fix(relay): centralize NIP-ER author-only delivery gate in fan-out path

The author-only delivery gate for NIP-ER reminders (AUTHOR_ONLY_KINDS)
lived inline in dispatch_persistent_event, so it covered only the
in-process fan-out path. The Redis cross-node path (subscribe_local in
main.rs) calls fan_out + filter_fanout_by_access but never applied the
author-only check — a reminder published on one node and received by
another was fanned out to any matching subscriber, leaking author-private
reminders across nodes.

Move the gate into filter_fanout_by_access, the single post-fan_out
chokepoint both delivery paths already share. It now runs independent of
channel scope (author-only kinds are stored globally, channel_id=None) and
cannot be bypassed by any path that delivers through the shared filter.
The redundant inline check is removed.

Document the Redis routing trust boundary at publish_event: per-author
routing is not the isolation boundary (every node PSUBSCRIBEs
buzz:channel:* and must receive every event since the author may connect
to any node); filter_fanout_by_access is the actual author-only delivery
boundary, now enforced on both fan-out paths.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

Author: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7

crates/buzz-pubsub/src/lib.rs

@@ -100,6 +100,20 @@ impl PubSubManager {
     }
 
     /// Publish an event to the Redis channel. Returns subscriber count.
+    ///
+    /// Routing note (NIP-ER author-private reminders): events are keyed by
+    /// `channel_id` (`buzz:channel:{id}`), and every relay node's subscriber
+    /// `PSUBSCRIBE buzz:channel:*` — so the channel key is a routing label, not
+    /// an isolation boundary; every node already receives every published event.
+    /// Author-private reminders (kind:30300, stored under the nil channel
+    /// sentinel) are therefore NOT protected by per-author Redis routing, and
+    /// adding it would be pointless: the reminder's author may be connected to
+    /// any node, so every node must still receive it. The actual author-only
+    /// delivery boundary is `filter_fanout_by_access` in the relay, which runs
+    /// on BOTH the in-process and the Redis cross-node (`subscribe_local`)
+    /// fan-out paths and drops every recipient that is not the event author.
+    /// Redis only ever carries events between nodes inside the relay trust
+    /// domain; the ciphertext is NIP-44-encrypted to the author regardless.
     pub async fn publish_event(
         &self,
         channel_id: Uuid,

crates/buzz-relay/src/handlers/event.rs

@@ -61,6 +61,27 @@ pub async fn filter_fanout_by_access(
     stored_event: &StoredEvent,
     matches: Vec<(crate::subscription::ConnId, crate::subscription::SubId)>,
 ) -> Vec<(crate::subscription::ConnId, crate::subscription::SubId)> {
+    // Author-only kinds (NIP-ER reminders) may only ever be delivered to the
+    // event's own author. This gate lives here — the chokepoint shared by the
+    // ingest fan-out path and the Redis cross-node `subscribe_local` path, the
+    // only paths that route author-only kinds — so no such delivery can bypass
+    // it. It runs before (and independent of) the channel-membership filter
+    // below because author-only kinds are stored globally (channel_id = None).
+    let matches = if AUTHOR_ONLY_KINDS.contains(&event_kind_u32(&stored_event.event)) {
+        let author = stored_event.event.pubkey.to_bytes();
+        matches
+            .into_iter()
+            .filter(|(conn_id, _)| {
+                state
+                    .conn_manager
+                    .pubkey_for_conn(*conn_id)
+                    .is_some_and(|pk| pk == author)
+            })
+            .collect()
+    } else {
+        matches
+    };
+
     let Some(channel_id) = stored_event.channel_id else {
         return matches;
     };
@@ -138,8 +159,8 @@ pub(crate) async fn dispatch_persistent_event(
                 .find_map(|t| t.content().map(|s| s.to_string()))
         })
         .flatten();
-    // Author-only kinds: only deliver to the event's author.
-    let is_author_only_kind = AUTHOR_ONLY_KINDS.contains(&kind_u32);
+    // Author-only delivery gating (NIP-ER reminders) is enforced centrally in
+    // filter_fanout_by_access, applied to `matches` above before this loop.
     let mut drop_count = 0u32;
     for (target_conn_id, sub_id) in &matches {
         if let Some(ref owner_hex) = dm_visibility_owner {
@@ -151,15 +172,6 @@ pub(crate) async fn dispatch_persistent_event(
                 continue;
             }
         }
-        if is_author_only_kind {
-            let is_author = state
-                .conn_manager
-                .pubkey_for(*target_conn_id)
-                .is_some_and(|pk| pk == stored_event.event.pubkey.to_bytes());
-            if !is_author {
-                continue;
-            }
-        }
         let msg = format!(r#"["EVENT","{}",{}]"#, sub_id, event_json);
         if !state.conn_manager.send_to(*target_conn_id, msg) {
             drop_count += 1;
@@ -1129,5 +1141,40 @@ mod tests {
                 filter_fanout_by_access(&state, &channel_event(Some(channel_id)), matches).await;
             assert_eq!(out, vec![(member, "m".to_string())]);
         }
+
+        #[tokio::test]
+        async fn author_only_reminder_delivers_to_author_only() {
+            let state = test_state().await;
+
+            let author_keys = Keys::generate();
+            let author_pk = author_keys.public_key().to_bytes().to_vec();
+            let other_pk = vec![9u8; 32];
+
+            // KIND_EVENT_REMINDER (30300) is in AUTHOR_ONLY_KINDS and is stored
+            // globally (channel_id = None), so the gate must apply independent
+            // of any channel-membership check.
+            let reminder = EventBuilder::new(
+                Kind::Custom(buzz_core::kind::KIND_EVENT_REMINDER as u16),
+                "{}",
+            )
+            .sign_with_keys(&author_keys)
+            .expect("sign reminder");
+            let stored = StoredEvent::new(reminder, None);
+
+            let author_conn = register_conn(&state, Some(author_pk));
+            let other_conn = register_conn(&state, Some(other_pk));
+            let unauthed_conn = register_conn(&state, None);
+
+            let matches = vec![
+                (author_conn, "a".to_string()),
+                (other_conn, "o".to_string()),
+                (unauthed_conn, "u".to_string()),
+            ];
+            let out = filter_fanout_by_access(&state, &stored, matches).await;
+
+            // Only the author's subscription survives; the non-author and the
+            // unauthenticated connection are both dropped.
+            assert_eq!(out, vec![(author_conn, "a".to_string())]);
+        }
     }
 }