Improves design of the policy

2026-03-21 13:21:21 -04:00
parent b0a8cae194
commit cfead47d71
14 changed files with 1011 additions and 839 deletions
@@ -0,0 +1,536 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.quartz.nip01Core.relay.server
+
+import com.vitorpamplona.quartz.nip01Core.core.Event
+import com.vitorpamplona.quartz.nip01Core.core.OptimizedJsonMapper
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toClient.AuthMessage
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toClient.EventMessage
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toRelay.AuthCmd
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toRelay.CountCmd
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toRelay.EventCmd
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toRelay.ReqCmd
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import com.vitorpamplona.quartz.nip01Core.relay.server.policies.EmptyPolicy
+import com.vitorpamplona.quartz.nip01Core.relay.server.policies.FullAuthPolicy
+import com.vitorpamplona.quartz.nip01Core.store.IEventStore
+import com.vitorpamplona.quartz.nip01Core.store.sqlite.EventStore
+import com.vitorpamplona.quartz.nip42RelayAuth.RelayAuthEvent
+import com.vitorpamplona.quartz.utils.TimeUtils
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.ExperimentalCoroutinesApi
+import kotlinx.coroutines.test.UnconfinedTestDispatcher
+import kotlinx.coroutines.test.runTest
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertFalse
+import kotlin.test.assertTrue
+
+@OptIn(ExperimentalCoroutinesApi::class)
+class NostrServerAuthTest {
+    private val pubkey = "46fcbe3065eaf1ae7811465924e48923363ff3f526bd6f73d7c184b16bd8ce4d"
+    private val pubkey2 = "32e1827635450ebb3c5a7d12c1f8e7b2b514439ac10a67eef3d9fd9c5c68e245"
+    private val sig = "4aa5264965018fa12a326686ad3d3bd8beae3218dcc83689b19ca1e6baeb791531943c15363aa6707c7c0c8b2d601deca1f20c32078b2872d356cdca03b04cce"
+    private val relayUrl = NormalizedRelayUrl("wss://relay.example.com/")
+
+    private fun hexId(n: Int): String = n.toString().padStart(64, '0')
+
+    private fun testEvent(
+        id: String = hexId(1),
+        kind: Int = 1,
+        createdAt: Long = 1000L,
+        content: String = "hello",
+        tags: Array<Array<String>> = emptyArray(),
+    ) = Event(id, pubkey, createdAt, kind, tags, content, sig)
+
+    /**
+     * Creates a server using the given dispatcher so coroutines run eagerly
+     * in tests (UnconfinedTestDispatcher).
+     */
+    private fun createServer(
+        dispatcher: CoroutineDispatcher,
+        store: IEventStore = EventStore(null),
+        policyBuilder: () -> IRelayPolicy = { FullAuthPolicy(relayUrl) },
+    ): NostrServer =
+        NostrServer(
+            store = store,
+            policyBuilder = policyBuilder,
+            parentContext = dispatcher,
+        )
+
+    private suspend fun RelaySession.insert(event: Event) {
+        val cmd = EventCmd(event)
+        this.receive(OptimizedJsonMapper.toJson(cmd))
+    }
+
+    /** Collects sent JSON messages for a connection. */
+    private class MessageCollector {
+        val messages = mutableListOf<String>()
+
+        val sendCallback: (String) -> Unit = { messages.add(it) }
+
+        /**
+         * Parses messages that can be round-tripped (EVENT, EOSE, NOTICE,
+         * CLOSED). OkMessage and CountMessage serialization uses formats
+         * incompatible with the client-side deserializer, so check those
+         * via [rawMessagesContaining].
+         */
+        fun parsedEventMessages() =
+            messages
+                .filter { it.startsWith("[\"EVENT\"") || it.startsWith("[\"EOSE\"") }
+                .map { OptimizedJsonMapper.fromJsonToMessage(it) }
+
+        fun rawMessagesContaining(label: String) = messages.filter { it.contains("\"$label\"") }
+    }
+
+    /**
+     * Builds a kind 22242 auth event for testing. Because verify = { true },
+     * the id and signature don't need to be real.
+     */
+    private fun authEvent(
+        challenge: String,
+        relay: String = relayUrl.url,
+        pubKey: String = pubkey,
+        createdAt: Long = TimeUtils.now(),
+    ) = RelayAuthEvent(
+        id = hexId(99),
+        pubKey = pubKey,
+        createdAt = createdAt,
+        tags =
+            arrayOf(
+                arrayOf("relay", relay),
+                arrayOf("challenge", challenge),
+            ),
+        content = "",
+        sig = sig,
+    )
+
+    private fun authJson(event: RelayAuthEvent): String {
+        val cmd = AuthCmd(event)
+        return OptimizedJsonMapper.toJson(cmd)
+    }
+
+    private fun authJson(event: Event) = """["AUTH",${event.toJson()}]"""
+
+    @Test
+    fun authChallengeIsSentOnRequest() =
+        runTest {
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val server = createServer(dispatcher = dispatcher)
+            val collector = MessageCollector()
+
+            val session = server.connect(collector.sendCallback)
+
+            assertEquals(1, collector.messages.size)
+            assertTrue(collector.messages[0].contains("\"AUTH\""))
+
+            server.shutdown()
+        }
+
+    @Test
+    fun authSucceedsWithValidEvent() =
+        runTest {
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val server = createServer(dispatcher = dispatcher)
+            val collector = MessageCollector()
+
+            val session = server.connect(collector.sendCallback)
+
+            assertEquals(1, collector.messages.size)
+            assertTrue(collector.messages[0].contains("\"AUTH\""))
+            val msg = OptimizedJsonMapper.fromJsonToMessage(collector.messages[0]) as AuthMessage
+
+            val event = authEvent(challenge = msg.challenge)
+            session.receive(authJson(event))
+
+            val okMessages = collector.rawMessagesContaining("OK")
+            assertEquals(1, okMessages.size)
+            assertTrue(okMessages[0].contains("\"true\""))
+            assertTrue((session.policy as FullAuthPolicy).isAuthenticated())
+            assertTrue(session.policy.authenticatedUsers.contains(pubkey))
+
+            server.shutdown()
+        }
+
+    @Test
+    fun authFailsWithWrongChallenge() =
+        runTest {
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val server = createServer(dispatcher = dispatcher)
+            val collector = MessageCollector()
+
+            val session = server.connect(collector.sendCallback)
+
+            val event = authEvent(challenge = "wrong-challenge")
+            session.receive(authJson(event))
+
+            val okMessages = collector.rawMessagesContaining("OK")
+            assertEquals(1, okMessages.size)
+            assertTrue(okMessages[0].contains("\"false\""))
+            assertTrue(okMessages[0].contains("challenge"))
+            assertFalse((session.policy as FullAuthPolicy).isAuthenticated())
+
+            server.shutdown()
+        }
+
+    @Test
+    fun authFailsWithWrongRelay() =
