feat(relayauth): reframe follows trust as relationship vs. message delivery

Restructure the two TRUSTED_FOLLOWS controls so they read as independent ideas
instead of a confusing read/write sub-toggle:

- The "My relays and people I follow" policy now trusts a followed user as any
  counterparty — reading their posts AND reaching them (DM/notification) — plus
  your own relays and joined venues. Reading your follows is no longer gated.
- The sub-toggle is repurposed to "Also log in to deliver my messages": trust a
  relay to send DMs, replies or notifications to anyone you're talking to, even
  people you don't follow.

Resolver: replace servesFollowed{Write,Read}Counterparty with a single
servesFollowedCounterparty, add servesWriteCounterparty (an inbox of anyone
you're messaging), and gate the latter behind the new
messageDeliveryTrustEnabled input. Rename the account setting
relayAuthTrustFollowsForReads -> relayAuthTrustMessageDelivery (+ pref key;
no migration needed, unreleased). The contextual prompt button moves from
read-post prompts to DM/notification prompts and now enables message delivery.
Resolver tests updated for the new inputs, including that the delivery toggle
is write-only and never auto-allows reading a stranger.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZjmYpgHP4pf79Sav5QT8a

amethyst/src/main/java/com/vitorpamplona/amethyst/LocalPreferences.kt

@@ -162,7 +162,7 @@ private object PrefKeys {
     const val ALWAYS_ON_NOTIFICATION_SERVICE = "always_on_notification_service"
     const val DEFAULT_RELAY_AUTH_POLICY = "default_relay_auth_policy"
     const val RELAY_GROUP_VIEW_MODE = "relay_group_view_mode"
-    const val RELAY_AUTH_TRUST_FOLLOWS_FOR_READS = "relay_auth_trust_follows_for_reads"
+    const val RELAY_AUTH_TRUST_MESSAGE_DELIVERY = "relay_auth_trust_message_delivery"
     const val SPLIT_NOTIFICATIONS_ENABLED = "split_notifications_enabled"
     const val SHOW_MESSAGES_IN_NOTIFICATIONS = "show_messages_in_notifications"
 
@@ -518,7 +518,7 @@ object LocalPreferences {
                     putBoolean(PrefKeys.ALWAYS_ON_NOTIFICATION_SERVICE, settings.alwaysOnNotificationService.value)
                     putString(PrefKeys.DEFAULT_RELAY_AUTH_POLICY, settings.defaultRelayAuthPolicy.value.name)
                     putString(PrefKeys.RELAY_GROUP_VIEW_MODE, settings.relayGroupViewMode.value.name)
-                    putBoolean(PrefKeys.RELAY_AUTH_TRUST_FOLLOWS_FOR_READS, settings.relayAuthTrustFollowsForReads.value)
+                    putBoolean(PrefKeys.RELAY_AUTH_TRUST_MESSAGE_DELIVERY, settings.relayAuthTrustMessageDelivery.value)
                     putBoolean(PrefKeys.SPLIT_NOTIFICATIONS_ENABLED, settings.splitNotificationsEnabled.value)
                     putBoolean(PrefKeys.SHOW_MESSAGES_IN_NOTIFICATIONS, settings.showMessagesInNotifications.value)
                     // Any account that reaches a save has its notification filter in its
@@ -640,7 +640,7 @@ object LocalPreferences {
                             ?.let { runCatching { RelayAuthPolicy.valueOf(it) }.getOrNull() }
                             ?: RelayAuthPolicy.TRUSTED_FOLLOWS
                     val relayGroupViewMode = RelayGroupViewMode.fromName(getString(PrefKeys.RELAY_GROUP_VIEW_MODE, null))
-                    val relayAuthTrustFollowsForReads = getBoolean(PrefKeys.RELAY_AUTH_TRUST_FOLLOWS_FOR_READS, false)
+                    val relayAuthTrustMessageDelivery = getBoolean(PrefKeys.RELAY_AUTH_TRUST_MESSAGE_DELIVERY, false)
                     val splitNotificationsEnabled = getBoolean(PrefKeys.SPLIT_NOTIFICATIONS_ENABLED, false)
                     val showMessagesInNotifications = getBoolean(PrefKeys.SHOW_MESSAGES_IN_NOTIFICATIONS, true)
                     val hasDonatedInVersion = getStringSet(PrefKeys.HAS_DONATED_IN_VERSION, null) ?: setOf()
@@ -850,7 +850,7 @@ object LocalPreferences {
                         alwaysOnNotificationService = MutableStateFlow(alwaysOnNotificationService),
                         defaultRelayAuthPolicy = MutableStateFlow(defaultRelayAuthPolicy),
                         relayGroupViewMode = MutableStateFlow(relayGroupViewMode),
-                        relayAuthTrustFollowsForReads = MutableStateFlow(relayAuthTrustFollowsForReads),
+                        relayAuthTrustMessageDelivery = MutableStateFlow(relayAuthTrustMessageDelivery),
                         splitNotificationsEnabled = MutableStateFlow(splitNotificationsEnabled),
                         showMessagesInNotifications = MutableStateFlow(showMessagesInNotifications),
                         backupUserMetadata = latestUserMetadataResolved,

