not by version
+        expect(manifest.versions['1.0.0'].readme).not.toBeDefined();
         expect(manifest.readme).toEqual('# test');
         expect(manifest._attachments).toEqual({});
         expect(typeof manifest._rev).toBeTruthy();
@@ -160,7 +194,7 @@ describe('storage', () => {
             __dirname
           )
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         const ac = new AbortController();
         setTimeout(() => {
@@ -205,7 +239,7 @@ describe('storage', () => {
             __dirname
           )
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         // create a package
         const bodyNewManifest1 = generatePackageMetadata(pkgName, '1.0.0');
@@ -260,10 +294,12 @@ describe('storage', () => {
         expect(manifestVersion._id).toEqual(`${pkgName}@1.0.1`);
         expect(manifestVersion.description).toEqual('package generated');
         expect(manifestVersion.dist).toEqual({
+          fileCount: 4,
           integrity:
             'sha512-6gHiERpiDgtb3hjqpQH5/i7zRmvYi9pmCjQf2ZMy3QEa9wVk9RgdZaPWUt7ZOnWUPFjcr9cmE6dUBf+XoPoH4g==',
           shasum: '2c03764f651a9f016ca0b7620421457b619151b9',
           tarball: 'http://localhost:5555/upstream/-/upstream-1.0.1.tgz',
+          unpackedSize: 543,
         });
 
         expect(manifestVersion.contributors).toEqual([]);
@@ -288,11 +324,11 @@ describe('storage', () => {
             {
               storage: generateRandomStorage(),
             },
-            './fixtures/config/getTarballNext-getupstream.yaml',
+            './fixtures/config/getTarball-getupstream.yaml',
             __dirname
           )
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         const bodyNewManifest1 = generatePackageMetadata(pkgName, '1.0.0');
         const bodyNewManifest2 = generatePackageMetadata(pkgName, '1.0.0');
@@ -309,13 +345,57 @@ describe('storage', () => {
           })
         ).rejects.toThrow(API_ERROR.PACKAGE_EXIST);
       });
+
+      test('create private package with readme only in manifest', async () => {
+        const mockDate = '2018-01-14T11:17:40.712Z';
+        MockDate.set(mockDate);
+        const pkgName = 'upstream';
+        const requestOptions = {
+          host: 'localhost',
+          protocol: 'http',
+          headers: {},
+        };
+        const config = new Config(
+          configExample(
+            {
+              ...getDefaultConfig(),
+              storage: generateRandomStorage(),
+            },
+            './fixtures/config/updateManifest-1.yaml',
+            __dirname
+          )
+        );
+        const storage = new Storage(config, logger);
+        await storage.init(config);
+        const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
+
+        // Remove readme from version to simulate behaviour of older package managers like npm6
+        bodyNewManifest.versions['1.0.0'].readme = '';
+
+        await storage.updateManifest(bodyNewManifest, {
+          signal: new AbortController().signal,
+          name: pkgName,
+          uplinksLook: true,
+          revision: '1',
+          requestOptions,
+        });
+        const manifest = (await storage.getPackageByOptions({
+          name: pkgName,
+          uplinksLook: true,
+          requestOptions,
+        })) as Manifest;
+
+        // verdaccio keeps latest version of readme on manifest level but not by version
+        expect(manifest.versions['1.0.0'].readme).not.toBeDefined();
+        expect(manifest.readme).toEqual('# test');
+      });
     });
     describe('deprecate', () => {
       test.each([['foo'], ['@scope/foo']])('deprecate package %s', async (pkgName) => {
         const mockDate = '2018-01-14T11:17:40.712Z';
         MockDate.set(mockDate);
         const config = getConfig('deprecate.yaml');
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
         await storage.updateManifest(bodyNewManifest, {
@@ -362,7 +442,7 @@ describe('storage', () => {
         const mockDate = '2018-01-14T11:17:40.712Z';
         MockDate.set(mockDate);
         const config = getConfig('deprecate.yaml');
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         // publish new package
         const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
@@ -436,7 +516,7 @@ describe('storage', () => {
     describe('star', () => {
       test.each([['foo']])('star package %s', async (pkgName) => {
         const config = getConfig('deprecate.yaml');
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
         await storage.updateManifest(bodyNewManifest, {
@@ -469,7 +549,7 @@ describe('storage', () => {
         const mockDate = '2018-01-14T11:17:40.712Z';
         MockDate.set(mockDate);
         const config = getConfig('deprecate.yaml');
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
         await storage.updateManifest(bodyNewManifest, {
@@ -511,7 +591,7 @@ describe('storage', () => {
         const mockDate = '2018-01-14T11:17:40.712Z';
         MockDate.set(mockDate);
         const config = getConfig('deprecate.yaml');
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
         await storage.updateManifest(bodyNewManifest, {
@@ -550,7 +630,7 @@ describe('storage', () => {
 