+        runTest {
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val server = createServer(dispatcher = dispatcher)
+            val collector = MessageCollector()
+
+            val session = server.connect(collector.sendCallback)
+
+            assertEquals(1, collector.messages.size)
+            assertTrue(collector.messages[0].contains("\"AUTH\""))
+            val msg = OptimizedJsonMapper.fromJsonToMessage(collector.messages[0]) as AuthMessage
+
+            val event = authEvent(challenge = msg.challenge, relay = "wss://wrong.relay.com/")
+            session.receive(authJson(event))
+
+            val okMessages = collector.rawMessagesContaining("OK")
+            assertEquals(1, okMessages.size)
+            assertTrue(okMessages[0].contains("\"false\""))
+            assertTrue(okMessages[0].contains("relay url"))
+            assertFalse((session.policy as FullAuthPolicy).isAuthenticated())
+
+            server.shutdown()
+        }
+
+    @Test
+    fun authFailsWithExpiredTimestamp() =
+        runTest {
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val server = createServer(dispatcher = dispatcher)
+            val collector = MessageCollector()
+
+            val session = server.connect(collector.sendCallback)
+
+            assertEquals(1, collector.messages.size)
+            assertTrue(collector.messages[0].contains("\"AUTH\""))
+            val msg = OptimizedJsonMapper.fromJsonToMessage(collector.messages[0]) as AuthMessage
+
+            val event =
+                authEvent(
+                    challenge = msg.challenge,
+                    createdAt = TimeUtils.now() - 1200L, // 20 minutes ago
+                )
+            session.receive(authJson(event))
+
+            val okMessages = collector.rawMessagesContaining("OK")
+            assertEquals(1, okMessages.size)
+            assertTrue(okMessages[0].contains("\"false\""))
+            assertTrue(okMessages[0].contains("created_at"))
+            assertFalse((session.policy as FullAuthPolicy).isAuthenticated())
+
+            server.shutdown()
+        }
+
+    @Test
+    fun authFailsWithWrongKind() =
+        runTest {
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val server = createServer(dispatcher = dispatcher)
+            val collector = MessageCollector()
+
+            val session = server.connect(collector.sendCallback)
+
+            assertEquals(1, collector.messages.size)
+            assertTrue(collector.messages[0].contains("\"AUTH\""))
+            val msg = OptimizedJsonMapper.fromJsonToMessage(collector.messages[0]) as AuthMessage
+
+            // Create an event with wrong kind (1 instead of 22242)
+            val event =
+                Event(
+                    id = hexId(99),
+                    pubKey = pubkey,
+                    createdAt = TimeUtils.now(),
+                    kind = 1,
+                    tags =
+                        arrayOf(
+                            arrayOf("relay", relayUrl.url),
+                            arrayOf("challenge", msg.challenge),
+                        ),
+                    content = "",
+                    sig = sig,
+                )
+            session.receive(authJson(event))
+
+            val okMessages = collector.rawMessagesContaining("NOTICE")
+            assertEquals(1, okMessages.size)
+            assertTrue(okMessages[0].contains("error"))
+            assertTrue(okMessages[0].contains("could not parse message"))
+            assertFalse((session.policy as FullAuthPolicy).isAuthenticated())
+
+            server.shutdown()
+        }
+
+    @Test
+    fun multipleUsersCanAuthenticate() =
+        runTest {
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val server = createServer(dispatcher = dispatcher)
+            val collector = MessageCollector()
+
+            val session = server.connect(collector.sendCallback)
+
+            assertEquals(1, collector.messages.size)
+            assertTrue(collector.messages[0].contains("\"AUTH\""))
+            val msg = OptimizedJsonMapper.fromJsonToMessage(collector.messages[0]) as AuthMessage
+
+            // First user authenticates
+            val event1 = authEvent(challenge = msg.challenge, pubKey = pubkey)
+            session.receive(authJson(event1))
+
+            // Second user authenticates on the same session
+            val event2 = authEvent(challenge = msg.challenge, pubKey = pubkey2)
+            session.receive(authJson(event2))
+
+            val okMessages = collector.rawMessagesContaining("OK")
+            assertEquals(2, okMessages.size)
+            assertTrue(okMessages[0].contains("\"true\""))
+            assertTrue(okMessages[1].contains("\"true\""))
+
+            val authedPubkeys = (session.policy as FullAuthPolicy).authenticatedUsers
+            assertEquals(2, authedPubkeys.size)
+            assertTrue(authedPubkeys.contains(pubkey))
+            assertTrue(authedPubkeys.contains(pubkey2))
+
+            server.shutdown()
+        }
+
+    // -- NIP-42: requireAuth ---------------------------------------------------
+
+    @Test
+    fun requireAuthRejectsEventWithoutAuth() =
+        runTest {
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val server = createServer(dispatcher = dispatcher)
+            val collector = MessageCollector()
+
+            val session = server.connect(collector.sendCallback)
+
+            val event = testEvent()
+            session.receive("""["EVENT",${event.toJson()}]""")
+
+            val okMessages = collector.rawMessagesContaining("OK")
+            assertEquals(1, okMessages.size)
+            assertTrue(okMessages[0].contains("\"false\""))
+            assertTrue(okMessages[0].contains("auth-required:"))
+
+            server.shutdown()
+        }
+
+    @Test
+    fun requireAuthRejectsReqWithoutAuth() =
+        runTest {
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val server = createServer(dispatcher = dispatcher)
+            val collector = MessageCollector()
+
+            val session = server.connect(collector.sendCallback)
+            session.receive("""["REQ","sub1",{"kinds":[1]}]""")
+
+            val closedMessages = collector.rawMessagesContaining("CLOSED")
+            assertEquals(1, closedMessages.size)
+            assertTrue(closedMessages[0].contains("auth-required:"))
+
+            server.shutdown()
+        }
+
+    @Test
+    fun requireAuthRejectsCountWithoutAuth() =
+        runTest {
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val server = createServer(dispatcher = dispatcher)
+            val collector = MessageCollector()
+
+            val session = server.connect(collector.sendCallback)
+            session.receive("""["COUNT","q1",{"kinds":[1]}]""")
+
+            val closedMessages = collector.rawMessagesContaining("CLOSED")
+            assertEquals(1, closedMessages.size)
+            assertTrue(closedMessages[0].contains("auth-required:"))
+
