Working on API

IMPLEMENT_API.md

@@ -0,0 +1,513 @@
+# Implementation Plan: Enhanced Admin Event API Structure
+
+## Current Issue
+
+The current admin event routing at [`main.c:3248-3268`](src/main.c:3248) has a security vulnerability:
+
+```c
+if (event_kind == 23455 || event_kind == 23456) {
+    // Admin event processing
+    int admin_result = process_admin_event_in_config(event, admin_error, sizeof(admin_error), wsi);
+} else {
+    // Regular event storage and broadcasting
+}
+```
+
+**Problem**: Any event with these kinds gets routed to admin processing, regardless of authorization. This allows unauthorized users to send admin events that could be processed as legitimate admin commands.
+
+**Note**: Event kinds 33334 and 33335 are no longer used and have been removed from the admin event routing.
+
+## Required Security Enhancement
+
+Admin events must be validated for proper authorization BEFORE routing to admin processing:
+
+1. **Relay Public Key Check**: Event must have a `p` tag equal to the relay's public key
+2. **Admin Signature Check**: Event must be signed by an authorized admin private key
+3. **Fallback to Regular Processing**: If authorization fails, treat as regular event (not admin event)
+
+## Implementation Plan
+
+### Phase 1: Add Admin Authorization Validation
+
+#### 1.1 Create Consolidated Admin Authorization Function
+**Location**: [`src/main.c`](src/main.c) or [`src/config.c`](src/config.c)
+
+```c
+/**
+ * Consolidated admin event authorization validator
+ * Implements defense-in-depth security for admin events
+ *
+ * @param event - The event to validate for admin authorization
+ * @param error_message - Buffer for detailed error messages
+ * @param error_size - Size of error message buffer
+ * @return 0 if authorized, -1 if unauthorized, -2 if validation error
+ */
+int is_authorized_admin_event(cJSON* event, char* error_message, size_t error_size) {
+    if (!event) {
+        snprintf(error_message, error_size, "admin_auth: null event");
+        return -2;
+    }
+    
+    // Extract event components
+    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    
+    if (!kind_obj || !pubkey_obj || !tags_obj) {
+        snprintf(error_message, error_size, "admin_auth: missing required fields");
+        return -2;
+    }
+    
+    // Validation Layer 1: Kind Check
+    int event_kind = (int)cJSON_GetNumberValue(kind_obj);
+    if (event_kind != 23455 && event_kind != 23456) {
+        snprintf(error_message, error_size, "admin_auth: not an admin event kind");
+        return -1;
+    }
+    
+    // Validation Layer 2: Relay Targeting Check
+    const char* relay_pubkey = get_config_value("relay_pubkey");
+    if (!relay_pubkey) {
+        snprintf(error_message, error_size, "admin_auth: relay pubkey not configured");
+        return -2;
+    }
+    
+    // Check for 'p' tag targeting this relay
+    int has_relay_target = 0;
+    if (cJSON_IsArray(tags_obj)) {
+        cJSON* tag = NULL;
+        cJSON_ArrayForEach(tag, tags_obj) {
+            if (cJSON_IsArray(tag) && cJSON_GetArraySize(tag) >= 2) {
+                cJSON* tag_name = cJSON_GetArrayItem(tag, 0);
+                cJSON* tag_value = cJSON_GetArrayItem(tag, 1);
+                
+                if (cJSON_IsString(tag_name) && cJSON_IsString(tag_value)) {
+                    const char* name = cJSON_GetStringValue(tag_name);
+                    const char* value = cJSON_GetStringValue(tag_value);
+                    
+                    if (strcmp(name, "p") == 0 && strcmp(value, relay_pubkey) == 0) {
+                        has_relay_target = 1;
+                        break;
+                    }
+                }
+            }
+        }
+    }
+    
+    if (!has_relay_target) {
+        // Admin event for different relay - not unauthorized, just not for us
+        snprintf(error_message, error_size, "admin_auth: admin event for different relay");
+        return -1;
+    }
+    
+    // Validation Layer 3: Admin Signature Check (only if targeting this relay)
+    const char* event_pubkey = cJSON_GetStringValue(pubkey_obj);
+    if (!event_pubkey) {
+        snprintf(error_message, error_size, "admin_auth: invalid pubkey format");
+        return -2;
+    }
+    
+    const char* admin_pubkey = get_config_value("admin_pubkey");
+    if (!admin_pubkey || strcmp(event_pubkey, admin_pubkey) != 0) {
+        // This is the ONLY case where we log as "Unauthorized admin event attempt"
+        // because it's targeting THIS relay but from wrong admin
+        snprintf(error_message, error_size, "admin_auth: unauthorized admin for this relay");
+        log_warning("SECURITY: Unauthorized admin event attempt for this relay");
+        return -1;
+    }
+    
+    // All validation layers passed
+    log_info("ADMIN: Admin event authorized");
+    return 0;
+}
+
+```
+
+#### 1.2 Update Event Routing Logic
