https://github.com/mleku/realy/blob/dev/realy/handlers.go#L138 this is where auth is required for an EVENT

https://github.com/mleku/realy/blob/dev/realy/handlers.go#L391 for COUNT

here i do special handling to permit filters that match on "directory" kinds https://github.com/mleku/realy/blob/dev/realy/handlers.go#L138

that is a special feature i have made that strips filters of all but a list of kinds (user metadata, follow, mute, relay lists, and some others i forget) https://github.com/mleku/realy/blob/dev/realy/handlers.go#L138

it processes the filter that has been stripped of non-directory kinds and then after sending back the result it sends an auth request... this is a kind of "helping the network" measure, to make a bridge between private relays, since clients are almost always configured with several if not a dozen relays it allows people to find each other even if they literally only use this one relay - if more clients implement outbox properly, now that realy automatically allows all permitted users who are able to access the relay to allow their follows as well, and they can then post their replies to the relay, and prevent the lost poast problem