refactor(quartz/relay): move authenticatedUsers off IRelayPolicy to a marker

Keep the universal policy interface free of NIP-42: instead of a default
authenticatedUsers on IRelayPolicy, add an opt-in AuthScopedPolicy mixin that
only FullAuthPolicy (and PolicyStack, which unions its auth-tracking members)
implements. RequestContext.authenticatedUsers resolves it via an `as?
AuthScopedPolicy` downcast, defaulting to empty — so non-auth relays carry no
auth concept, and the accessor now earns its keep by encapsulating that cast
(ctx.policy is IRelayPolicy and no longer exposes the set directly).

quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip01Core/relay/server/backend/RequestContext.kt

@@ -21,6 +21,7 @@
 package com.vitorpamplona.quartz.nip01Core.relay.server.backend
 
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.relay.server.policies.AuthScopedPolicy
 import com.vitorpamplona.quartz.nip01Core.relay.server.policies.IRelayPolicy
 
 /**
@@ -61,7 +62,8 @@ interface RequestContext {
     /**
      * The pubkeys that have authenticated on this connection via NIP-42, read
      * live from [policy]. Empty when the connection is unauthenticated or the
-     * policy does not implement auth.
+     * policy does not track auth (i.e. is not an [AuthScopedPolicy]). This
+     * accessor encapsulates that downcast so a source needn't repeat it.
      */
-    val authenticatedUsers: Set<HexKey> get() = policy.authenticatedUsers
+    val authenticatedUsers: Set<HexKey> get() = (policy as? AuthScopedPolicy)?.authenticatedUsers ?: emptySet()
 }

quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip01Core/relay/server/policies/AuthScopedPolicy.kt

@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.quartz.nip01Core.relay.server.policies
+
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+
+/**
+ * Opt-in mixin for the policies that actually track NIP-42 authentication, so
+ * the auth concept stays out of the universal [IRelayPolicy]. A relay that does
+ * no auth never implements this; only [FullAuthPolicy] (and [PolicyStack], which
+ * unions any auth-tracking members) do.
+ *
+ * The engine surfaces it to the data plane through
+ * [com.vitorpamplona.quartz.nip01Core.relay.server.backend.RequestContext.authenticatedUsers],
+ * which downcasts the connection's policy to this interface — so a source sees
+ * the authenticated pubkey(s) without the base policy interface knowing about
+ * NIP-42.
+ */
+interface AuthScopedPolicy {
+    /** The pubkeys that have authenticated on this connection via NIP-42. */
+    val authenticatedUsers: Set<HexKey>
+}

quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip01Core/relay/server/policies/FullAuthPolicy.kt

@@ -53,7 +53,8 @@ import com.vitorpamplona.quartz.utils.TimeUtils
  */
 open class FullAuthPolicy(
     val relay: NormalizedRelayUrl,
-) : IRelayPolicy {
+) : IRelayPolicy,
+    AuthScopedPolicy {
     /** The challenge string sent to this client for NIP-42 authentication. */
     val challenge: String = RandomInstance.randomChars(32)
 

quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip01Core/relay/server/policies/IRelayPolicy.kt

@@ -34,16 +34,6 @@ import com.vitorpamplona.quartz.nip42RelayAuth.RelayAuthEvent
  * Defines custom behavior for this relay.
  */
 interface IRelayPolicy {
-    /**
-     * The pubkeys this connection has authenticated as via NIP-42. The engine
-     * surfaces this to the data plane through
-     * [com.vitorpamplona.quartz.nip01Core.relay.server.backend.RequestContext.authenticatedUsers]
-     * so a source can tailor results to the caller. The default is empty — a
-     * policy that does no auth (e.g. [EmptyPolicy]) never authenticates anyone;
-     * [FullAuthPolicy] overrides it with the set it commits on a successful AUTH.
-     */
-    val authenticatedUsers: Set<HexKey> get() = emptySet()
-
     fun onConnect(send: (Message) -> Unit)
 
     /**

quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip01Core/relay/server/policies/PolicyStack.kt

@@ -32,12 +32,13 @@ import com.vitorpamplona.quartz.nip42RelayAuth.RelayAuthEvent
 
 class PolicyStack(
     vararg policies: IRelayPolicy,
-) : IRelayPolicy {
+) : IRelayPolicy,
+    AuthScopedPolicy {
     val policies = policies.toList()
 
-    /** Union of the authenticated pubkeys across every composed policy. */
+    /** Union of the authenticated pubkeys across the auth-tracking members. */
     override val authenticatedUsers: Set<HexKey>
-        get() = policies.flatMapTo(mutableSetOf()) { it.authenticatedUsers }
+        get() = policies.filterIsInstance<AuthScopedPolicy>().flatMapTo(mutableSetOf()) { it.authenticatedUsers }
 
     override fun onConnect(send: (Message) -> Unit) {
         policies.forEach { it.onConnect(send) }