+**Location**: [`main.c:3248`](src/main.c:3248)
+
+```c
+// Current problematic code:
+if (event_kind == 23455 || event_kind == 23456) {
+    // Admin event processing
+    int admin_result = process_admin_event_in_config(event, admin_error, sizeof(admin_error), wsi);
+} else {
+    // Regular event storage and broadcasting
+}
+
+// Enhanced secure code with consolidated authorization:
+if (result == 0) {
+    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+    if (kind_obj && cJSON_IsNumber(kind_obj)) {
+        int event_kind = (int)cJSON_GetNumberValue(kind_obj);
+        
+        // Check if this is an admin event
+        if (event_kind == 23455 || event_kind == 23456) {
+            // Use consolidated authorization check
+            char auth_error[512] = {0};
+            int auth_result = is_authorized_admin_event(event, auth_error, sizeof(auth_error));
+            
+            if (auth_result == 0) {
+                // Authorized admin event - process through admin API
+                char admin_error[512] = {0};
+                int admin_result = process_admin_event_in_config(event, admin_error, sizeof(admin_error), wsi);
+                
+                if (admin_result != 0) {
+                    result = -1;
+                    strncpy(error_message, admin_error, sizeof(error_message) - 1);
+                }
+                // Admin events are NOT broadcast to subscriptions
+            } else {
+                // Unauthorized admin event - treat as regular event
+                log_warning("Unauthorized admin event treated as regular event");
+                if (store_event(event) != 0) {
+                    result = -1;
+                    strncpy(error_message, "error: failed to store event", sizeof(error_message) - 1);
+                } else {
+                    broadcast_event_to_subscriptions(event);
+                }
+            }
+        } else {
+            // Regular event - normal processing
+            if (store_event(event) != 0) {
+                result = -1;
+                strncpy(error_message, "error: failed to store event", sizeof(error_message) - 1);
+            } else {
+                broadcast_event_to_subscriptions(event);
+            }
+        }
+    }
+}
+```
+
+### Phase 2: Enhanced Admin Event Processing
+
+#### 2.1 Admin Event Validation in Config System
+**Location**: [`src/config.c`](src/config.c) - [`process_admin_event_in_config()`](src/config.c:2065)
+
+Add additional validation within the admin processing function:
+
+```c
+int process_admin_event_in_config(cJSON* event, char* error_buffer, size_t error_buffer_size, struct lws* wsi) {
+    // Double-check authorization (defense in depth)
+    if (!is_authorized_admin_event(event)) {
+        snprintf(error_buffer, error_buffer_size, "unauthorized: not a valid admin event");
+        return -1;
+    }
+    
+    // Continue with existing admin event processing...
+    // ... rest of function unchanged
+}
+```
+
+#### 2.2 Logging and Monitoring
+Add comprehensive logging for admin event attempts:
+
+```c
+// In the routing logic - enhanced logging
+cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+int event_kind = kind_obj ? cJSON_GetNumberValue(kind_obj) : -1;
+const char* event_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : "unknown";
+
+if (is_authorized_admin_event(event)) {
+    char log_msg[256];
+    snprintf(log_msg, sizeof(log_msg),
+            "ADMIN EVENT: Authorized admin event (kind=%d) from pubkey=%.16s...",
+            event_kind, event_pubkey);
+    log_info(log_msg);
+} else if (event_kind == 23455 || event_kind == 23456) {
+    // This catches unauthorized admin event attempts
+    char log_msg[256];
+    snprintf(log_msg, sizeof(log_msg),
+            "SECURITY: Unauthorized admin event attempt (kind=%d) from pubkey=%.16s...",
+            event_kind, event_pubkey);
+    log_warning(log_msg);
+}
+```
+
+## Phase 3: Unified Output Flow Architecture
+
+### 3.1 Current Output Flow Analysis
+
+After analyzing both [`main.c`](src/main.c) and [`config.c`](src/config.c), the **admin event responses already flow through the standard WebSocket output pipeline**. This is the correct architecture and requires no changes.
+
+#### Standard WebSocket Output Pipeline
+
+**Regular Events** ([`main.c:2978-2996`](src/main.c:2978)):
+```c
+// Database query responses
+unsigned char* buf = malloc(LWS_PRE + msg_len);
+memcpy(buf + LWS_PRE, msg_str, msg_len);
+lws_write(wsi, buf + LWS_PRE, msg_len, LWS_WRITE_TEXT);
+free(buf);
+```
+
+**OK Responses** ([`main.c:3342-3375`](src/main.c:3342)):
+```c
+// Event processing results: ["OK", event_id, success_boolean, message]
+unsigned char *buf = malloc(LWS_PRE + response_len);
+memcpy(buf + LWS_PRE, response_str, response_len);
+lws_write(wsi, buf + LWS_PRE, response_len, LWS_WRITE_TEXT);
+free(buf);
+```
+
+#### Admin Event Output Pipeline (Already Unified)