+            server.shutdown()
+        }
+
+    @Test
+    fun requireAuthAllowsCommandsAfterAuth() =
+        runTest {
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+
+            val server = createServer(dispatcher = dispatcher)
+            val collector = MessageCollector()
+
+            val session = server.connect(collector.sendCallback)
+
+            assertEquals(1, collector.messages.size)
+            assertTrue(collector.messages[0].contains("\"AUTH\""))
+            val msg = OptimizedJsonMapper.fromJsonToMessage(collector.messages[0]) as AuthMessage
+
+            // Authenticate first
+            val authEv = authEvent(challenge = msg.challenge)
+            session.receive(authJson(authEv))
+
+            val okMessages = collector.rawMessagesContaining("OK")
+            assertEquals(1, okMessages.size)
+            assertTrue(okMessages[0].contains("\"true\""))
+
+            // Now EVENT should work
+            val event = testEvent()
+            session.receive("""["EVENT",${event.toJson()}]""")
+
+            val allOk = collector.rawMessagesContaining("OK")
+            assertEquals(2, allOk.size)
+            assertTrue(allOk[1].contains("\"true\""))
+
+            // REQ should work
+            session.receive("""["REQ","sub1",{"kinds":[1]}]""")
+
+            val eoseMessages = collector.rawMessagesContaining("EOSE")
+            assertTrue(eoseMessages.isNotEmpty())
+
+            server.shutdown()
+        }
+
+    @Test
+    fun noAuthRequiredAllowsCommandsWithoutAuth() =
+        runTest {
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val server = createServer(dispatcher = dispatcher, policyBuilder = { EmptyPolicy })
+            val collector = MessageCollector()
+
+            val session = server.connect(collector.sendCallback)
+
+            // EVENT should work without auth when using OpenPolicy
+            val event = testEvent()
+            session.receive("""["EVENT",${event.toJson()}]""")
+
+            val okMessages = collector.rawMessagesContaining("OK")
+            assertEquals(1, okMessages.size)
+            assertTrue(okMessages[0].contains("\"true\""))
+
+            server.shutdown()
+        }
+
+    // -- Custom AuthPolicy tests -----------------------------------------------
+
+    @Test
+    fun customPolicyRejectsSpecificEventKinds() =
+        runTest {
+            // Policy that blocks kind 4 (DMs) from unauthenticated users.
+            val policy =
+                object : FullAuthPolicy(relayUrl) {
+                    override fun accept(cmd: EventCmd) =
+                        if (cmd.event.kind == 4 && authenticatedUsers.isEmpty()) {
+                            PolicyResult.Rejected("auth-required: kind 4 events require authentication")
+                        } else {
+                            PolicyResult.Accepted(cmd)
+                        }
+
+                    override fun accept(cmd: ReqCmd) = PolicyResult.Accepted(cmd)
+
+                    override fun accept(cmd: CountCmd) = PolicyResult.Accepted(cmd)
+                }
+
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val server = createServer(dispatcher = dispatcher, policyBuilder = { policy })
+            val collector = MessageCollector()
+            val session = server.connect(collector.sendCallback)
+
+            // Kind 1 should be accepted without auth
+            val note = testEvent(hexId(1), kind = 1)
+            session.receive("""["EVENT",${note.toJson()}]""")
+            assertTrue(collector.rawMessagesContaining("OK")[0].contains("\"true\""))
+
+            // Kind 4 should be rejected without auth
+            val dm = testEvent(hexId(2), kind = 4)
+            session.receive("""["EVENT",${dm.toJson()}]""")
+            val okMessages = collector.rawMessagesContaining("OK")
+            assertEquals(2, okMessages.size)
+            assertTrue(okMessages[1].contains("\"false\""))
+            assertTrue(okMessages[1].contains("auth-required:"))
+
+            server.shutdown()
+        }
+
+    @Test
+    fun customPolicyRewritesFilters() =
+        runTest {
+            // Policy that restricts kind 4 queries to the authed user's own messages.
+            val policy =
+                object : FullAuthPolicy(relayUrl) {
+                    override fun accept(cmd: EventCmd) = PolicyResult.Accepted(cmd)
+
+                    override fun accept(cmd: ReqCmd): PolicyResult<ReqCmd> {
+                        val hasDmFilter = cmd.filters.any { it.kinds?.contains(4) == true }
+                        if (!hasDmFilter) return PolicyResult.Accepted(cmd)
+                        if (authenticatedUsers.isEmpty()) {
+                            return PolicyResult.Rejected("auth-required: kind 4 requires auth")
+                        }
+                        // Rewrite: restrict to authed user's pubkey as author
+                        val rewritten =
+                            cmd.filters.map { filter ->
+                                if (filter.kinds?.contains(4) == true) {
+                                    filter.copy(authors = authenticatedUsers.toList())
+                                } else {
+                                    filter
+                                }
+                            }
+                        return PolicyResult.Accepted(ReqCmd(cmd.subId, rewritten))
+                    }
+
+                    override fun accept(cmd: CountCmd) = PolicyResult.Accepted(cmd)
+                }
+
+            val dispatcher = UnconfinedTestDispatcher(testScheduler)
+            val store = EventStore(null)
+            val server = createServer(store = store, dispatcher = dispatcher, policyBuilder = { policy })
+
+            // Insert DMs from two different authors
+            store.insert(testEvent(hexId(1), kind = 4, createdAt = 100L)) // from pubkey
+            store.insert(
+                Event(hexId(2), pubkey2, 200L, 4, emptyArray(), "secret", sig),
+            ) // from pubkey2
+
+            val collector = MessageCollector()
+            val session = server.connect(collector.sendCallback)
+
+            assertEquals(1, collector.messages.size)
+            assertTrue(collector.messages[0].contains("\"AUTH\""))
+            val msg = OptimizedJsonMapper.fromJsonToMessage(collector.messages[0]) as AuthMessage
+
+            // Authenticate as pubkey
+            val auth = authEvent(challenge = msg.challenge, pubKey = pubkey)
+            session.receive(authJson(auth))
+
+            // Query kind 4 — policy should rewrite to only return pubkey's events
+            session.receive("""["REQ","sub1",{"kinds":[4]}]""")
+
+            val events = collector.parsedEventMessages().filterIsInstance<EventMessage>()
+            assertEquals(1, events.size)
+            assertEquals(pubkey, events[0].event.pubKey)
+
+            server.shutdown()
+        }
+}
@@ -21,31 +21,25 @@
 package com.vitorpamplona.quartz.nip01Core.relay.server