amethyst/src/main/java/com/vitorpamplona/amethyst/model/AccountSettings.kt

@@ -275,7 +275,7 @@ class AccountSettings(
     val callsEnabled: MutableStateFlow<Boolean> = MutableStateFlow(true),
     val defaultRelayAuthPolicy: MutableStateFlow<RelayAuthPolicy> = MutableStateFlow(RelayAuthPolicy.TRUSTED_FOLLOWS),
     val relayGroupViewMode: MutableStateFlow<RelayGroupViewMode> = MutableStateFlow(RelayGroupViewMode.DEFAULT),
-    val relayAuthTrustFollowsForReads: MutableStateFlow<Boolean> = MutableStateFlow(false),
+    val relayAuthTrustMessageDelivery: MutableStateFlow<Boolean> = MutableStateFlow(false),
 ) : EphemeralChatRepository,
     RelayGroupRepository,
     PublicChatListRepository {
@@ -1526,9 +1526,9 @@ class AccountSettings(
         }
     }
 
-    fun changeRelayAuthTrustFollowsForReads(enabled: Boolean) {
-        if (relayAuthTrustFollowsForReads.value != enabled) {
-            relayAuthTrustFollowsForReads.tryEmit(enabled)
+    fun changeRelayAuthTrustMessageDelivery(enabled: Boolean) {
+        if (relayAuthTrustMessageDelivery.value != enabled) {
+            relayAuthTrustMessageDelivery.tryEmit(enabled)
             saveAccountSettings()
         }
     }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/authCommand/compose/AccountDataSourceSubscription.kt

@@ -72,7 +72,7 @@ fun RelayAuthSubscription(
                         venueId in account.communityList.flowSet.value ||
                         venueOwnerPubkey(venueId)?.let { it in account.allFollows.flow.value.authors } == true
                 },
-                readTrustEnabled = { account.settings.relayAuthTrustFollowsForReads.value },
+                messageDeliveryTrustEnabled = { account.settings.relayAuthTrustMessageDelivery.value },
             )
         }
 

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/authCommand/compose/RelayAuthPromptHost.kt