+
+**Admin Responses** ([`config.c:2363-2414`](src/config.c:2363)):
+```c
+// Admin query responses use IDENTICAL pattern
+int send_websocket_response_data(struct lws* wsi, cJSON* response_data) {
+    unsigned char* buf = malloc(LWS_PRE + response_len);
+    memcpy(buf + LWS_PRE, response_str, response_len);
+    
+    // Same lws_write() call as regular events
+    int result = lws_write(wsi, buf + LWS_PRE, response_len, LWS_WRITE_TEXT);
+    
+    free(buf);
+    return result;
+}
+```
+
+### 3.2 Unified Output Flow Confirmation
+
+✅ **Admin responses already use the same WebSocket transmission mechanism as regular events**
+
+✅ **Both admin and regular events use identical buffer allocation patterns**
+
+✅ **Both admin and regular events use the same [`lws_write()`](src/config.c:2393) function**
+
+✅ **Both admin and regular events follow the same cleanup patterns**
+
+### 3.3 Output Flow Integration Points
+
+The admin event processing in [`config.c:2436`](src/config.c:2436) already integrates correctly with the unified output system:
+
+1. **Admin Query Processing** ([`config.c:2568-2583`](src/config.c:2568)):
+   - Auth queries return structured JSON via [`send_websocket_response_data()`](src/config.c:2571)
+   - System commands return status data via [`send_websocket_response_data()`](src/config.c:2631)
+
+2. **Response Format Consistency**:
+   - Admin responses use standard JSON format
+   - Regular events use standard Nostr event format
+   - Both transmitted through same WebSocket pipeline
+
+3. **Error Handling Consistency**:
+   - Admin errors returned via same WebSocket connection
+   - Regular event errors returned via OK messages
+   - Both use identical transmission mechanism
+
+### 3.4 Key Architectural Benefits
+
+**No Changes Required**: The output flow is already unified and correctly implemented.
+
+**Security Separation**: Admin events are processed separately but responses flow through the same secure WebSocket channel.
+
+**Performance Consistency**: Both admin and regular responses use the same optimized transmission path.
+
+**Maintenance Simplicity**: Single WebSocket output pipeline reduces complexity and potential bugs.
+
+### 3.5 Admin Event Flow Summary
+
+```
+Admin Event Input → Authorization Check → Admin Processing → Unified WebSocket Output
+Regular Event Input → Validation → Storage + Broadcast → Unified WebSocket Output
+```
+
+Both flows converge at the **Unified WebSocket Output** stage, which is already correctly implemented.
+
+## Phase 4: Integration Points for Secure Admin Event Routing
+
+### 4.1 Configuration System Integration
+
+**Required Configuration Values**:
+- `admin_pubkey` - Public key of authorized administrator
+- `relay_pubkey` - Public key of this relay instance
+
+**Integration Points**:
+1. [`get_config_value()`](src/config.c) - Used by authorization function
+2. [`get_relay_pubkey_cached()`](src/config.c) - Used for relay targeting validation
+3. Configuration loading during startup - Must ensure admin/relay pubkeys are available
+
+### 4.3 Forward Declarations Required
+
+**Location**: [`src/main.c`](src/main.c) - Add near other forward declarations (around line 230)
+
+```c
+// Forward declarations for enhanced admin event authorization
+int is_authorized_admin_event(cJSON* event, char* error_message, size_t error_size);
+```
+
+### 4.4 Error Handling Integration
+
+**Enhanced Error Response System**:
+
+```c
+// In main.c event processing - enhanced error handling for admin events
+if (auth_result != 0) {
+    // Admin authorization failed - send detailed OK response
+    cJSON* event_id = cJSON_GetObjectItem(event, "id");
+    if (event_id && cJSON_IsString(event_id)) {
+        cJSON* response = cJSON_CreateArray();
+        cJSON_AddItemToArray(response, cJSON_CreateString("OK"));
+        cJSON_AddItemToArray(response, cJSON_CreateString(cJSON_GetStringValue(event_id)));
+        cJSON_AddItemToArray(response, cJSON_CreateBool(0)); // Failed
+        cJSON_AddItemToArray(response, cJSON_CreateString(auth_error));
+        
+        // Send via standard WebSocket output pipeline
+        char *response_str = cJSON_Print(response);
+        if (response_str) {
+            size_t response_len = strlen(response_str);
+            unsigned char *buf = malloc(LWS_PRE + response_len);
+            if (buf) {
+                memcpy(buf + LWS_PRE, response_str, response_len);
+                lws_write(wsi, buf + LWS_PRE, response_len, LWS_WRITE_TEXT);
+                free(buf);
+            }
+            free(response_str);
+        }
+        cJSON_Delete(response);
+    }
+}
+```
+
+### 4.5 Logging Integration Points
+
+**Console Logging**: Uses existing [`log_warning()`](src/main.c:993), [`log_info()`](src/main.c:972) functions
+
+**Security Event Categories**:
+- Admin authorization success logged via `log_info()`
+- Admin authorization failures logged via `log_warning()`
