fix: enforce auth requirement for REQ messages when require-auth=true

- REQ messages now properly rejected before authentication when
  require-auth=true (previously only protected kinds were checked)
- Updated unit test to explicitly set requireAuth=false for the
  "allow REQ without auth" test case
- Added "Message Authentication Requirements" section to README
  documenting which messages require auth and protected kinds
- Updated pom.xml: version 0.1.0, distribution management, repositories

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: tcheeric

README.md

@@ -83,6 +83,33 @@ mvn spring-boot:run
 5. On success: `["OK", "<event-id>", true, "authenticated as <pubkey>..."]`
 6. On failure: `["OK", "<event-id>", false, "<error>"]` and connection closes
 
+## Message Authentication Requirements
+
+The proxy enforces authentication based on message type and the `require-auth` setting:
+
+| Message Type | `require-auth=true` | `require-auth=false` |
+|--------------|---------------------|----------------------|
+| **AUTH**     | Allowed (for authentication) | Allowed |
+| **CLOSE**    | Allowed | Allowed |
+| **REQ**      | Requires auth | Allowed, unless querying protected kinds |
+| **EVENT**    | Requires auth | Requires auth |
+| **Other**    | Requires auth | Requires auth |
+
+### Protected Kinds
+
+When `require-auth=false`, REQ messages are still rejected if they query privacy-sensitive event kinds:
+
+- **NIP-04**: kind `4` (Legacy encrypted DMs)
+- **NIP-17**: kinds `14`, `15` (Private direct messages)
+- **NIP-29**: kind `39002` (Group members)
+- **NIP-37**: kinds `10013`, `31234` (Draft events)
+- **NIP-46**: kind `24133` (Nostr Remote Signing/Bunker)
+- **NIP-47**: kinds `23194`, `23195`, `23196`, `23197` (Wallet Connect)
+- **NIP-51**: kinds `10000`, `10050` (Mute list, DM relay preferences)
+- **NIP-59**: kinds `13`, `1059` (Gift Wraps/Seals)
+- **NIP-60**: kinds `7374`, `7375`, `7376`, `17375` (Cashu Wallet)
+- **NIP-61**: kinds `9321`, `10019` (Nutzaps)
+
 ## Access Control
 
 ### OPEN Mode (default)

pom.xml

@@ -14,7 +14,7 @@
 
     <groupId>xyz.tcheeric</groupId>
     <artifactId>nostr-auth-proxy</artifactId>
-    <version>1.0.0</version>
+    <version>0.1.0</version>
     <packaging>jar</packaging>
 
     <name>Nostr Auth Proxy</name>
@@ -28,17 +28,31 @@
         <awaitility.version>4.3.0</awaitility.version>
     </properties>
 
+    <distributionManagement>
+        <repository>
+            <id>reposilite-releases</id>
+            <url>https://maven.398ja.xyz/releases</url>
+        </repository>
+        <snapshotRepository>
+            <id>reposilite-snapshots</id>
+            <url>https://maven.398ja.xyz/snapshots</url>
+        </snapshotRepository>
+    </distributionManagement>
+
     <repositories>
         <repository>
-            <id>398ja-releases</id>
+            <id>central</id>
+            <url>https://repo.maven.apache.org/maven2</url>
+            <releases><enabled>true</enabled></releases>
+            <snapshots><enabled>false</enabled></snapshots>
+        </repository>
+        <repository>
+            <id>reposilite-releases</id>
             <url>https://maven.398ja.xyz/releases</url>
         </repository>
         <repository>
-            <id>398ja-snapshots</id>
+            <id>reposilite-snapshots</id>
             <url>https://maven.398ja.xyz/snapshots</url>
-            <snapshots>
-                <enabled>true</enabled>
-            </snapshots>
         </repository>
     </repositories>
 

src/main/java/xyz/tcheeric/nostr/authproxy/handler/AuthProxyWebSocketHandler.java

@@ -204,8 +204,11 @@ protected void handleTextMessage(WebSocketSession session, TextMessage message)
                     ensureUpstreamConnected(proxySession);
                     proxyToUpstream(proxySession, message);
                 } else if ("REQ".equals(messageType)) {
-                    // REQ requires auth if querying protected kinds
-                    if (reqContainsProtectedKinds(payload)) {
+                    // REQ requires auth if require-auth is enabled or if querying protected kinds
+                    if (properties.isRequireAuth()) {
+                        sendAuthError(proxySession, "auth-required",
+                                "AUTH required for REQ messages");
+                    } else if (reqContainsProtectedKinds(payload)) {
                         sendAuthError(proxySession, "auth-required",
                                 "Authentication required to query protected kinds (DMs, wallet data)");
                     } else {

src/test/java/xyz/tcheeric/nostr/authproxy/handler/AuthProxyWebSocketHandlerTest.java

@@ -232,11 +232,12 @@ void shouldRejectEventMessageBeforeAuth() throws Exception {
     }
 
     /**
-     * Tests that REQ (read) messages are allowed without authentication.
+     * Tests that REQ (read) messages are allowed without authentication when require-auth is disabled.
      */
     @Test
     void shouldAllowReqMessageWithoutAuth() throws Exception {
         // Given
+        properties.setRequireAuth(false);
         Nip42Challenge challenge = new Nip42Challenge(TEST_CHALLENGE, Instant.now().plusSeconds(300));
         ProxySession proxySession = new ProxySession(SESSION_ID, clientSession, challenge);
         WebSocketSession upstreamSession = mock(WebSocketSession.class);