@@ -175,18 +175,19 @@ private fun RelayAuthPromptDialog(
                     onClick = { onChoice(UserAuthChoice.ALLOW_ONCE) },
                     modifier = Modifier.fillMaxWidth(),
                 ) { Text(stringRes(R.string.relay_auth_allow_once)) }
-                // For a "download their posts" prompt, offer the broad rule: trust every relay that
-                // serves people you follow, so these read prompts stop appearing. Read-trust only
-                // applies under TRUSTED_FOLLOWS, so set both to make the promise hold on any policy.
-                if (primary?.kind == AuthPurposeKind.READ_OUTBOX) {
+                // For a DM/notification prompt, offer the broad rule: always log in to deliver my
+                // messages to whoever I'm talking to, so these prompts stop appearing. That trust
+                // only applies under TRUSTED_FOLLOWS, so set both to make the promise hold on any
+                // policy.
+                if (primary?.kind == AuthPurposeKind.SEND_DM || primary?.kind == AuthPurposeKind.NOTIFY_INBOX) {
                     FilledTonalButton(
                         onClick = {
                             accountViewModel.account.settings.changeDefaultRelayAuthPolicy(RelayAuthPolicy.TRUSTED_FOLLOWS)
-                            accountViewModel.account.settings.changeRelayAuthTrustFollowsForReads(true)
+                            accountViewModel.account.settings.changeRelayAuthTrustMessageDelivery(true)
                             onChoice(UserAuthChoice.ALLOW_ONCE)
                         },
                         modifier = Modifier.fillMaxWidth(),
-                    ) { Text(stringRes(R.string.relay_auth_always_allow_follows)) }
+                    ) { Text(stringRes(R.string.relay_auth_always_deliver)) }
                 }
                 FilledTonalButton(
                     onClick = { onChoice(UserAuthChoice.ALWAYS_ALLOW) },

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/authCommand/model/RelayAuthPermissionLedger.kt

@@ -44,7 +44,7 @@ class RelayAuthPermissionLedger(
     val isBlocked: (String) -> Boolean = { false },
     val isFollowed: (String) -> Boolean = { false },
     val isTrustedVenue: (String) -> Boolean = { false },
-    val readTrustEnabled: () -> Boolean = { false },
+    val messageDeliveryTrustEnabled: () -> Boolean = { false },
 ) {
     /** The authorization verdict for [ctx], taking the challenge's purpose into account. */
     suspend fun decide(ctx: RelayAuthContext): RelayAuthVerdict {
@@ -54,21 +54,23 @@ class RelayAuthPermissionLedger(
                 isBlocked = isBlocked(ctx.relayUrl),
                 policy = globalPolicy(),
                 isInMyRelayList = isInMyRelayList(ctx.relayUrl),
-                servesFollowedWriteCounterparty =
+                // A followed user is a counterparty here, whether we're reading them (outbox) or
+                // reaching them (DM / notification inbox).
+                servesFollowedCounterparty =
+                    ctx.purposes.any { p -> p.counterparties.any(isFollowed) },
+                // This relay is an inbox for someone we're messaging (DM or notification), follow
+                // or not — the target of the "deliver my messages" toggle.
+                servesWriteCounterparty =
                     ctx.purposes.any { p ->
                         (p.kind == AuthPurposeKind.SEND_DM || p.kind == AuthPurposeKind.NOTIFY_INBOX) &&
-                            p.counterparties.any(isFollowed)
-                    },
-                servesFollowedReadCounterparty =
-                    ctx.purposes.any { p ->
-                        p.kind == AuthPurposeKind.READ_OUTBOX && p.counterparties.any(isFollowed)
+                            p.counterparties.isNotEmpty()
                     },
                 servesTrustedVenue =
                     ctx.purposes.any { p ->
                         (p.kind == AuthPurposeKind.POST_VENUE || p.kind == AuthPurposeKind.READ_VENUE) &&
                             p.venues.any(isTrustedVenue)
                     },
-                readTrustEnabled = readTrustEnabled(),
+                messageDeliveryTrustEnabled = messageDeliveryTrustEnabled(),
                 hasAttributablePurpose =
                     ctx.purposes.any {
                         it.kind == AuthPurposeKind.MY_OWN_RELAY ||

amethyst/src/main/java/com/vitorpamplona/amethyst/ui/screen/loggedIn/relayauth/RelayAuthSettingsScreen.kt

