publish: only set `access` when explicitly set

2 files changed, 7 insertions, 6 deletions

diff --git a/lib/config/defaults.js b/lib/config/defaults.js
index b7443a7e0..99c1b4f54 100644
--- a/lib/config/defaults.js
+++ b/lib/config/defaults.js
@@ -119,7 +119,7 @@ Object.defineProperty(exports, "defaults", {get: function () {
   }
 
   defaults = {
-    access : "restricted"
+    access : null
     , "always-auth" : false
 
     , "bin-links" : true
@@ -230,7 +230,7 @@ Object.defineProperty(exports, "defaults", {get: function () {
 }})
 
 exports.types =
-  { access : ["restricted", "public"]
+  { access : [null, "restricted", "public"]
   , "always-auth" : Boolean
   , "bin-links": Boolean
   , browser : [null, String]
diff --git a/lib/publish.js b/lib/publish.js
index 18f45b087..06a3404af 100644
--- a/lib/publish.js
+++ b/lib/publish.js
@@ -124,12 +124,13 @@ function publish_ (arg, data, isRetry, cachedir, cb) {
 
     // registry-frontdoor cares about the access level, which is only
     // configurable for scoped packages
-    if (npa(data.name).scope) {
+    if (config.get("access")) {
+      if (!npa(data.name).scope && config.get("access") === "restricted") {
+        return cb(new Error("Can't restrict access to unscoped packages."))
+      }
+
       params.access = config.get("access")
     }
-    else {
-      params.access = "public"
-    }
 
     registry.publish(registryBase, params, function (er) {
       if (er && er.code === "EPUBLISHCONFLICT" &&