       test.each([['foo']])('should unstar a package %s', async (pkgName) => {
         const config = getConfig('deprecate.yaml');
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
         await storage.updateManifest(bodyNewManifest, {
@@ -587,7 +667,7 @@ describe('storage', () => {
 
       test.each([['foo']])('should handle missing username %s', async (pkgName) => {
         const config = getConfig('deprecate.yaml');
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
         await storage.updateManifest(bodyNewManifest, {
@@ -609,9 +689,248 @@ describe('storage', () => {
         ).rejects.toThrow();
       });
     });
+    describe('owner', () => {
+      test.each([
+        ['foo', 'publishWithOwnerDefault.yaml'],
+        ['foo', 'publishWithOwnerAndCheck.yaml'],
+      ])('new package %s, %s (anonymous)', async (pkgName, configFile) => {
+        const config = getConfig(configFile);
+        const storage = new Storage(config, logger);
+        await storage.init(config);
+        const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
+        await storage.updateManifest(bodyNewManifest, {
+          signal: new AbortController().signal,
+          name: pkgName,
+          uplinksLook: true,
+          requestOptions: defaultRequestOptions,
+        });
+        const manifest = (await storage.getPackageByOptions({
+          name: pkgName,
+          uplinksLook: true,
+          requestOptions: defaultRequestOptions,
+        })) as Manifest;
+        expect(manifest?.maintainers).toEqual([{ name: 'Anonymous', email: '' }]);
+      });
+
+      test.each([
+        ['foo', 'publishWithOwnerDefault.yaml'],
+        ['foo', 'publishWithOwnerAndCheck.yaml'],
+      ])('new package %s, %s (logged in)', async (pkgName, configFile) => {
+        const config = getConfig(configFile);
+        const storage = new Storage(config, logger);
+        await storage.init(config);
+        const owner = { name: 'fooUser', email: '' };
+        const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
+        const options = { ...defaultRequestOptions, username: owner.name };
+        await storage.updateManifest(bodyNewManifest, {
+          signal: new AbortController().signal,
+          name: pkgName,
+          uplinksLook: true,
+          requestOptions: options,
+        });
+        const manifest = (await storage.getPackageByOptions({
+          name: pkgName,
+          uplinksLook: true,
+          requestOptions: defaultRequestOptions,
+        })) as Manifest;
+        expect(manifest?.maintainers).toEqual([owner]);
+        expect(manifest?.versions['1.0.0'].maintainers).toEqual([owner]);
+      });
+
+      test.each([
+        ['foo', 'publishWithOwnerDefault.yaml'],
+        ['foo', 'publishWithOwnerAndCheck.yaml'],
+      ])('add/remove owner %s, %s', async (pkgName, configFile) => {
+        const config = getConfig(configFile);
+        const storage = new Storage(config, logger);
+        await storage.init(config);
+        const firstOwner = { name: 'fooUser', email: '' };
+        const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
+        const options = { ...defaultRequestOptions, username: firstOwner.name };
+        await storage.updateManifest(bodyNewManifest, {
+          signal: new AbortController().signal,
+          name: pkgName,
+          uplinksLook: false,
+          requestOptions: options,
+        });
+
+        // add owner
+        const secondOwner = { name: 'barUser', email: '' };
+        const maintainers = [firstOwner, secondOwner];
+
+        const message = await executeChangeOwners(storage, {
+          _rev: bodyNewManifest._rev,
+          _id: bodyNewManifest._id,
+          name: pkgName,
+          username: firstOwner.name,
+          maintainers: maintainers,
+        });
+        expect(message).toEqual(API_MESSAGE.PKG_CHANGED);
+
+        const manifest = (await storage.getPackageByOptions({
+          name: pkgName,
+          uplinksLook: false,
+          requestOptions: options,
+        })) as Manifest;
+        expect(manifest?.maintainers).toEqual(maintainers);
+        // published version should not be affected
+        expect(manifest?.versions['1.0.0'].maintainers).toEqual([firstOwner]);
+
+        // remove owner
+        const maintainers2 = [secondOwner];