@@ -172,25 +172,25 @@ fun RelayAuthSettingsScreen(
             }
 
             if (globalPolicy == RelayAuthPolicy.TRUSTED_FOLLOWS) {
-                val trustReads by account.settings.relayAuthTrustFollowsForReads.collectAsState()
+                val trustDelivery by account.settings.relayAuthTrustMessageDelivery.collectAsState()
                 Row(
                     modifier = Modifier.fillMaxWidth().padding(top = 8.dp),
                     verticalAlignment = Alignment.CenterVertically,
                 ) {
                     Column(modifier = Modifier.weight(1f)) {
                         Text(
-                            text = stringResource(R.string.relay_auth_trust_reads),
+                            text = stringResource(R.string.relay_auth_trust_delivery),
                             style = MaterialTheme.typography.bodyLarge,
                         )
                         Text(
-                            text = stringResource(R.string.relay_auth_trust_reads_desc),
+                            text = stringResource(R.string.relay_auth_trust_delivery_desc),
                             style = MaterialTheme.typography.bodyMedium,
                             color = MaterialTheme.colorScheme.onSurfaceVariant,
                         )
                     }
                     Switch(
-                        checked = trustReads,
-                        onCheckedChange = { account.settings.changeRelayAuthTrustFollowsForReads(it) },
+                        checked = trustDelivery,
+                        onCheckedChange = { account.settings.changeRelayAuthTrustMessageDelivery(it) },
                     )
                 }
             }

amethyst/src/main/res/values/strings.xml

@@ -827,8 +827,8 @@
     <string name="relay_auth_policy_if_in_my_list_desc">Only authenticate with relays in your relay list</string>
     <string name="relay_auth_policy_trusted_follows">My relays and people I follow</string>
     <string name="relay_auth_policy_trusted_follows_desc">Also authenticate with relays that serve people you follow, such as sending a message to a friend. You\'ll be asked about anyone else.</string>
-    <string name="relay_auth_trust_reads">Also log in to read their posts</string>
-    <string name="relay_auth_trust_reads_desc">On its own, the option above only logs in to send messages or notifications to people you follow. Turn this on to also log in when downloading their posts.</string>
+    <string name="relay_auth_trust_delivery">Also log in to deliver my messages</string>
+    <string name="relay_auth_trust_delivery_desc">On its own, the option above only logs in for people you follow. Turn this on to also log in to send DMs, replies or notifications to anyone you\'re talking to, even if you don\'t follow them.</string>
     <string name="relay_auth_prompt_title">Confirm it\'s you to this relay?</string>
     <string name="relay_auth_prompt_message">This relay wants to confirm it\'s really you first. Its operator will see which account you are.</string>
     <!-- Action-aware titles: %1$s is the person (or "Alice and others"). -->
@@ -853,7 +853,7 @@
     <string name="relay_auth_reason_my_own_relay">Connect to your own relay</string>
     <string name="relay_auth_allow_once">Allow once</string>
     <string name="relay_auth_always_allow">Always allow this relay</string>
-    <string name="relay_auth_always_allow_follows">Always allow my follows\' relays</string>
+    <string name="relay_auth_always_deliver">Always deliver my messages</string>
     <string name="relay_auth_block">Block this relay</string>
     <string name="relay_auth_per_relay_overrides">Per-relay overrides</string>
     <string name="relay_auth_forget">Forget</string>

commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/relayauth/RelayAuthResolver.kt

