From 66d6bc448ff2b332e4f54269ab4ec68f45118f98 Mon Sep 17 00:00:00 2001
From: Jon Staab <shtaab@gmail.com>
Date: Fri, 27 Feb 2026 11:24:17 -0800
Subject: [PATCH] Prevent broadcasting protected events

---
 zooid/instance.go | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/zooid/instance.go b/zooid/instance.go
index e814b4a..ae9506e 100644
--- a/zooid/instance.go
+++ b/zooid/instance.go
@@ -227,7 +227,31 @@ func (instance *Instance) OnConnect(ctx context.Context) {
 }
 
 func (instance *Instance) PreventBroadcast(ws *khatru.WebSocket, filter nostr.Filter, event nostr.Event) bool {
-	return IsWriteOnlyEvent(event)
+	if !IsReadableEvent(event) {
+		return true
+	}
+
+	if instance.Groups.IsGroupEvent(event) {
+		for _, pubkey := range ws.AuthedPublicKeys {
+			if instance.Groups.CanRead(pubkey, event) {
+				return false
+			}
+		}
+
+		return true
+	}
+
+	if event.Kind == PUSH_SUBSCRIPTION {
+		for _, pubkey := range ws.AuthedPublicKeys {
+			if event.PubKey == pubkey {
+				return false
+			}
+		}
+
+		return true
+	}
+
+	return false
 }
 
 func (instance *Instance) StoreEvent(ctx context.Context, event nostr.Event) error {