+        const message2 = await executeChangeOwners(storage, {
+          _rev: bodyNewManifest._rev,
+          _id: bodyNewManifest._id,
+          name: pkgName,
+          username: firstOwner.name,
+          maintainers: maintainers2,
+        });
+        expect(message2).toEqual(API_MESSAGE.PKG_CHANGED);
+
+        const manifest2 = (await storage.getPackageByOptions({
+          name: pkgName,
+          uplinksLook: false,
+          requestOptions: options,
+        })) as Manifest;
+        expect(manifest2?.maintainers).toEqual(maintainers2);
+        // published version should not be affected
+        expect(manifest2?.versions['1.0.0'].maintainers).toEqual([firstOwner]);
+      });
+
+      test.each([
+        ['foo', 'publishWithOwnerDefault.yaml'],
+        ['foo', 'publishWithOwnerAndCheck.yaml'],
+      ])('should fail removing last owner %s, %s', async (pkgName, configFile) => {
+        const config = getConfig(configFile);
+        const storage = new Storage(config, logger);
+        await storage.init(config);
+        const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
+        const owner = 'fooUser';
+        const options = { ...defaultRequestOptions, username: owner };
+        await storage.updateManifest(bodyNewManifest, {
+          signal: new AbortController().signal,
+          name: pkgName,
+          uplinksLook: false,
+          requestOptions: options,
+        });
+
+        // no owners
+        await expect(
+          executeChangeOwners(storage, {
+            _rev: bodyNewManifest._rev,
+            _id: bodyNewManifest._id,
+            name: pkgName,
+            username: owner,
+            maintainers: [],
+          })
+        ).rejects.toThrow();
+      });
+
+      test.each([['foo', 'publishWithOwnerDefault.yaml']])(
+        'ok to publish as non-owner without check %s, %s',
+        async (pkgName, configFile) => {
+          const config = getConfig(configFile);
+          const storage = new Storage(config, logger);
+          await storage.init(config);
+          const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
+          const owner = 'fooUser';
+          const options = { ...defaultRequestOptions, username: owner };
+          await storage.updateManifest(bodyNewManifest, {
+            signal: new AbortController().signal,
+            name: pkgName,
+            uplinksLook: false,
+            requestOptions: options,
+          });
+
+          // try to publish as user who's not an owner
+          const bodyNewManifest2 = generatePackageMetadata(pkgName, '1.0.1');
+          const nonOwner = 'barUser';
+          const options2 = { ...defaultRequestOptions, username: nonOwner };
+          const message2 = await storage.updateManifest(bodyNewManifest2, {
+            signal: new AbortController().signal,
+            name: pkgName,
+            uplinksLook: false,
+            requestOptions: options2,
+          });
+          expect(message2).toEqual(API_MESSAGE.PKG_CHANGED);
+        }
+      );
+
+      test.each([['foo', 'publishWithOwnerAndCheck.yaml']])(
+        'should fail publishing as non-owner with check %s, %s',
+        async (pkgName, configFile) => {
+          const config = getConfig(configFile);
+          const storage = new Storage(config, logger);
+          await storage.init(config);
+          const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
+          const owner = 'fooUser';
+          const options = { ...defaultRequestOptions, username: owner };
+          await storage.updateManifest(bodyNewManifest, {
+            signal: new AbortController().signal,
+            name: pkgName,
+            uplinksLook: false,
+            requestOptions: options,
+          });
+
+          // try to publish as user who's not an owner
+          const bodyNewManifest2 = generatePackageMetadata(pkgName, '1.0.1');
+          const nonOwner = 'barUser';
+          const options2 = { ...defaultRequestOptions, username: nonOwner };
+          await expect(
+            storage.updateManifest(bodyNewManifest2, {
+              signal: new AbortController().signal,
+              name: pkgName,
+              uplinksLook: false,
+              requestOptions: options2,
+            })
+          ).rejects.toThrow();
+        }
+      );
+    });
   });
 