@@ -29,13 +29,14 @@ package com.vitorpamplona.amethyst.commons.relayauth
  * @param isBlocked the relay is on the user's blocked-relay list (kind 10006).
  * @param policy the global [RelayAuthPolicy].
  * @param isInMyRelayList the relay is in the user's own relay list.
- * @param servesFollowedWriteCounterparty a followed user is a counterparty of a *write* purpose
- *   (send DM / deliver notification) for this relay.
- * @param servesFollowedReadCounterparty a followed user is a counterparty of a *read* purpose
- *   (download their outbox) for this relay.
+ * @param servesFollowedCounterparty a user the person follows is a counterparty for this relay —
+ *   whether they're reading that user (their outbox) or reaching them (DM / notification inbox).
+ * @param servesWriteCounterparty this relay serves the inbox of *someone the user is sending to*
+ *   (a DM or a notification), whether or not that person is followed.
  * @param servesTrustedVenue this relay hosts a venue (public chat, community, or live stream) the
  *   user has joined, or whose owner they follow. Trusts both reading and posting to it.
- * @param readTrustEnabled the "also trust follows' outboxes when reading" sub-toggle.
+ * @param messageDeliveryTrustEnabled the "also log in to deliver my messages to anyone I'm talking
+ *   to" toggle, which extends trust to [servesWriteCounterparty] relays beyond the follow graph.
  * @param hasAttributablePurpose we know *why* this relay wants auth (so a prompt can explain it).
  *   When false, an unresolved challenge is denied silently rather than prompting.
  */
@@ -44,10 +45,10 @@ data class RelayAuthInputs(
     val isBlocked: Boolean,
     val policy: RelayAuthPolicy,
     val isInMyRelayList: Boolean,
-    val servesFollowedWriteCounterparty: Boolean,
-    val servesFollowedReadCounterparty: Boolean,
+    val servesFollowedCounterparty: Boolean,
+    val servesWriteCounterparty: Boolean,
     val servesTrustedVenue: Boolean,
-    val readTrustEnabled: Boolean,
+    val messageDeliveryTrustEnabled: Boolean,
     val hasAttributablePurpose: Boolean,
 )
 
@@ -61,8 +62,9 @@ data class RelayAuthInputs(
  *    - [RelayAuthPolicy.ALWAYS] → ALLOW
  *    - [RelayAuthPolicy.IF_IN_MY_LIST] → ALLOW if in my list, else fall through
  *    - [RelayAuthPolicy.TRUSTED_FOLLOWS] → ALLOW if in my list, a venue the user joined/follows is
- *      served, a followed counterparty is served for a write purpose (DM/notification), or (when
- *      [RelayAuthInputs.readTrustEnabled]) for a read purpose; else fall through
+ *      served, a followed user is a counterparty (reading them or reaching them), or (when
+ *      [RelayAuthInputs.messageDeliveryTrustEnabled]) the relay serves the inbox of anyone the user
+ *      is messaging; else fall through
  * 4. Fall-through → [RelayAuthVerdict.ASK] when the purpose is known, otherwise DENY.
  */
 object RelayAuthResolver {
@@ -84,8 +86,8 @@ object RelayAuthResolver {
             RelayAuthPolicy.TRUSTED_FOLLOWS ->
                 if (inputs.isInMyRelayList ||
                     inputs.servesTrustedVenue ||
-                    inputs.servesFollowedWriteCounterparty ||
-                    (inputs.readTrustEnabled && inputs.servesFollowedReadCounterparty)
+                    inputs.servesFollowedCounterparty ||
+                    (inputs.messageDeliveryTrustEnabled && inputs.servesWriteCounterparty)
                 ) {
                     RelayAuthVerdict.ALLOW
                 } else {

commons/src/commonTest/kotlin/com/vitorpamplona/amethyst/commons/relayauth/RelayAuthResolverTest.kt

@@ -29,20 +29,20 @@ class RelayAuthResolverTest {
         isBlocked: Boolean = false,
         policy: RelayAuthPolicy = RelayAuthPolicy.TRUSTED_FOLLOWS,
         isInMyRelayList: Boolean = false,
-        servesFollowedWriteCounterparty: Boolean = false,
-        servesFollowedReadCounterparty: Boolean = false,
+        servesFollowedCounterparty: Boolean = false,
+        servesWriteCounterparty: Boolean = false,
         servesTrustedVenue: Boolean = false,
-        readTrustEnabled: Boolean = false,
+        messageDeliveryTrustEnabled: Boolean = false,
         hasAttributablePurpose: Boolean = true,
     ) = RelayAuthInputs(
         storedOverride = storedOverride,
         isBlocked = isBlocked,
         policy = policy,
         isInMyRelayList = isInMyRelayList,
-        servesFollowedWriteCounterparty = servesFollowedWriteCounterparty,
-        servesFollowedReadCounterparty = servesFollowedReadCounterparty,
+        servesFollowedCounterparty = servesFollowedCounterparty,
+        servesWriteCounterparty = servesWriteCounterparty,
         servesTrustedVenue = servesTrustedVenue,
-        readTrustEnabled = readTrustEnabled,
+        messageDeliveryTrustEnabled = messageDeliveryTrustEnabled,
         hasAttributablePurpose = hasAttributablePurpose,
     )
 