 import com.vitorpamplona.quartz.nip01Core.core.Event
-import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.core.OptimizedJsonMapper
 import com.vitorpamplona.quartz.nip01Core.relay.commands.toClient.EoseMessage
 import com.vitorpamplona.quartz.nip01Core.relay.commands.toClient.EventMessage
 import com.vitorpamplona.quartz.nip01Core.relay.commands.toRelay.EventCmd
 import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
-import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import com.vitorpamplona.quartz.nip01Core.relay.server.policies.EmptyPolicy
 import com.vitorpamplona.quartz.nip01Core.store.IEventStore
 import com.vitorpamplona.quartz.nip01Core.store.sqlite.EventStore
-import com.vitorpamplona.quartz.nip42RelayAuth.RelayAuthEvent
-import com.vitorpamplona.quartz.utils.TimeUtils
 import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.test.UnconfinedTestDispatcher
 import kotlinx.coroutines.test.runTest
 import kotlin.test.Test
 import kotlin.test.assertEquals
-import kotlin.test.assertFalse
 import kotlin.test.assertTrue

@OptIn(ExperimentalCoroutinesApi::class)
 class NostrServerTest {
    private val pubkey = "46fcbe3065eaf1ae7811465924e48923363ff3f526bd6f73d7c184b16bd8ce4d"
-    private val pubkey2 = "32e1827635450ebb3c5a7d12c1f8e7b2b514439ac10a67eef3d9fd9c5c68e245"
    private val sig = "4aa5264965018fa12a326686ad3d3bd8beae3218dcc83689b19ca1e6baeb791531943c15363aa6707c7c0c8b2d601deca1f20c32078b2872d356cdca03b04cce"
-    private val relayUrl = NormalizedRelayUrl("wss://relay.example.com/")

    private fun hexId(n: Int): String = n.toString().padStart(64, '0')

@@ -62,21 +56,19 @@ class NostrServerTest {
     * in tests (UnconfinedTestDispatcher).
     */
    private fun createServer(
-        store: IEventStore = EventStore(null),
        dispatcher: kotlinx.coroutines.CoroutineDispatcher,
-        authPolicy: AuthPolicy = OpenPolicy(),
+        store: IEventStore = EventStore(null),
+        policyBuilder: () -> IRelayPolicy = { EmptyPolicy },
    ): NostrServer =
        NostrServer(
            store = store,
-            relayUrl = relayUrl,
-            authPolicy = authPolicy,
+            policyBuilder = policyBuilder,
            parentContext = dispatcher,
-            verify = { true },
        )

    private suspend fun RelaySession.insert(event: Event) {
        val cmd = EventCmd(event)
-        this.processMessage(OptimizedJsonMapper.toJson(cmd))
+        this.receive(OptimizedJsonMapper.toJson(cmd))
    }

    /** Collects sent JSON messages for a connection. */
@@ -99,31 +91,6 @@ class NostrServerTest {
        fun rawMessagesContaining(label: String) = messages.filter { it.contains("\"$label\"") }
    }

-    /**
-     * Builds a kind 22242 auth event for testing. Because verify = { true },
-     * the id and signature don't need to be real.
-     */
-    private fun authEvent(
-        challenge: String,
-        relay: String = relayUrl.url,
-        pubKey: String = pubkey,
-        createdAt: Long = TimeUtils.now(),
-    ) = Event(
-        id = hexId(99),
-        pubKey = pubKey,
-        createdAt = createdAt,
-        kind = RelayAuthEvent.KIND,
-        tags =
-            arrayOf(
-                arrayOf("relay", relay),
-                arrayOf("challenge", challenge),
-            ),
-        content = "",
-        sig = sig,
-    )
-
-    private fun authJson(event: Event) = """["AUTH",${event.toJson()}]"""
-
    // -- EVENT command ---------------------------------------------------------