-  describe('getTarballNext', () => {
+  describe('getTarball', () => {
+    test('should get a package from local storage', (done) => {
+      const pkgName = 'foo';
+      const config = new Config(
+        configExample({
+          ...getDefaultConfig(),
+          storage: generateRandomStorage(),
+        })
+      );
+      const storage = new Storage(config, logger);
+      storage.init(config).then(() => {
+        const ac = new AbortController();
+        const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
+        storage
+          .updateManifest(bodyNewManifest, {
+            signal: ac.signal,
+            name: pkgName,
+            uplinksLook: false,
+            requestOptions: defaultRequestOptions,
+          })
+          .then(() => {
+            const abort = new AbortController();
+            storage
+              .getTarball(pkgName, `${pkgName}-1.0.0.tgz`, {
+                signal: abort.signal,
+              })
+              .then((stream) => {
+                stream.on('data', (dat) => {
+                  expect(dat).toBeDefined();
+                  expect(dat.length).toEqual(512);
+                });
+                stream.on('end', () => {
+                  done();
+                });
+                stream.on('error', () => {
+                  done('this should not happen');
+                });
+              });
+          });
+      });
+    });
+
     test('should not found a package anywhere', (done) => {
       const config = new Config(
         configExample({
@@ -619,11 +938,11 @@ describe('storage', () => {
           storage: generateRandomStorage(),
         })
       );
-      const storage = new Storage(config);
+      const storage = new Storage(config, logger);
       storage.init(config).then(() => {
         const abort = new AbortController();
         storage
-          .getTarballNext('some-tarball', 'some-tarball-1.0.0.tgz', {
+          .getTarball('some-tarball', 'some-tarball-1.0.0.tgz', {
             signal: abort.signal,
           })
           .then((stream) => {
@@ -655,15 +974,15 @@ describe('storage', () => {
           {
             storage: generateRandomStorage(),
           },
-          './fixtures/config/getTarballNext-getupstream.yaml',
+          './fixtures/config/getTarball-getupstream.yaml',
           __dirname
         )
       );
-      const storage = new Storage(config);
+      const storage = new Storage(config, logger);
       storage.init(config).then(() => {
         const abort = new AbortController();
         storage
-          .getTarballNext(pkgName, `${pkgName}-1.0.0.tgz`, {
+          .getTarball(pkgName, `${pkgName}-1.0.0.tgz`, {
             signal: abort.signal,
           })
           .then((stream) => {
@@ -683,7 +1002,7 @@ describe('storage', () => {
     test('should serve fetch tarball from upstream without dist info local', (done) => {
       const pkgName = 'upstream';
       const upstreamManifest = addNewVersion(
-        generateRemotePackageMetadata(pkgName, '1.0.0'),
+        generateRemotePackageMetadata(pkgName, '1.0.0') as Manifest,
         '1.0.1'
       );
       nock('https://registry.verdaccio.org').get(`/${pkgName}`).reply(201, upstreamManifest);
