Owner access for the administrative members in the npm organization

[bjohansebas]

Currently, the only owners in the npm organization are @darcyclarke and @wesleytodd. Shouldn't all administrative members be owners in the npm organization?

At the moment, the remaining administrative members are just admins

[darcyclarke]

I wasn't aware of this but you're right - it looks like @wesleytodd & I are the only "owners" in the pkgjs org right now. I'm not sure what the process is/documentation says about this or what the appropriate level of access should be for npmjs.com org members (I did a quick search of our governance docs & came up with nothing - maybe @mhdawson / @wesleytodd know or @bjohansebas, if you already know, feel free to share links/refs). I can definitely help fix any incorrect permissions but would want to understand how we determine who is a "member" vs. "admin" vs. "owner" as well as how we'll keep this mapping of users/access up-to-date (ie. do we check this quarterly/annually/ad-hoc & who gets what access?). I ask this because there's also a bunch of "members" in that pkgjs org & it's not clear why they aren't also "admins", "owners" or purged.

In practical terms, the only differences I know of between an "admin" & "owner" today are the ability to add/remove other owners & to transfer packages out of an org. Here's a breakdown of the permissions as far as I remember from my time at npm:

Permission / Access	Member	Admin	Owner
Publish packages	✅	✅	✅
Access org’s private packages	✅	✅	✅
View member list	✅	✅	✅
Manage package access	❌	✅	✅
Manage organization settings	❌	✅	✅
Manage billing	❌	✅	✅
Delete packages	❌	✅	✅
Add/remove members	❌	✅	✅
Add/remove admins	❌	✅	✅
Add/remove owners	❌	❌	✅
Transfer package into an org (if user owns it)	✅	✅	✅
Transfer package out of an org	❌	❌	✅

[wesleytodd]

Yeah I was the person who registered the org, so makes sense I am. I also agree this is a gap in the process/documentation. At the time, IIRC, the idea was just to keep it low effort to unblock a bunch of shared goals. Now that progress on a bunch of those has stalled, maybe it is time to reassess?

[bjohansebas]

While it doesn’t explicitly state that they should be owners within the organization, an administrative member has the responsibility of managing the pkgjs organization (this is in the governance file), so in my understanding, this includes the npm organization as well. Therefore, they should have the highest level of permissions in order to manage it properly, because as an admin they don’t have all the permissions that an owner has. Now that I realize, not all administrative members are owners in the pkgjs GitHub organization either, only a few are.

I can definitely help fix any incorrect permissions but would want to understand how we determine who is a "member" vs. "admin" vs. "owner"

A member would be someone who is helping with a specific package within the pkgjs organization. An admin or owner (since it’s not clear whether an administrative member should have that role) should be the administrative members.

how we'll keep this mapping of users/access up-to-date (ie. do we check this quarterly/annually/ad-hoc & who gets what access?).

Probably ad-hoc? There are very few people in npm compared to the list of members in this group, so such a frequent review isn’t really necessary either.

In practical terms, the only differences I know of between an "admin" & "owner" today are the ability to add/remove other owners & to transfer packages out of an org.

These are the current permissions within the organization. https://docs.npmjs.com/organization-roles-and-permissions

[wesleytodd]

Oh, and I forgot, one other thing we didn't have answered at the time was if folks were comfortable with publishing under the @nodejs scope. It is being used now, but wasn't at the time, and we didn't want to worry about the requirements that "being official" needed. It is quite possible that the org could just be retired and the packages could be managed under the main nodejs org?

[bjohansebas]

if folks were comfortable with publishing under the @nodejs scope. It is being used now, but wasn't at the time, and we didn't want to worry about the requirements that "being official" needed

I think at this point we would be fine moving the scope to @nodejs for the future and retiring that organization on npm.

It is quite possible that the org could just be retired and the packages could be managed under the main nodejs org?

Are you referring only to the npm organization or also to the GitHub one?