fix(relay): preserve authenticated existing private reads

Signed-off-by: Logan Johnson <loganj@squareup.com>

Author: loganj

crates/buzz-db/src/store/event.rs

@@ -10,8 +10,8 @@ use sqlx::{PgConnection, PgPool, Postgres, QueryBuilder, Row, Transaction};
 use uuid::Uuid;
 
 use buzz_core::kind::{
-    event_kind_i32, is_ephemeral, is_parameterized_replaceable, KIND_AUTH, KIND_EVENT_REMINDER,
-    KIND_HUDDLE_STARTED, SHARED_GATED_KINDS,
+    event_kind_i32, is_ephemeral, is_parameterized_replaceable, AUTHOR_ONLY_KINDS, KIND_AUTH,
+    KIND_EVENT_REMINDER, KIND_HUDDLE_STARTED, SHARED_GATED_KINDS,
 };
 use buzz_core::{CommunityId, StoredEvent};
 use buzz_datastore_tracing::datastore_span;
@@ -113,6 +113,10 @@ pub struct EventQuery {
     /// SQL pushdown is sound.  Keeping `event_visible_to_reader` as post-filter
     /// defense-in-depth catches any residual mismatch.
     pub shared_gated_reader: Option<Vec<u8>>,
+    /// Author-only visibility reader for [`query_events`]: exclude foreign
+    /// [`AUTHOR_ONLY_KINDS`] before ordering, offset and limit. This does not
+    /// affect `count_events`; callers must retain its existing fallback gate.
+    pub author_only_reader: Option<Vec<u8>>,
 }
 
 impl EventQuery {
@@ -144,6 +148,7 @@ impl EventQuery {
             channel_ids_include_global: true,
             max_limit: None,
             shared_gated_reader: None,
+            author_only_reader: None,
         }
     }
 }
@@ -682,6 +687,19 @@ pub(crate) async fn query_events_on(
         qb.push(")");
     }
 
+    // Author-only visibility belongs before pagination, just like shared-gated
+    // visibility. Keep relay result checks as defense in depth.
+    if let Some(ref reader_bytes) = q.author_only_reader {
+        qb.push(format!(" AND ({col_prefix}kind NOT IN ("));
+        let mut sep = qb.separated(", ");
+        for kind in AUTHOR_ONLY_KINDS {
+            sep.push_bind(*kind as i32);
+        }
+        qb.push(format!(") OR {col_prefix}pubkey = "));
+        qb.push_bind(reader_bytes.clone());
+        qb.push(")");
+    }
+
     // Composite ordering for deterministic pagination across ALL callers of
     // query_events (WebSocket REQ, REST endpoints, canvas, notes, etc.).
     // The `id ASC` tiebreaker ensures stable results when events share the

crates/buzz-relay/src/api/bridge.rs

@@ -146,6 +146,26 @@ pub(crate) fn verify_bridge_auth_with_options(
     Err(api_error(StatusCode::UNAUTHORIZED, "missing Nostr auth"))
 }
 
+/// A declared dev-mode identity is not proof of authorship. Preserve the
+/// public-kind fallback, but require verified NIP-98 for any filter that could
+/// read author-only data, including mixed-kind and known-ID queries.
+fn authorize_author_only_read(
+    filters: &[nostr::Filter],
+    signed_auth_created_at: Option<u64>,
+) -> Result<(), (StatusCode, Json<Value>)> {
+    if signed_auth_created_at.is_none()
+        && filters
+            .iter()
+            .any(crate::handlers::req::filter_can_match_author_only_kinds)
+    {
+        return Err(api_error(
+            StatusCode::UNAUTHORIZED,
+            "auth-required: author-only reads require NIP-98 authentication",
+        ));
+    }
+    Ok(())
+}
+
 /// Check NIP-98 replay and record the event ID atomically.
 ///
 /// The correctness boundary is the shared, community-scoped Redis seen-set on
@@ -1121,6 +1141,8 @@ async fn query_events_authed(
     crate::handlers::req::extract_channel_ids_from_filters_limited(&filters)
         .map_err(|()| api_error(StatusCode::BAD_REQUEST, "too many explicit channels"))?;
 
+    authorize_author_only_read(&filters, signed_auth_created_at)?;
+
     // P-gated kinds (gift wraps, member notifications, observer frames) require
     // the caller's own pubkey in the #p tag — same enforcement as WS REQ handler.
     let authed_pubkey_hex = pubkey.to_hex();
@@ -1655,6 +1677,8 @@ async fn count_events_authed(
     crate::handlers::req::extract_channel_ids_from_filters_limited(&filters)
         .map_err(|()| api_error(StatusCode::BAD_REQUEST, "too many explicit channels"))?;
 
+    authorize_author_only_read(&filters, signed_auth_created_at)?;
+
     // P-gated kinds enforcement — same as WS REQ and /query.
     let authed_pubkey_hex = pubkey.to_hex();
     if !crate::handlers::req::p_gated_filters_authorized(&filters, &authed_pubkey_hex) {
@@ -2529,6 +2553,10 @@ fn ban_json(b: &buzz_db::moderation::BanRecord) -> Value {
     })
 }
 
+#[cfg(test)]
+#[path = "private_read_postgres_tests.rs"]
+mod private_read_postgres_tests;
+
 #[cfg(test)]
 mod postgres_tests {
     use super::*;
@@ -3839,7 +3867,7 @@ mod postgres_tests {
     /// - Redis pool points at the local dev instance for the admission check.
     ///
     /// Returns `None` when local Postgres is not reachable.
-    async fn bridge_handler_test_state() -> Option<Arc<crate::state::AppState>> {
+    pub(super) async fn bridge_handler_test_state() -> Option<Arc<crate::state::AppState>> {
         let mut config = crate::config::Config::from_env().ok()?;
         config.database_url = crate::test_support::database_url();
         // Use the real local Redis so enforce_http_admission can pass.