@@ -699,11 +1018,11 @@ describe('storage', () => {
           {
             storage: generateRandomStorage(),
           },
-          './fixtures/config/getTarballNext-getupstream.yaml',
+          './fixtures/config/getTarball-getupstream.yaml',
           __dirname
         )
       );
-      const storage = new Storage(config);
+      const storage = new Storage(config, logger);
       storage.init(config).then(() => {
         const ac = new AbortController();
         const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
@@ -722,7 +1041,7 @@ describe('storage', () => {
           .then(() => {
             const abort = new AbortController();
             storage
-              .getTarballNext(pkgName, `${pkgName}-1.0.1.tgz`, {
+              .getTarball(pkgName, `${pkgName}-1.0.1.tgz`, {
                 signal: abort.signal,
               })
               .then((stream) => {
@@ -743,7 +1062,7 @@ describe('storage', () => {
     test('should serve fetch tarball from upstream without with info local', (done) => {
       const pkgName = 'upstream';
       const upstreamManifest = addNewVersion(
-        addNewVersion(generateRemotePackageMetadata(pkgName, '1.0.0'), '1.0.1'),
+        addNewVersion(generateRemotePackageMetadata(pkgName, '1.0.0') as Manifest, '1.0.1'),
         '1.0.2'
       );
       nock('https://registry.verdaccio.org')
@@ -763,11 +1082,11 @@ describe('storage', () => {
           {
             storage: storagePath,
           },
-          './fixtures/config/getTarballNext-getupstream.yaml',
+          './fixtures/config/getTarball-getupstream.yaml',
           __dirname
         )
       );
-      const storage = new Storage(config);
+      const storage = new Storage(config, logger);
       storage.init(config).then(() => {
         const req = httpMocks.createRequest({
           method: 'GET',
@@ -791,7 +1110,7 @@ describe('storage', () => {
           .then(() => {
             const abort = new AbortController();
             storage
-              .getTarballNext(pkgName, `${pkgName}-1.0.0.tgz`, {
+              .getTarball(pkgName, `${pkgName}-1.0.0.tgz`, {
                 signal: abort.signal,
               })
               .then((stream) => {
@@ -816,11 +1135,11 @@ describe('storage', () => {
           {
             storage: generateRandomStorage(),
           },
-          './fixtures/config/getTarballNext-getupstream.yaml',
+          './fixtures/config/getTarball-getupstream.yaml',
           __dirname
         )
       );
-      const storage = new Storage(config);
+      const storage = new Storage(config, logger);
       storage.init(config).then(() => {
         const ac = new AbortController();
         const bodyNewManifest = generatePackageMetadata(pkgName, '1.0.0');
@@ -839,7 +1158,7 @@ describe('storage', () => {
           .then(() => {
             const abort = new AbortController();
             storage
-              .getTarballNext(pkgName, `${pkgName}-1.0.0.tgz`, {
+              .getTarball(pkgName, `${pkgName}-1.0.0.tgz`, {
                 signal: abort.signal,
               })
               .then((stream) => {
@@ -858,44 +1177,36 @@ describe('storage', () => {
     });
   });
 
