Calling relay.Auth() immediately after RelayConnect signed an auth event
with an empty challenge tag. go-nostr keeps the relay's challenge on an
unexported field populated by its reader goroutine when the AUTH envelope
arrives, so the value is not yet set at connect time, and relays reject
the resulting event.
Subscribe first and run the handshake only once the relay answers
"auth-required". That guarantees the challenge has been read: the CLOSED
envelope is processed after AUTH on the relay's single reader goroutine,
and receiving it over a channel establishes the happens-before edge that
makes the read safe.
A second rejection after authenticating is a permissions failure rather
than a mistimed handshake, so it fails instead of retrying. Both waits
are bounded by a 15s timeout, and relays that accept without auth still
work via EndOfStoredEvents.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
a3dd7fca24