    @Test
@@ -131,14 +98,14 @@ class NostrServerTest {
        runTest {
            val dispatcher = UnconfinedTestDispatcher(testScheduler)
            val store = EventStore(null)
-            val server = createServer(store, dispatcher)
+            val server = createServer(dispatcher, store)
            val collector = MessageCollector()

            val c1 = server.connect(collector.sendCallback)

            val event = testEvent()
            val eventJson = """["EVENT",${event.toJson()}]"""
-            c1.processMessage(eventJson)
+            c1.receive(eventJson)

            val okMessages = collector.rawMessagesContaining("OK")
            assertEquals(1, okMessages.size)
@@ -156,15 +123,15 @@ class NostrServerTest {
        runTest {
            val dispatcher = UnconfinedTestDispatcher(testScheduler)
            val store = EventStore(null)
-            val server = createServer(store, dispatcher)
+            val server = createServer(dispatcher, store)
            val collector = MessageCollector()

            val c1 = server.connect(collector.sendCallback)

            val event = testEvent()
            val eventJson = """["EVENT",${event.toJson()}]"""
-            c1.processMessage(eventJson)
-            c1.processMessage(eventJson)
+            c1.receive(eventJson)
+            c1.receive(eventJson)

            val okMessages = collector.rawMessagesContaining("OK")
            assertEquals(2, okMessages.size)
@@ -181,7 +148,7 @@ class NostrServerTest {
        runTest {
            val dispatcher = UnconfinedTestDispatcher(testScheduler)
            val store = EventStore(null)
-            val server = createServer(store, dispatcher)
+            val server = createServer(dispatcher, store)

            // Pre-populate store
            store.insert(testEvent(hexId(1), kind = 1, createdAt = 100L))
@@ -192,7 +159,7 @@ class NostrServerTest {
            val c1 = server.connect(collector.sendCallback)

            val reqJson = """["REQ","sub1",{"kinds":[1]}]"""
-            c1.processMessage(reqJson)
+            c1.receive(reqJson)

            val parsed = collector.parsedEventMessages()
            val events = parsed.filterIsInstance<EventMessage>()
@@ -213,7 +180,7 @@ class NostrServerTest {
        runTest {
            val dispatcher = UnconfinedTestDispatcher(testScheduler)
            val store = EventStore(null)
-            val server = createServer(store, dispatcher)
+            val server = createServer(dispatcher, store)

            for (i in 1..10) {
                store.insert(testEvent(hexId(i), createdAt = i.toLong()))
@@ -223,7 +190,7 @@ class NostrServerTest {
            val c1 = server.connect(collector.sendCallback)

            val reqJson = """["REQ","sub1",{"limit":3}]"""
-            c1.processMessage(reqJson)
+            c1.receive(reqJson)

            val events = collector.parsedEventMessages().filterIsInstance<EventMessage>()
            assertEquals(3, events.size)
@@ -237,8 +204,8 @@ class NostrServerTest {
    fun liveSubscriptionReceivesNewEvents() =
        runTest {
            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val store = EventStore(null)
-            val server = createServer(store, dispatcher)
+
+            val server = createServer(dispatcher)
            val collector1 = MessageCollector()
            val collector2 = MessageCollector()

@@ -247,7 +214,7 @@ class NostrServerTest {

            // Subscribe to kind 1
            val reqJson = """["REQ","sub1",{"kinds":[1]}]"""
-            c1.processMessage(reqJson)
+            c1.receive(reqJson)

            // After REQ, we should have EOSE
            val countAfterEose = collector1.messages.size
@@ -266,8 +233,8 @@ class NostrServerTest {
    fun liveSubscriptionFiltersNonMatchingEvents() =
        runTest {
            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val store = EventStore(null)
-            val server = createServer(store, dispatcher)
+
+            val server = createServer(dispatcher)
            val collector1 = MessageCollector()
            val collector2 = MessageCollector()

@@ -275,7 +242,7 @@ class NostrServerTest {
            val c2 = server.connect(collector2.sendCallback)

            val reqJson = """["REQ","sub1",{"kinds":[1]}]"""
-            c1.processMessage(reqJson)
+            c1.receive(reqJson)

            val countAfterEose = collector1.messages.size

@@ -293,8 +260,8 @@ class NostrServerTest {
    fun closeStopsSubscription() =
        runTest {
            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val store = EventStore(null)
-            val server = createServer(store, dispatcher)
+
+            val server = createServer(dispatcher)
            val collector1 = MessageCollector()
            val collector2 = MessageCollector()

@@ -302,11 +269,11 @@ class NostrServerTest {
            val c2 = server.connect(collector2.sendCallback)

            val reqJson = """["REQ","sub1",{"kinds":[1]}]"""
-            c1.processMessage(reqJson)
+            c1.receive(reqJson)

            // Close the subscription
            val closeJson = """["CLOSE","sub1"]"""
-            c1.processMessage(closeJson)
+            c1.receive(closeJson)

            val countAfterClose = collector1.messages.size

@@ -322,7 +289,7 @@ class NostrServerTest {
    fun replacingSubscriptionCancelsOld() =
        runTest {
            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(EventStore(null), dispatcher)
+            val server = createServer(dispatcher)
            val collector1 = MessageCollector()
            val collector2 = MessageCollector()

@@ -330,10 +297,10 @@ class NostrServerTest {
            val c2 = server.connect(collector2.sendCallback)

            // First subscription for kind 1
-            c1.processMessage("""["REQ","sub1",{"kinds":[1]}]""")
+            c1.receive("""["REQ","sub1",{"kinds":[1]}]""")

