khatru: fix possible race condition with authed keys.

khatru/handlers.go

@@ -322,8 +322,8 @@ func (rl *Relay) HandleWebsocket(w http.ResponseWriter, r *http.Request) {
 				case *nostr.AuthEnvelope:
 					wsBaseUrl := strings.Replace(rl.getBaseURL(r), "http", "ws", 1)
 					if pubkey, err := nip42.ValidateAuthEvent(env.Event, ws.Challenge, wsBaseUrl); err == nil {
-						total := len(ws.AuthedPublicKeys)
 						ws.authLock.Lock()
+						total := len(ws.AuthedPublicKeys)
 						if idx := slices.Index(ws.AuthedPublicKeys, pubkey); idx == -1 {
 							// this public key is not authenticated
 							if total < rl.MaxAuthenticatedClients {