+- Admin event processing logged via existing admin logging
+
+## Phase 5: Detailed Function Specifications
+
+### 5.1 Core Authorization Function
+
+**Function**: `is_authorized_admin_event()`
+**Location**: [`src/main.c`](src/main.c) or [`src/config.c`](src/config.c)
+**Dependencies**:
+- `get_config_value()` for admin/relay pubkeys
+- `log_warning()` and `log_info()` for logging
+- `cJSON` library for event parsing
+
+**Return Values**:
+- `0` - Event is authorized for admin processing
+- `-1` - Event is unauthorized (treat as regular event)
+- `-2` - Validation error (malformed event)
+
+**Error Handling**: Detailed error messages in provided buffer for client feedback
+
+### 5.2 Enhanced Event Routing
+
+**Location**: [`main.c:3248-3340`](src/main.c:3248)
+**Integration**: Replaces existing admin event routing logic
+**Dependencies**:
+- `is_authorized_admin_event()` for authorization
+- `process_admin_event_in_config()` for admin processing
+- `store_event()` and `broadcast_event_to_subscriptions()` for regular events
+
+**Security Features**:
+- Graceful degradation for unauthorized admin events
+- Comprehensive logging of authorization attempts
+- No broadcast of admin events to subscriptions
+- Detailed error responses for failed authorization
+
+### 5.4 Defense-in-Depth Validation
+
+**Primary Validation**: In main event routing logic
+**Secondary Validation**: In `process_admin_event_in_config()` function
+**Tertiary Validation**: In individual admin command handlers
+
+**Validation Layers**:
+1. **Kind Check** - Must be admin event kind (23455/23456)
+2. **Relay Targeting Check** - Must have 'p' tag with this relay's pubkey
+3. **Admin Signature Check** - Must be signed by authorized admin (only if targeting this relay)
+4. **Processing Check** - Additional validation in admin handlers
+
+**Security Logic**:
+- If no 'p' tag for this relay → Admin event for different relay (not unauthorized)
+- If 'p' tag for this relay + wrong admin signature → "Unauthorized admin event attempt"
+
+## Phase 6: Event Flow Documentation
+
+### 6.1 Complete Event Processing Flow
+
+```
+┌─────────────────┐
+│ WebSocket Input │
+└─────────┬───────┘
+          │
+          ▼
+┌─────────────────┐
+│ Unified         │
+│ Validation      │ ← nostr_validate_unified_request()
+└─────────┬───────┘
+          │
+          ▼
+┌─────────────────┐
+│ Kind-Based      │
+│ Routing Check   │ ← Check if kind 23455/23456
+└─────────┬───────┘
+          │
+     ┌────▼────┐
+     │ Admin?  │
+     └────┬────┘
+          │
+    ┌─────▼─────┐         ┌─────────────┐
+    │ YES       │         │ NO          │
+    │           │         │             │
+    ▼           │         ▼             │
+┌─────────────┐ │    ┌─────────────┐    │
+│ Admin       │ │    │ Regular     │    │
+│ Authorization│ │    │ Event       │    │
+│ Check       │ │    │ Processing  │    │
+└─────┬───────┘ │    └─────┬───────┘    │
+      │         │          │            │
+ ┌────▼────┐    │          ▼            │
+ │Authorized?│   │    ┌─────────────┐    │
+ └────┬────┘    │    │ store_event()│    │
+      │         │    │ +           │    │
+┌─────▼─────┐   │    │ broadcast() │    │
+│ YES   NO  │   │    └─────┬───────┘    │
+│  │     │  │   │          │            │
+│  ▼     ▼  │   │          ▼            │
+│┌─────┐┌───┴┐  │    ┌─────────────┐    │
+││Admin││Treat│  │    │ WebSocket   │    │
+││API  ││as   │  │    │ OK Response │    │
+││     ││Reg  │  │    └─────────────┘    │
+│└──┬──┘└───┬┘  │                       │
+│   │      │   │                       │
+│   ▼      │   │                       │
+│┌─────────┐│   │                       │
+││WebSocket││   │                       │
+││Response ││   │                       │
+│└─────────┘│   │                       │
+└───────────┴───┘                       │
+            │                           │
+            └───────────────────────────┘
+                        │
+                        ▼
+                ┌─────────────┐
+                │ Unified     │
+                │ WebSocket   │
+                │ Output      │
+                └─────────────┘
+```
+
+### 6.2 Security Decision Points
+
+1. **Event Kind Check** - Identifies potential admin events
+2. **Authorization Validation** - Three-layer security check
+3. **Routing Decision** - Admin API vs Regular processing
+4. **Response Generation** - Unified output pipeline
+5. **Audit Logging** - Security event tracking
+
+### 6.3 Error Handling Paths
+
+**Validation Errors**: Return detailed error messages via OK response
+**Authorization Failures**: Log security event + treat as regular event
+**Processing Errors**: Return admin-specific error responses
+**System Errors**: Fallback to standard error handling
+
+This completes the comprehensive implementation plan for the enhanced admin event API structure with unified output flow architecture.