            // Replace with kind 4
-            c1.processMessage("""["REQ","sub1",{"kinds":[4]}]""")
+            c1.receive("""["REQ","sub1",{"kinds":[4]}]""")

            val countAfterReplace = collector1.messages.size

@@ -361,7 +328,7 @@ class NostrServerTest {
        runTest {
            val dispatcher = UnconfinedTestDispatcher(testScheduler)
            val store = EventStore(null)
-            val server = createServer(store, dispatcher)
+            val server = createServer(dispatcher, store)

            store.insert(testEvent(hexId(1), kind = 1))
            store.insert(testEvent(hexId(2), kind = 1))
@@ -371,7 +338,7 @@ class NostrServerTest {
            val c1 = server.connect(collector.sendCallback)

            val countJson = """["COUNT","q1",{"kinds":[1]}]"""
-            c1.processMessage(countJson)
+            c1.receive(countJson)

            val countMessages = collector.rawMessagesContaining("COUNT")
            assertEquals(1, countMessages.size)
@@ -386,16 +353,16 @@ class NostrServerTest {
    fun disconnectCancelsAllSubscriptions() =
        runTest {
            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val store = EventStore(null)
-            val server = createServer(store, dispatcher)
+
+            val server = createServer(dispatcher)
            val collector1 = MessageCollector()
            val collector2 = MessageCollector()

            val c1 = server.connect(collector1.sendCallback)
            val c2 = server.connect(collector2.sendCallback)

-            c1.processMessage("""["REQ","sub1",{"kinds":[1]}]""")
-            c1.processMessage("""["REQ","sub2",{"kinds":[4]}]""")
+            c1.receive("""["REQ","sub1",{"kinds":[1]}]""")
+            c1.receive("""["REQ","sub2",{"kinds":[4]}]""")

            c1.close()

@@ -420,458 +387,11 @@ class NostrServerTest {
            val collector = MessageCollector()

            val c1 = server.connect(collector.sendCallback)
-            c1.processMessage("not valid json")
+            c1.receive("not valid json")

            assertEquals(1, collector.messages.size)
            assertTrue(collector.messages[0].contains("NOTICE"))

