1 files changed, 12 insertions, 2 deletions
diff --git a/spec/requests/api/npm_project_packages_spec.rb b/spec/requests/api/npm_project_packages_spec.rb
index 7c3f1890095..62809b432af 100644
--- a/spec/requests/api/npm_project_packages_spec.rb
+++ b/spec/requests/api/npm_project_packages_spec.rb
@@ -30,6 +30,7 @@ RSpec.describe API::NpmProjectPackages do
   end
 
   describe 'GET /api/v4/projects/:id/packages/npm/*package_name/-/*file_name' do
+    let(:snowplow_gitlab_standard_context) { { project: project, namespace: project.namespace } }
     let(:package_file) { package.package_files.first }
 
     let(:headers) { {} }
@@ -61,18 +62,18 @@ RSpec.describe API::NpmProjectPackages do
         let(:headers) { build_token_auth_header(token.token) }
 
         it_behaves_like 'successfully downloads the file'
+        it_behaves_like 'a package tracking event', 'API::NpmPackages', 'pull_package'
       end
 
       context 'with job token' do
         let(:headers) { build_token_auth_header(job.token) }
 
         it_behaves_like 'successfully downloads the file'
+        it_behaves_like 'a package tracking event', 'API::NpmPackages', 'pull_package'
       end
     end
 
     context 'a public project' do
-      let(:snowplow_gitlab_standard_context) { { project: project, namespace: project.namespace } }
-
       it_behaves_like 'successfully downloads the file'
       it_behaves_like 'a package tracking event', 'API::NpmPackages', 'pull_package'
 
@@ -112,6 +113,15 @@ RSpec.describe API::NpmProjectPackages do
       end
 
       it_behaves_like 'a package file that requires auth'
+
+      context 'with a job token for a different user' do
+        let_it_be(:other_user) { create(:user) }
+        let_it_be_with_reload(:other_job) { create(:ci_build, :running, user: other_user) }
+
+        let(:headers) { build_token_auth_header(other_job.token) }
+
+        it_behaves_like 'successfully downloads the file'
+      end
     end
   end