README.md

@@ -22,4 +22,150 @@ Do NOT modify the formatting, add emojis, or change the text. Keep the simple fo
 - [ ] NIP-50: Keywords filter
 - [ ] NIP-70: Protected Events
 
+## 🔧 Administrator API
+
+C-Relay uses an innovative **event-based administration system** where all configuration and management commands are sent as signed Nostr events using the admin private key generated during first startup. All admin commands use **tag-based parameters** for simplicity and compatibility.
+
+### Authentication
+
+All admin commands require signing with the admin private key displayed during first-time startup. **Save this key securely** - it cannot be recovered and is needed for all administrative operations.
+
+### Event Structure
+
+All admin commands use the same unified event structure with tag-based parameters:
+
+**Admin Command Event:**
+```json
+{
+  "id": "event_id",
+  "pubkey": "admin_public_key",
+  "created_at": 1234567890,
+  "kind": 23456,
+  "content": "<nip44 encrypted command>",
+  "tags": [
+    ["p", "relay_public_key"],
+  ],
+  "sig": "event_signature"
+}
+```
+
+**Admin Response Event:**
+```json
+["EVENT", "temp_sub_id", {
+  "id": "response_event_id",
+  "pubkey": "relay_public_key",
+  "created_at": 1234567890,
+  "kind": 23457,
+  "content": "<nip44 encrypted response>",
+  "tags": [
+    ["p", "admin_public_key"]
+  ],
+  "sig": "response_event_signature"
+}]
+```
+
+### Admin Commands
+
+All commands are sent as nip44 encrypted content. The following table lists all available commands:
+
+| Command Type | Tag Format | Description |
+|--------------|------------|-------------|
+| **Configuration Management** |
+| `config_update` | `["relay_description", "My Relay"]` | Update relay configuration parameters |
+| `config_query` | `["config_query", "list_all_keys"]` | List all available configuration keys |
+| **Auth Rules Management** |
+| `auth_add_blacklist` | `["blacklist", "pubkey", "abc123..."]` | Add pubkey to blacklist |
+| `auth_add_whitelist` | `["whitelist", "pubkey", "def456..."]` | Add pubkey to whitelist |
+| `auth_query_all` | `["auth_query", "all"]` | Query all auth rules |
+| `auth_query_type` | `["auth_query", "whitelist"]` | Query specific rule type |
+| `auth_query_pattern` | `["auth_query", "pattern", "abc123..."]` | Query specific pattern |
+| **System Commands** |
+| `system_clear_auth` | `["system_command", "clear_all_auth_rules"]` | Clear all auth rules |
+| `system_status` | `["system_command", "system_status"]` | Get system status |
+
+### Available Configuration Keys
+
+**Basic Relay Settings:**
+- `relay_description`: Relay description text
+- `relay_contact`: Contact information
+- `max_connections`: Maximum concurrent connections
+- `max_subscriptions_per_client`: Max subscriptions per client
+- `max_event_tags`: Maximum tags per event
+- `max_content_length`: Maximum event content length
+
+**Authentication & Access Control:**
+- `auth_enabled`: Enable whitelist/blacklist auth rules (`true`/`false`)
+- `nip42_auth_required`: Enable NIP-42 cryptographic authentication (`true`/`false`)
+- `nip42_auth_required_kinds`: Event kinds requiring NIP-42 auth (comma-separated)
+- `nip42_challenge_timeout`: NIP-42 challenge expiration seconds
+
+**Proof of Work & Validation:**
+- `pow_min_difficulty`: Minimum proof-of-work difficulty
+- `nip40_expiration_enabled`: Enable event expiration (`true`/`false`)
+
+### Response Format
+
+All admin commands return **signed EVENT responses** via WebSocket following standard Nostr protocol. Responses use JSON content with structured data.
+
+#### Response Examples
+
+**Success Response:**
+```json
+["EVENT", "temp_sub_id", {
+  "id": "response_event_id",
+  "pubkey": "relay_public_key",
+  "created_at": 1234567890,
+  "kind": 23457,
+  "content": "nip44 encrypted:{\"status\": \"success\", \"message\": \"Operation completed successfully\"}",
+  "tags": [
+    ["p", "admin_public_key"]
+  ],
+  "sig": "response_event_signature"
+}]
+```
+
+**Error Response:**
+```json
+["EVENT", "temp_sub_id", {
+  "id": "response_event_id",
+  "pubkey": "relay_public_key",
+  "created_at": 1234567890,
+  "kind": 23457,
+  "content": "nip44 encrypted:{\"status\": \"error\", \"message\": \"Error: invalid configuration value\"}",
+  "tags": [
+    ["p", "admin_public_key"]
+  ],
+  "sig": "response_event_signature"
+}]
+```
+
+**Auth Rules Query Response:**
+```json
+["EVENT", "temp_sub_id", {
+  "id": "response_event_id",
+  "pubkey": "relay_public_key",
+  "created_at": 1234567890,
+  "kind": 23457,
+  "content": "nip44 encrypted:{\"query_type\": \"auth_rules\", \"total_results\": 2, \"data\": [{\"rule_type\": \"blacklist\", \"pattern_type\": \"pubkey\", \"pattern_value\": \"abc123...\", \"action\": \"deny\"}]}",
+  "tags": [
+    ["p", "admin_public_key"]
+  ],
+  "sig": "response_event_signature"
+}]
+```
+
+**Configuration Query Response:**
+```json
+["EVENT", "temp_sub_id", {
+  "id": "response_event_id",
+  "pubkey": "relay_public_key",
+  "created_at": 1234567890,
+  "kind": 23457,
+  "content": "nip44 encrypted:{\"query_type\": \"config_keys\", \"config_keys\": [\"auth_enabled\", \"max_connections\"], \"descriptions\": {\"auth_enabled\": \"Enable whitelist/blacklist rules\"}}",
+  "tags": [
+    ["p", "admin_public_key"]
+  ],
+  "sig": "response_event_signature"
+}]
+```
 

api/index.html

@@ -951,12 +951,12 @@
                         relayStatus.textContent = 'CONNECTED - SUBSCRIBING...';
                         relayStatus.className = 'status connected';
 