-            server.shutdown()
-        }
-
-    // -- NIP-42: AUTH ----------------------------------------------------------
-
-    @Test
-    fun authChallengeIsSentOnRequest() =
-        runTest {
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(dispatcher = dispatcher)
-            val collector = MessageCollector()
-
-            val session = server.connect(collector.sendCallback)
-            session.sendAuthChallenge()
-
-            assertEquals(1, collector.messages.size)
-            assertTrue(collector.messages[0].contains("\"AUTH\""))
-            assertTrue(collector.messages[0].contains(session.challenge))
-
-            server.shutdown()
-        }
-
-    @Test
-    fun authSucceedsWithValidEvent() =
-        runTest {
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(dispatcher = dispatcher)
-            val collector = MessageCollector()
-
-            val session = server.connect(collector.sendCallback)
-
-            val event = authEvent(challenge = session.challenge)
-            session.processMessage(authJson(event))
-
-            val okMessages = collector.rawMessagesContaining("OK")
-            assertEquals(1, okMessages.size)
-            assertTrue(okMessages[0].contains("\"true\""))
-            assertTrue(session.isAuthenticated())
-            assertTrue(session.authenticatedPubkeys().contains(pubkey))
-
-            server.shutdown()
-        }
-
-    @Test
-    fun authFailsWithWrongChallenge() =
-        runTest {
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(dispatcher = dispatcher)
-            val collector = MessageCollector()
-
-            val session = server.connect(collector.sendCallback)
-
-            val event = authEvent(challenge = "wrong-challenge")
-            session.processMessage(authJson(event))
-
-            val okMessages = collector.rawMessagesContaining("OK")
-            assertEquals(1, okMessages.size)
-            assertTrue(okMessages[0].contains("\"false\""))
-            assertTrue(okMessages[0].contains("challenge"))
-            assertFalse(session.isAuthenticated())
-
-            server.shutdown()
-        }
-
-    @Test
-    fun authFailsWithWrongRelay() =
-        runTest {
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(dispatcher = dispatcher)
-            val collector = MessageCollector()
-
-            val session = server.connect(collector.sendCallback)
-
-            val event = authEvent(challenge = session.challenge, relay = "wss://wrong.relay.com/")
-            session.processMessage(authJson(event))
-
-            val okMessages = collector.rawMessagesContaining("OK")
-            assertEquals(1, okMessages.size)
-            assertTrue(okMessages[0].contains("\"false\""))
-            assertTrue(okMessages[0].contains("relay url"))
-            assertFalse(session.isAuthenticated())
-
-            server.shutdown()
-        }
-
-    @Test
-    fun authFailsWithExpiredTimestamp() =
-        runTest {
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(dispatcher = dispatcher)
-            val collector = MessageCollector()
-
-            val session = server.connect(collector.sendCallback)
-
-            val event =
-                authEvent(
-                    challenge = session.challenge,
-                    createdAt = TimeUtils.now() - 1200L, // 20 minutes ago
-                )
-            session.processMessage(authJson(event))
-
-            val okMessages = collector.rawMessagesContaining("OK")
-            assertEquals(1, okMessages.size)
-            assertTrue(okMessages[0].contains("\"false\""))
-            assertTrue(okMessages[0].contains("created_at"))
-            assertFalse(session.isAuthenticated())
-
-            server.shutdown()
-        }
-
-    @Test
-    fun authFailsWithWrongKind() =
-        runTest {
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(dispatcher = dispatcher)
-            val collector = MessageCollector()
-
-            val session = server.connect(collector.sendCallback)
-
-            // Create an event with wrong kind (1 instead of 22242)
-            val event =
-                Event(
-                    id = hexId(99),
-                    pubKey = pubkey,
-                    createdAt = TimeUtils.now(),
-                    kind = 1,
-                    tags =
-                        arrayOf(
-                            arrayOf("relay", relayUrl.url),
-                            arrayOf("challenge", session.challenge),
-                        ),
-                    content = "",
-                    sig = sig,
-                )
-            session.processMessage(authJson(event))
-
-            val okMessages = collector.rawMessagesContaining("OK")
-            assertEquals(1, okMessages.size)
-            assertTrue(okMessages[0].contains("\"false\""))
-            assertTrue(okMessages[0].contains("wrong event kind"))
-            assertFalse(session.isAuthenticated())
-
-            server.shutdown()
-        }
-
-    @Test
-    fun multipleUsersCanAuthenticate() =
-        runTest {
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(dispatcher = dispatcher)
-            val collector = MessageCollector()
-
-            val session = server.connect(collector.sendCallback)
-
-            // First user authenticates
-            val event1 = authEvent(challenge = session.challenge, pubKey = pubkey)
-            session.processMessage(authJson(event1))
-
-            // Second user authenticates on the same session
-            val event2 = authEvent(challenge = session.challenge, pubKey = pubkey2)
-            session.processMessage(authJson(event2))
-
-            val okMessages = collector.rawMessagesContaining("OK")
-            assertEquals(2, okMessages.size)
-            assertTrue(okMessages[0].contains("\"true\""))
-            assertTrue(okMessages[1].contains("\"true\""))
-
-            val authedPubkeys = session.authenticatedPubkeys()
-            assertEquals(2, authedPubkeys.size)
-            assertTrue(authedPubkeys.contains(pubkey))
-            assertTrue(authedPubkeys.contains(pubkey2))
-
-            server.shutdown()
-        }
-
-    // -- NIP-42: requireAuth ---------------------------------------------------
-
-    @Test
-    fun requireAuthRejectsEventWithoutAuth() =
-        runTest {
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(dispatcher = dispatcher, authPolicy = RequireAuthPolicy())
-            val collector = MessageCollector()
-
-            val session = server.connect(collector.sendCallback)
-
-            val event = testEvent()
-            session.processMessage("""["EVENT",${event.toJson()}]""")
-
-            val okMessages = collector.rawMessagesContaining("OK")
-            assertEquals(1, okMessages.size)
-            assertTrue(okMessages[0].contains("\"false\""))
-            assertTrue(okMessages[0].contains("auth-required:"))
-
-            server.shutdown()
-        }
-
-    @Test
-    fun requireAuthRejectsReqWithoutAuth() =
-        runTest {
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(dispatcher = dispatcher, authPolicy = RequireAuthPolicy())
-            val collector = MessageCollector()
-
-            val session = server.connect(collector.sendCallback)
-            session.processMessage("""["REQ","sub1",{"kinds":[1]}]""")
-
-            val closedMessages = collector.rawMessagesContaining("CLOSED")
-            assertEquals(1, closedMessages.size)
-            assertTrue(closedMessages[0].contains("auth-required:"))
-
-            server.shutdown()
-        }
-
-    @Test
-    fun requireAuthRejectsCountWithoutAuth() =
-        runTest {
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(dispatcher = dispatcher, authPolicy = RequireAuthPolicy())
-            val collector = MessageCollector()
-
-            val session = server.connect(collector.sendCallback)
-            session.processMessage("""["COUNT","q1",{"kinds":[1]}]""")
-
-            val closedMessages = collector.rawMessagesContaining("CLOSED")
-            assertEquals(1, closedMessages.size)
-            assertTrue(closedMessages[0].contains("auth-required:"))
-
-            server.shutdown()
-        }
-
-    @Test
-    fun requireAuthAllowsCommandsAfterAuth() =
-        runTest {
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val store = EventStore(null)
-            val server = createServer(store = store, dispatcher = dispatcher, authPolicy = RequireAuthPolicy())
-            val collector = MessageCollector()
-
-            val session = server.connect(collector.sendCallback)
-
