fix(relay): record the NIP-OA owner for direct members on closed relays

.github/workflows/ci.yml

@@ -722,6 +722,22 @@ jobs:
             --run-ignored ignored-only
         env:
           DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+      - name: NIP-OA owner materialization gate tests
+        # Call-site integration for agent→owner materialization: a direct
+        # member's attestation is recorded on a closed relay, while a
+        # non-member owner and an expired attestation are refused. Selected by
+        # name because these span two modules (api::bridge, handlers::auth) and
+        # nothing else runs this crate's default test set — a test added here
+        # without this step would never execute. Needs Redis as well as
+        # Postgres: the submit path takes the NIP-98 replay guard.
+        run: |
+          cargo nextest run \
+            --archive-file target/ci/backend-integration-tests.tar.zst \
+            -E 'package(buzz-relay) and test(/nip_oa_owner_/)' \
+            --run-ignored ignored-only
+        env:
+          DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+          REDIS_URL: redis://localhost:6379
       - name: NIP-ER reminder e2e
         # Feature e2e for NIP-ER (Event Reminders, kind:30300): write-path
         # validation, author-only read filtering, and scheduler delivery against

crates/buzz-auth/src/lib.rs

@@ -72,10 +72,18 @@ pub struct AuthContext {
     pub channel_ids: Option<Vec<uuid::Uuid>>,
     /// How the connection was authenticated.
     pub auth_method: AuthMethod,
-    /// NIP-OA verified owner pubkey (if authenticated via owner attestation).
+    /// NIP-OA verified owner pubkey.
     ///
-    /// `None` for direct relay members or non-NIP-OA auth paths.
-    /// Set by the relay membership gate when NIP-OA fallback succeeds.
+    /// Set for any caller whose presented attestation resolved to a trusted
+    /// owner — including a direct relay member, which is why membership alone
+    /// no longer implies `None`. On a closed relay the claimed owner must also
+    /// be a relay member; an expired or not-yet-valid attestation resolves to
+    /// `None`.
+    ///
+    /// `None` for non-NIP-OA auth paths, and whenever the attestation could not
+    /// be trusted. Note this field selects the agent rate class in
+    /// `connection.rs`, so it must never be populated from an unverified or
+    /// untrusted owner.
     pub agent_owner_pubkey: Option<nostr::PublicKey>,
 }