-                        // Send REQ message to subscribe to kind 33334 events
+                        // Send REQ message to subscribe to kind 23455 events (ephemeral config events)
                         const reqMessage = [
                             "REQ",
                             subscriptionId,
                             {
-                                "kinds": [33334],
+                                "kinds": [23455],
                                 "limit": 50
                             }
                         ];
@@ -1176,10 +1176,10 @@
                 'max_limit': 'Maximum Query Limit'
             };
 
-            // Process configuration tags
+            // Process configuration tags (no d tag filtering for ephemeral events)
             const configData = {};
             event.tags.forEach(tag => {
-                if (tag.length >= 2 && tag[0] !== 'd') { // Skip 'd' tag (relay identifier)
+                if (tag.length >= 2) {
                     configData[tag[0]] = tag[1];
                 }
             });
@@ -1270,26 +1270,23 @@
                 const formInputs = configForm.querySelectorAll('input, select');
                 const newTags = [];
 
-                // Preserve the 'd' tag (relay identifier) from original event
-                const dTag = currentConfig.tags.find(tag => tag[0] === 'd');
-                if (dTag) {
-                    newTags.push(dTag);
-                }
-
-                // Add updated configuration tags
+                // Add updated configuration tags (no d tag needed for ephemeral events)
                 formInputs.forEach(input => {
                     if (!input.disabled && input.name) {
                         newTags.push([input.name, input.value]);
                     }
                 });
 
-                // Create new kind 33334 event
+                // Create new kind 23455 event (ephemeral configuration event)
                 const newEvent = {
-                    kind: 33334,
+                    kind: 23455,
                     pubkey: userPubkey,
                     created_at: Math.floor(Date.now() / 1000),
                     tags: newTags,
-                    content: currentConfig.content || 'C Nostr Relay Configuration'
+                    content: JSON.stringify({
+                        action: 'update_config',
+                        config_data: Object.fromEntries(newTags.filter(tag => tag[0] !== 'd'))
+                    })
                 };
 
                 console.log('Signing event with window.nostr.signEvent()...');
@@ -1660,7 +1657,7 @@
             try {
                 log(`Deleting auth rule: ${rule.rule_type} - ${rule.pattern_value || rule.rule_target}`, 'INFO');
                 
-                // TODO: Implement actual rule deletion via WebSocket kind 33335 event
+                // TODO: Implement actual rule deletion via WebSocket kind 23456 event
                 // For now, just remove from local array
                 currentAuthRules.splice(index, 1);
                 displayAuthRules(currentAuthRules);
@@ -1746,7 +1743,7 @@
                 if (editingAuthRule) {
                     log(`Updating auth rule: ${ruleData.rule_type} - ${ruleData.pattern_value}`, 'INFO');
                     
-                    // TODO: Implement actual rule update via WebSocket kind 33335 event
+                    // TODO: Implement actual rule update via WebSocket kind 23456 event
                     // For now, just update local array
                     currentAuthRules[editingAuthRule.index] = { ...ruleData, id: editingAuthRule.id || Date.now() };
                     
@@ -1754,7 +1751,7 @@
                 } else {
                     log(`Adding new auth rule: ${ruleData.rule_type} - ${ruleData.pattern_value}`, 'INFO');
                     
-                    // TODO: Implement actual rule creation via WebSocket kind 33335 event
+                    // TODO: Implement actual rule creation via WebSocket kind 23456 event
                     // For now, just add to local array
                     currentAuthRules.push({ ...ruleData, id: Date.now() });
                     
@@ -2021,7 +2018,7 @@
                 });
         }
 
-        // Add auth rule via WebSocket (kind 33335 event)
+        // Add auth rule via WebSocket (kind 23456 event)
         async function addAuthRuleViaWebSocket(ruleData) {
             if (!isLoggedIn || !userPubkey) {
                 throw new Error('Must be logged in to add auth rules');
@@ -2064,13 +2061,12 @@
                     dbPatternType = 'pubkey';
                 }
                 
-                // Create kind 33335 auth rule event with database schema values
+                // Create kind 23456 auth rule event (ephemeral auth management)
                 const authEvent = {
-                    kind: 33335,
+                    kind: 23456,
                     pubkey: userPubkey,
                     created_at: Math.floor(Date.now() / 1000),
                     tags: [
-                        ['d', 'auth-rules'], // Addressable event identifier
                         [dbRuleType, dbPatternType, ruleData.pattern_value]
                     ],
                     content: JSON.stringify({