-            // Authenticate first
-            val authEv = authEvent(challenge = session.challenge)
-            session.processMessage(authJson(authEv))
-
-            val okMessages = collector.rawMessagesContaining("OK")
-            assertEquals(1, okMessages.size)
-            assertTrue(okMessages[0].contains("\"true\""))
-
-            // Now EVENT should work
-            val event = testEvent()
-            session.processMessage("""["EVENT",${event.toJson()}]""")
-
-            val allOk = collector.rawMessagesContaining("OK")
-            assertEquals(2, allOk.size)
-            assertTrue(allOk[1].contains("\"true\""))
-
-            // REQ should work
-            session.processMessage("""["REQ","sub1",{"kinds":[1]}]""")
-
-            val eoseMessages = collector.rawMessagesContaining("EOSE")
-            assertTrue(eoseMessages.isNotEmpty())
-
-            server.shutdown()
-        }
-
-    @Test
-    fun noAuthRequiredAllowsCommandsWithoutAuth() =
-        runTest {
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(dispatcher = dispatcher)
-            val collector = MessageCollector()
-
-            val session = server.connect(collector.sendCallback)
-
-            // EVENT should work without auth when using OpenPolicy
-            val event = testEvent()
-            session.processMessage("""["EVENT",${event.toJson()}]""")
-
-            val okMessages = collector.rawMessagesContaining("OK")
-            assertEquals(1, okMessages.size)
-            assertTrue(okMessages[0].contains("\"true\""))
-
-            server.shutdown()
-        }
-
-    // -- Custom AuthPolicy tests -----------------------------------------------
-
-    @Test
-    fun customPolicyRejectsSpecificEventKinds() =
-        runTest {
-            // Policy that blocks kind 4 (DMs) from unauthenticated users.
-            val policy =
-                object : AuthPolicy {
-                    override fun acceptEvent(
-                        event: Event,
-                        authedPubkeys: Set<HexKey>,
-                    ) = if (event.kind == 4 && authedPubkeys.isEmpty()) {
-                        PolicyResult.Rejected("auth-required: kind 4 events require authentication")
-                    } else {
-                        PolicyResult.Accepted
-                    }
-
-                    override fun acceptReq(
-                        filters: List<Filter>,
-                        authedPubkeys: Set<HexKey>,
-                    ) = ReqPolicyResult.Accepted()
-
-                    override fun acceptCount(
-                        filters: List<Filter>,
-                        authedPubkeys: Set<HexKey>,
-                    ) = PolicyResult.Accepted
-                }
-
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val server = createServer(dispatcher = dispatcher, authPolicy = policy)
-            val collector = MessageCollector()
-            val session = server.connect(collector.sendCallback)
-
-            // Kind 1 should be accepted without auth
-            val note = testEvent(hexId(1), kind = 1)
-            session.processMessage("""["EVENT",${note.toJson()}]""")
-            assertTrue(collector.rawMessagesContaining("OK")[0].contains("\"true\""))
-
-            // Kind 4 should be rejected without auth
-            val dm = testEvent(hexId(2), kind = 4)
-            session.processMessage("""["EVENT",${dm.toJson()}]""")
-            val okMessages = collector.rawMessagesContaining("OK")
-            assertEquals(2, okMessages.size)
-            assertTrue(okMessages[1].contains("\"false\""))
-            assertTrue(okMessages[1].contains("auth-required:"))
-
-            server.shutdown()
-        }
-
-    @Test
-    fun customPolicyRewritesFilters() =
-        runTest {
-            // Policy that restricts kind 4 queries to the authed user's own messages.
-            val policy =
-                object : AuthPolicy {
-                    override fun acceptEvent(
-                        event: Event,
-                        authedPubkeys: Set<HexKey>,
-                    ) = PolicyResult.Accepted
-
-                    override fun acceptReq(
-                        filters: List<Filter>,
-                        authedPubkeys: Set<HexKey>,
-                    ): ReqPolicyResult {
-                        val hasDmFilter = filters.any { it.kinds?.contains(4) == true }
-                        if (!hasDmFilter) return ReqPolicyResult.Accepted()
-                        if (authedPubkeys.isEmpty()) {
-                            return ReqPolicyResult.Rejected("auth-required: kind 4 requires auth")
-                        }
-                        // Rewrite: restrict to authed user's pubkey as author
-                        val rewritten =
-                            filters.map { filter ->
-                                if (filter.kinds?.contains(4) == true) {
-                                    filter.copy(authors = authedPubkeys.toList())
-                                } else {
-                                    filter
-                                }
-                            }
-                        return ReqPolicyResult.Accepted(rewritten)
-                    }
-
-                    override fun acceptCount(
-                        filters: List<Filter>,
-                        authedPubkeys: Set<HexKey>,
-                    ) = PolicyResult.Accepted
-                }
-
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val store = EventStore(null)
-            val server = createServer(store = store, dispatcher = dispatcher, authPolicy = policy)
-
-            // Insert DMs from two different authors
-            store.insert(testEvent(hexId(1), kind = 4, createdAt = 100L)) // from pubkey
-            store.insert(
-                Event(hexId(2), pubkey2, 200L, 4, emptyArray(), "secret", sig),
-            ) // from pubkey2
-
-            val collector = MessageCollector()
-            val session = server.connect(collector.sendCallback)
-
-            // Authenticate as pubkey
-            val auth = authEvent(challenge = session.challenge, pubKey = pubkey)
-            session.processMessage(authJson(auth))
-
-            // Query kind 4 — policy should rewrite to only return pubkey's events
-            session.processMessage("""["REQ","sub1",{"kinds":[4]}]""")
-
-            val events = collector.parsedEventMessages().filterIsInstance<EventMessage>()
-            assertEquals(1, events.size)
-            assertEquals(pubkey, events[0].event.pubKey)
-
-            server.shutdown()
-        }
-
-    @Test
-    fun customPolicyFiltersLiveEvents() =
-        runTest {
-            // Policy that only delivers events to authenticated sessions
-            val policy =
-                object : AuthPolicy {
-                    override fun acceptEvent(
-                        event: Event,
-                        authedPubkeys: Set<HexKey>,
-                    ) = PolicyResult.Accepted
-
-                    override fun acceptReq(
-                        filters: List<Filter>,
-                        authedPubkeys: Set<HexKey>,
-                    ) = ReqPolicyResult.Accepted()
-
-                    override fun acceptCount(
-                        filters: List<Filter>,
-                        authedPubkeys: Set<HexKey>,
-                    ) = PolicyResult.Accepted
-
-                    override fun canSendToSession(
-                        event: Event,
-                        authedPubkeys: Set<HexKey>,
-                    ) = authedPubkeys.isNotEmpty()
-                }
-
-            val dispatcher = UnconfinedTestDispatcher(testScheduler)
-            val store = EventStore(null)
-            val server = createServer(store = store, dispatcher = dispatcher, authPolicy = policy)
-
-            // Unauthenticated subscriber
-            val unauthCollector = MessageCollector()
-            val unauthSession = server.connect(unauthCollector.sendCallback)
-            unauthSession.processMessage("""["REQ","sub1",{"kinds":[1]}]""")
-            val countAfterEose = unauthCollector.messages.size
-
-            // Authenticated publisher
-            val pubCollector = MessageCollector()
-            val pubSession = server.connect(pubCollector.sendCallback)
-
-            // Publish an event
-            pubSession.insert(testEvent(hexId(1), kind = 1))
-
-            // Unauthenticated session should NOT receive the live event
-            assertEquals(countAfterEose, unauthCollector.messages.size)
-
            server.shutdown()
        }
 }