1 files changed, 27 insertions, 6 deletions
diff --git a/spec/requests/api/npm_project_packages_spec.rb b/spec/requests/api/npm_project_packages_spec.rb
index bdcd6e7278d..373327787a2 100644
--- a/spec/requests/api/npm_project_packages_spec.rb
+++ b/spec/requests/api/npm_project_packages_spec.rb
@@ -5,16 +5,29 @@ require 'spec_helper'
 RSpec.describe API::NpmProjectPackages do
   include_context 'npm api setup'
 
-  describe 'GET /api/v4/projects/:id/packages/npm/*package_name' do
-    it_behaves_like 'handling get metadata requests', scope: :project do
-      let(:url) { api("/projects/#{project.id}/packages/npm/#{package_name}") }
+  shared_examples 'accept get request on private project with access to package registry for everyone' do
+    subject { get(url) }
+
+    before do
+      project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+      project.project_feature.update!(package_registry_access_level: ProjectFeature::PUBLIC)
     end
+
+    it_behaves_like 'returning response status', :ok
+  end
+
+  describe 'GET /api/v4/projects/:id/packages/npm/*package_name' do
+    let(:url) { api("/projects/#{project.id}/packages/npm/#{package_name}") }
+
+    it_behaves_like 'handling get metadata requests', scope: :project
+    it_behaves_like 'accept get request on private project with access to package registry for everyone'
   end
 
   describe 'GET /api/v4/projects/:id/packages/npm/-/package/*package_name/dist-tags' do
-    it_behaves_like 'handling get dist tags requests', scope: :project do
-      let(:url) { api("/projects/#{project.id}/packages/npm/-/package/#{package_name}/dist-tags") }
-    end
+    let(:url) { api("/projects/#{project.id}/packages/npm/-/package/#{package_name}/dist-tags") }
+
+    it_behaves_like 'handling get dist tags requests', scope: :project
+    it_behaves_like 'accept get request on private project with access to package registry for everyone'
   end
 
   describe 'PUT /api/v4/projects/:id/packages/npm/-/package/*package_name/dist-tags/:tag' do
@@ -108,6 +121,14 @@ RSpec.describe API::NpmProjectPackages do
           expect(response).to have_gitlab_http_status(:forbidden)
         end
       end
+
+      context 'with access to package registry for everyone' do
+        before do
+          project.project_feature.update!(package_registry_access_level: ProjectFeature::PUBLIC)
+        end
+
+        it_behaves_like 'successfully downloads the file'
+      end
     end
 
     context 'internal project' do