docs/admin_api_plan.md

@@ -0,0 +1,537 @@
+# C-Relay Administrator API Implementation Plan
+
+## Problem Analysis
+
+### Current Issues Identified:
+
+1. **Schema Mismatch**: Storage system (config.c) vs Validation system (request_validator.c) use different column names and values
+2. **Missing API Endpoint**: No way to clear auth_rules table for testing
+3. **Configuration Gap**: Auth rules enforcement may not be properly enabled
+4. **Documentation Gap**: Admin API commands not documented
+
+### Root Cause: Auth Rules Schema Inconsistency
+
+**Current Schema (sql_schema.h lines 140-150):**
+```sql
+CREATE TABLE auth_rules (
+    rule_type TEXT CHECK (rule_type IN ('whitelist', 'blacklist')),
+    pattern_type TEXT CHECK (pattern_type IN ('pubkey', 'hash')),  
+    pattern_value TEXT,
+    action TEXT CHECK (action IN ('allow', 'deny')),
+    active INTEGER DEFAULT 1
+);
+```
+
+**Storage Implementation (config.c):**
+- Stores: `rule_type='blacklist'`, `pattern_type='pubkey'`, `pattern_value='hex'`, `action='allow'`
+
+**Validation Implementation (request_validator.c):**
+- Queries: `rule_type='pubkey_blacklist'`, `rule_target='hex'`, `operation='event'`, `enabled=1`
+
+**MISMATCH**: Validator looks for non-existent columns and wrong rule_type values!
+
+## Proposed Solution Architecture
+
+### Phase 1: API Documentation & Standardization
+
+#### Admin API Commands (via WebSocket with admin private key)
+
+**Kind 23455: Configuration Management (Ephemeral)**
+- Update relay settings, limits, authentication policies
+- **Standard Mode**: Commands in tags `["config_key", "config_value"]`
+- **Encrypted Mode**: Commands NIP-44 encrypted in content `{"encrypted_tags": "..."}`
+- Content: Descriptive text or encrypted payload
+- Security: Optional NIP-44 encryption for sensitive operations
+
+**Kind 23456: Auth Rules & System Management (Ephemeral)**
+- Auth rules: Add/remove/query whitelist/blacklist rules
+- System commands: clear rules, status, cache management
+- **Standard Mode**: Commands in tags
+  - Rule format: `["rule_type", "pattern_type", "pattern_value"]`
+  - Query format: `["auth_query", "filter"]`
+  - System format: `["system_command", "command_name"]`
+- **Encrypted Mode**: Commands NIP-44 encrypted in content `{"encrypted_tags": "..."}`
+- Content: Action description + optional encrypted payload
+- Security: Optional NIP-44 encryption for sensitive operations
+
+#### Configuration Query Commands (using Kind 23455)
+
+1. **List All Configuration Keys (Standard)**:
+   ```json
+   {
+     "kind": 23455,
+     "content": "Discovery query",
+     "tags": [["config_query", "list_all_keys"]]
+   }
+   ```
+
+2. **List All Configuration Keys (Encrypted)**:
+   ```json
+   {
+     "kind": 23455,
+     "content": "{\"query\":\"list_config_keys\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
+     "tags": []
+   }
+   ```
+   *Encrypted payload contains:* `[["config_query", "list_all_keys"]]`
+
+3. **Get Current Configuration (Standard)**:
+   ```json
+   {
+     "kind": 23455,
+     "content": "Config query",
+     "tags": [["config_query", "get_current_config"]]
+   }
+   ```
+
+4. **Get Current Configuration (Encrypted)**:
+   ```json
+   {
+     "kind": 23455,
+     "content": "{\"query\":\"get_config\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
+     "tags": []
+   }
+   ```
+   *Encrypted payload contains:* `[["config_query", "get_current_config"]]`
+
+#### System Management Commands (using Kind 23456)
+
+1. **Clear All Auth Rules (Standard)**:
+   ```json
+   {
+     "kind": 23456,
+     "content": "{\"action\":\"clear_all\"}",
+     "tags": [["system_command", "clear_all_auth_rules"]]
+   }
+   ```
+
+2. **Clear All Auth Rules (Encrypted)**:
+   ```json
+   {
+     "kind": 23456,
+     "content": "{\"action\":\"clear_all\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
+     "tags": []
+   }
+   ```
+   *Encrypted payload contains:* `[["system_command", "clear_all_auth_rules"]]`
+
+3. **Query All Auth Rules (Standard)**:
+   ```json
+   {
+     "kind": 23456,
+     "content": "{\"query\":\"list_auth_rules\"}",
+     "tags": [["auth_query", "all"]]
+   }
+   ```
+
+4. **Query All Auth Rules (Encrypted)**:
+   ```json
+   {
+     "kind": 23456,
+     "content": "{\"query\":\"list_auth_rules\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
+     "tags": []
+   }
+   ```
+   *Encrypted payload contains:* `[["auth_query", "all"]]`
+
+5. **Add Blacklist Rule (Standard)**:
+   ```json
+   {
+     "kind": 23456,
+     "content": "{\"action\":\"add\"}",
+     "tags": [["blacklist", "pubkey", "deadbeef1234abcd..."]]
+   }
+   ```
+
+6. **Add Blacklist Rule (Encrypted)**:
+   ```json
+   {
+     "kind": 23456,
+     "content": "{\"action\":\"add\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
+     "tags": []
+   }
+   ```
+   *Encrypted payload contains:* `[["blacklist", "pubkey", "deadbeef1234abcd..."]]`
+
+### Phase 2: Auth Rules Schema Alignment
+
+#### Option A: Fix Validator to Match Schema (RECOMMENDED)
+
+**Update request_validator.c:**
+```sql
+-- OLD (broken):