-  describe('syncUplinksMetadataNext()', () => {
+  describe('syncUplinksMetadata()', () => {
     describe('error handling', () => {
       test('should handle double failure on uplinks with timeout', async () => {
         const fooManifest = generatePackageMetadata('timeout', '8.0.0');
-
-        nock('https://registry.domain.com')
+        nock('https://registry.timeout.com')
           .get(`/${fooManifest.name}`)
-          .times(10)
-          .delayConnection(4000)
+          .delayConnection(8000)
           .reply(201, manifestFooRemoteNpmjs);
 
         const config = new Config(
           configExample(
             {
               storage: generateRandomStorage(),
-              uplinks: {
-                npmjs: {
-                  url: 'https://registry.npmjs.org',
-                  timeout: '2s',
-                },
-              },
             },
             './fixtures/config/syncDoubleUplinksMetadata.yaml',
             __dirname
           )
         );
 
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         await expect(
-          storage.syncUplinksMetadataNext(fooManifest.name, null, {
-            retry: { limit: 0 },
+          storage.syncUplinksMetadata(fooManifest.name, null, {
+            retry: { limit: 3 },
             timeout: {
               request: 1000,
             },
           })
         ).rejects.toThrow(API_ERROR.NO_PACKAGE);
-      }, 10000);
+      }, 18000);
 
       test('should handle one proxy fails', async () => {
         const fooManifest = generatePackageMetadata('foo', '8.0.0');
@@ -909,10 +1220,10 @@ describe('storage', () => {
             __dirname
           )
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         await expect(
-          storage.syncUplinksMetadataNext(fooManifest.name, null, {
+          storage.syncUplinksMetadata(fooManifest.name, null, {
             retry: { limit: 0 },
           })
         ).rejects.toThrow(API_ERROR.NO_PACKAGE);
@@ -930,10 +1241,10 @@ describe('storage', () => {
             __dirname
           )
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
-        const [manifest] = await storage.syncUplinksMetadataNext(fooManifest.name, fooManifest, {
-          retry: 0,
+        const [manifest] = await storage.syncUplinksMetadata(fooManifest.name, fooManifest, {
+          retry: { limit: 0 },
         });
         expect(manifest).toBe(fooManifest);
       });
@@ -952,10 +1263,10 @@ describe('storage', () => {
             __dirname
           )
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
 
-        const [response] = await storage.syncUplinksMetadataNext(fooManifest.name, fooManifest);
+        const [response] = await storage.syncUplinksMetadata(fooManifest.name, fooManifest);
         expect(response).not.toBeNull();
         expect((response as Manifest).name).toEqual(fooManifest.name);
         expect(Object.keys((response as Manifest).versions)).toEqual([
@@ -993,10 +1304,10 @@ describe('storage', () => {
             __dirname
           )
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
 
-        const [response] = await storage.syncUplinksMetadataNext(fooManifest.name, null);
+        const [response] = await storage.syncUplinksMetadata(fooManifest.name, null);
         // the latest from the remote manifest
         expect(response).not.toBeNull();
         expect((response as Manifest).name).toEqual(fooManifest.name);
@@ -1015,10 +1326,10 @@ describe('storage', () => {
             __dirname
           )
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
 
-        const [response] = await storage.syncUplinksMetadataNext(fooManifest.name, fooManifest);
+        const [response] = await storage.syncUplinksMetadata(fooManifest.name, fooManifest);
         expect(response).not.toBeNull();
         expect((response as Manifest).name).toEqual(fooManifest.name);
         expect((response as Manifest)[DIST_TAGS].latest).toEqual('8.0.0');
@@ -1039,10 +1350,10 @@ describe('storage', () => {
             __dirname
           )
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
 
-        const [response] = await storage.syncUplinksMetadataNext(fooManifest.name, fooManifest, {
+        const [response] = await storage.syncUplinksMetadata(fooManifest.name, fooManifest, {
           uplinksLook: false,
         });
 
@@ -1068,10 +1379,10 @@ describe('storage', () => {
             __dirname
           )
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
 
-        const [response] = await storage.syncUplinksMetadataNext('foo', null, {
+        const [response] = await storage.syncUplinksMetadata('foo', null, {
           uplinksLook: true,
         });
 