@@ -70,7 +70,7 @@ class RelayAuthResolverTest {
 
     @Test
     fun neverAndAlwaysAreUnconditional() {
-        assertEquals(RelayAuthVerdict.DENY, resolve(inputs(policy = RelayAuthPolicy.NEVER, servesFollowedWriteCounterparty = true)))
+        assertEquals(RelayAuthVerdict.DENY, resolve(inputs(policy = RelayAuthPolicy.NEVER, servesFollowedCounterparty = true)))
         assertEquals(RelayAuthVerdict.ALLOW, resolve(inputs(policy = RelayAuthPolicy.ALWAYS, hasAttributablePurpose = false)))
     }
 
@@ -81,24 +81,35 @@ class RelayAuthResolverTest {
     }
 
     @Test
-    fun trustedFollowsAllowsWriteToFollowedCounterparty() {
-        // Sending a DM / delivering a notification to someone I follow -> auto-auth.
-        assertEquals(RelayAuthVerdict.ALLOW, resolve(inputs(servesFollowedWriteCounterparty = true)))
+    fun trustedFollowsAllowsAnyFollowedCounterparty() {
+        // Reading a followed author's outbox OR reaching them (DM/notification) -> auto-auth,
+        // independent of the delivery toggle.
+        assertEquals(RelayAuthVerdict.ALLOW, resolve(inputs(servesFollowedCounterparty = true)))
     }
 
     @Test
-    fun trustedFollowsDoesNotAutoAllowReadUnlessSubToggleOn() {
-        // Reading a followed author's outbox: prompts by default (decision D, conservative)...
-        assertEquals(RelayAuthVerdict.ASK, resolve(inputs(servesFollowedReadCounterparty = true, readTrustEnabled = false)))
-        // ...auto-auths only when the read sub-toggle is enabled.
-        assertEquals(RelayAuthVerdict.ALLOW, resolve(inputs(servesFollowedReadCounterparty = true, readTrustEnabled = true)))
+    fun trustedFollowsAsksToMessageAStrangerUnlessDeliveryToggleOn() {
+        // Sending to someone I don't follow: prompts by default...
+        assertEquals(RelayAuthVerdict.ASK, resolve(inputs(servesWriteCounterparty = true, messageDeliveryTrustEnabled = false)))
+        // ...auto-auths only when the "deliver my messages" toggle is enabled.
+        assertEquals(RelayAuthVerdict.ALLOW, resolve(inputs(servesWriteCounterparty = true, messageDeliveryTrustEnabled = true)))
+    }
+
+    @Test
+    fun deliveryToggleDoesNotCoverReadingAStranger() {
+        // The delivery toggle is write-only: reading a non-followed author (no write counterparty)
+        // still prompts even with the toggle on.
+        assertEquals(
+            RelayAuthVerdict.ASK,
+            resolve(inputs(servesWriteCounterparty = false, servesFollowedCounterparty = false, messageDeliveryTrustEnabled = true)),
+        )
     }
 
     @Test
     fun trustedFollowsAllowsVenueYouJoinedOrFollow() {
         // A public chat / community / live stream you've joined (or whose owner you follow) —
-        // auto-auth for both reading and posting, regardless of the read sub-toggle.
-        assertEquals(RelayAuthVerdict.ALLOW, resolve(inputs(servesTrustedVenue = true, readTrustEnabled = false)))
+        // auto-auth for both reading and posting, regardless of the delivery toggle.
+        assertEquals(RelayAuthVerdict.ALLOW, resolve(inputs(servesTrustedVenue = true, messageDeliveryTrustEnabled = false)))
     }
 
     @Test