@@ -1082,19 +1393,19 @@ describe('storage', () => {
   });
 
   describe('getLocalDatabase', () => {
-    test('should return 0 local packages', async () => {
+    test('should return no results', async () => {
       const config = new Config(
         configExample({
           ...getDefaultConfig(),
           storage: generateRandomStorage(),
         })
       );
-      const storage = new Storage(config);
+      const storage = new Storage(config, logger);
       await storage.init(config);
       await expect(storage.getLocalDatabase()).resolves.toHaveLength(0);
     });
 
-    test('should return 1 local packages', async () => {
+    test('should return single result', async () => {
       const config = new Config(
         configExample({
           ...getDefaultConfig(),
@@ -1109,7 +1420,7 @@ describe('storage', () => {
         },
         url: '/',
       });
-      const storage = new Storage(config);
+      const storage = new Storage(config, logger);
       await storage.init(config);
       const manifest = generatePackageMetadata('foo');
       const ac = new AbortController();
@@ -1138,7 +1449,7 @@ describe('storage', () => {
             storage: generateRandomStorage(),
           })
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         await storage.saveToken({
           user: 'foo',
@@ -1160,7 +1471,7 @@ describe('storage', () => {
             storage: generateRandomStorage(),
           })
         );
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         await storage.saveToken({
           user: 'foo',
@@ -1180,15 +1491,16 @@ describe('storage', () => {
 
   describe('removeTarball', () => {
     test('should fail on remove tarball of package does not exist', async () => {
+      const username = 'foouser';
       const config = new Config(
         configExample({
           ...getDefaultConfig(),
           storage: generateRandomStorage(),
         })
       );
-      const storage = new Storage(config);
+      const storage = new Storage(config, logger);
       await storage.init(config);
-      await expect(storage.removeTarball('foo', 'foo-1.0.0.tgz', 'rev')).rejects.toThrow(
+      await expect(storage.removeTarball('foo', 'foo-1.0.0.tgz', 'rev', username)).rejects.toThrow(
         API_ERROR.NO_PACKAGE
       );
     });
@@ -1196,6 +1508,7 @@ describe('storage', () => {
 
   describe('removePackage', () => {
     test('should remove entirely a package', async () => {
+      const username = 'foouser';
       const config = new Config(
         configExample({
           ...getDefaultConfig(),
@@ -1211,7 +1524,7 @@ describe('storage', () => {
         },
         url: '/',
       });
-      const storage = new Storage(config);
+      const storage = new Storage(config, logger);
       await storage.init(config);
 
       const manifest = generatePackageMetadata('foo');
@@ -1240,10 +1553,10 @@ describe('storage', () => {
       const _rev = manifest1._rev;
       // 3. remove the tarball
       await expect(
-        storage.removeTarball(manifest1.name, 'foo-1.0.0.tgz', _rev)
+        storage.removeTarball(manifest1.name, 'foo-1.0.0.tgz', _rev, username)
       ).resolves.toBeDefined();
       // 4. remove the package
-      await storage.removePackage(manifest1.name, _rev);
+      await storage.removePackage(manifest1.name, _rev, username);
       // 5. fails if package does not exist anymore in storage
       await expect(
         storage.getPackageByOptions({
@@ -1257,6 +1570,76 @@ describe('storage', () => {
         })
       ).rejects.toThrow('package does not exist on uplink: foo');
     });
+
+    test('ok to remove package as non-owner without check', async () => {
+      const config = getConfig('publishWithOwnerDefault.yaml');
+      const storage = new Storage(config, logger);
+      await storage.init(config);
+      const owner = 'fooUser';
+      const options = { ...defaultRequestOptions, username: owner };
+
+      // 1. publish a package
+      const bodyNewManifest = generatePackageMetadata('foo', '1.0.0');
+      await storage.updateManifest(bodyNewManifest, {
+        signal: new AbortController().signal,
+        name: 'foo',
+        uplinksLook: true,
+        requestOptions: options,
+      });
+      // 2. request package (should be available in the local cache)
+      const manifest1 = (await storage.getPackageByOptions({
+        name: 'foo',
+        uplinksLook: false,
+        requestOptions: options,
+      })) as Manifest;
+      const _rev = manifest1._rev;
+      // 3. remove the tarball as other user
+      const nonOwner = 'barUser';
+      await expect(
+        storage.removeTarball(manifest1.name, 'foo-1.0.0.tgz', _rev, nonOwner)
+      ).resolves.toBeDefined();
+      // 4. remove the package as other user
+      await storage.removePackage(manifest1.name, _rev, nonOwner);
+      // 5. fails if package does not exist anymore in storage
+      await expect(
+        storage.getPackageByOptions({
+          name: 'foo',
+          uplinksLook: false,
+          requestOptions: options,
+        })
+      ).rejects.toThrow('package does not exist on uplink: foo');
+    });
+
+    test('should fail as non-owner with check', async () => {
+      const config = getConfig('publishWithOwnerAndCheck.yaml');
+      const storage = new Storage(config, logger);
+      await storage.init(config);
+      const owner = 'fooUser';
+      const options = { ...defaultRequestOptions, username: owner };
+
+      // 1. publish a package
+      const bodyNewManifest = generatePackageMetadata('foo', '1.0.0');
+      await storage.updateManifest(bodyNewManifest, {
+        signal: new AbortController().signal,
+        name: 'foo',
+        uplinksLook: true,
+        requestOptions: options,
+      });
+      // 2. request package (should be available in the local cache)
+      const manifest1 = (await storage.getPackageByOptions({
+        name: 'foo',
+        uplinksLook: false,
+        requestOptions: options,
+      })) as Manifest;
+      const _rev = manifest1._rev;
+      // 3. try removing the tarball
+      const nonOwner = 'barUser';
+      await expect(
+        storage.removeTarball(manifest1.name, 'foo-1.0.0.tgz', _rev, nonOwner)
+      ).rejects.toThrow();
+      // 4. try removing the package
+      await expect(storage.removePackage(manifest1.name, _rev, nonOwner)).rejects.toThrow();
+    });
   });
 
   describe('getPackageByOptions()', () => {
@@ -1278,7 +1661,7 @@ describe('storage', () => {
           },
           url: '/',
         });
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         await expect(
           storage.getPackageByOptions({
@@ -1310,7 +1693,7 @@ describe('storage', () => {
           },
           url: '/',
         });
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         await expect(
           storage.getPackageByOptions({
@@ -1343,7 +1726,7 @@ describe('storage', () => {
           },
           url: '/',
         });
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         await expect(
           storage.getPackageByOptions({
@@ -1376,7 +1759,7 @@ describe('storage', () => {
           },
           url: '/',
         });
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         await expect(
           storage.getPackageByOptions({
@@ -1416,7 +1799,7 @@ describe('storage', () => {
           },
           url: '/',
         });
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         await expect(
           storage.getPackageByOptions({
@@ -1456,7 +1839,7 @@ describe('storage', () => {
           },
           url: '/',
         });
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
         await expect(
           storage.getPackageByOptions({
@@ -1490,7 +1873,7 @@ describe('storage', () => {
           },
           url: '/',
         });
-        const storage = new Storage(config);
+        const storage = new Storage(config, logger);
         await storage.init(config);
 
         const manifest = (await storage.getPackageByOptions({
@@ -1511,7 +1894,6 @@ describe('storage', () => {
         expect(Object.keys(version)).toEqual([
           'name',
           'version',
-          'description',
           'deprecated',
           'bin',
           'dist',
@@ -1523,6 +1905,10 @@ describe('storage', () => {
           'peerDependencies',
           'optionalDependencies',
           'bundleDependencies',
+          'cpu',
+          'os',
+          'peerDependenciesMeta',
+          'acceptDependencies',
           '_hasShrinkwrap',
           'hasInstallScript',
         ]);