+WHERE rule_type = 'pubkey_blacklist' AND rule_target = ? AND operation = ? AND enabled = 1
+
+-- NEW (correct):
+WHERE rule_type = 'blacklist' AND pattern_type = 'pubkey' AND pattern_value = ? AND active = 1
+```
+
+**Benefits:**
+- Matches actual database schema
+- Simpler rule_type values ('blacklist' vs 'pubkey_blacklist')  
+- Uses existing columns (pattern_value vs rule_target)
+- Consistent with storage implementation
+
+#### Option B: Update Schema to Match Validator (NOT RECOMMENDED)
+
+Would require changing schema, migration scripts, and storage logic.
+
+### Phase 3: Implementation Priority
+
+#### High Priority (Critical for blacklist functionality):
+1. Fix request_validator.c schema mismatch
+2. Ensure auth_required configuration is enabled
+3. Update tests to use ephemeral event kinds (23455/23456)
+4. Test blacklist enforcement
+
+#### Medium Priority (Enhanced Admin Features):
+1. **Implement NIP-44 Encryption Support**:
+   - Detect empty tags array for Kind 23455/23456 events
+   - Parse `encrypted_tags` field from content JSON
+   - Decrypt using admin privkey and relay pubkey
+   - Process decrypted tags as normal commands
+2. Add clear_all_auth_rules system command
+3. Add auth rule query functionality (both standard and encrypted modes)
+4. Add configuration discovery (list available config keys)
+5. Enhanced error reporting in admin API
+6. Conflict resolution (same pubkey in whitelist + blacklist)
+
+#### Security Priority (NIP-44 Implementation):
+1. **Encryption Detection Logic**: Check for empty tags + encrypted_tags field
+2. **Key Pair Management**: Use admin private key + relay public key for NIP-44
+3. **Backward Compatibility**: Support both standard and encrypted modes
+4. **Error Handling**: Graceful fallback if decryption fails
+5. **Performance**: Cache decrypted results to avoid repeated decryption
+
+#### Low Priority (Documentation & Polish):
+1. Complete README.md API documentation
+2. Example usage scripts
+3. Admin client tools
+
+### Phase 4: Expected API Structure
+
+#### README.md Documentation Format:
+
+```markdown
+# C-Relay Administrator API
+
+## Authentication
+All admin commands require signing with the admin private key generated during first startup.
+
+## Configuration Management (Kind 23455 - Ephemeral)
+Update relay configuration parameters or query available settings.
+
+**Configuration Update Event:**
+```json
+{
+  "kind": 23455,
+  "content": "Configuration update",
+  "tags": [
+    ["config_key1", "config_value1"],
+    ["config_key2", "config_value2"]
+  ]
+}
+```
+
+**List Available Config Keys:**
+```json
+{
+  "kind": 23455,
+  "content": "{\"query\":\"list_config_keys\",\"description\":\"Get editable config keys\"}",
+  "tags": [
+    ["config_query", "list_all_keys"]
+  ]
+}
+```
+
+**Get Current Configuration:**
+```json
+{
+  "kind": 23455,
+  "content": "{\"query\":\"get_config\",\"description\":\"Get current config values\"}",
+  "tags": [
+    ["config_query", "get_current_config"]
+  ]
+}
+```
+
+## Auth Rules Management (Kind 23456 - Ephemeral)
+Manage whitelist and blacklist rules.
+
+**Add Rule Event:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"action\":\"add\",\"description\":\"Block malicious user\"}",
+  "tags": [
+    ["blacklist", "pubkey", "deadbeef1234..."]
+  ]
+}
+```
+
+**Remove Rule Event:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"action\":\"remove\",\"description\":\"Unblock user\"}",
+  "tags": [
+    ["blacklist", "pubkey", "deadbeef1234..."]
+  ]
+}
+```
+
+**Query All Auth Rules:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"query\":\"list_auth_rules\",\"description\":\"Get all rules\"}",
+  "tags": [
+    ["auth_query", "all"]
+  ]
+}
+```
+
+**Query Whitelist Rules Only:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"query\":\"list_auth_rules\",\"description\":\"Get whitelist\"}",
+  "tags": [
+    ["auth_query", "whitelist"]
+  ]
+}
+```
+
+**Check Specific Pattern:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"query\":\"check_pattern\",\"description\":\"Check if pattern exists\"}",
+  "tags": [
+    ["auth_query", "pattern", "deadbeef1234..."]
+  ]
+}
+```
+
+## System Management (Kind 23456 - Ephemeral)
+System administration commands using the same kind as auth rules.
+
+**Clear All Auth Rules:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"action\":\"clear_all\",\"description\":\"Clear all auth rules\"}",
+  "tags": [
+    ["system_command", "clear_all_auth_rules"]
+  ]
+}
+```
+
+**System Status:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"action\":\"system_status\",\"description\":\"Get system status\"}",
+  "tags": [
+    ["system_command", "system_status"]
+  ]
+}
+```
+
+## Response Format
+All admin commands return JSON responses via WebSocket:
+
+**Success Response:**
+```json
+["OK", "event_id", true, "success_message"]
+```
+
+**Error Response:**  
+```json
+["OK", "event_id", false, "error_message"]
+```
+
+## Configuration Keys
+- `relay_description`: Relay description text
+- `relay_contact`: Contact information  
+- `auth_enabled`: Enable authentication system
+- `max_connections`: Maximum concurrent connections
+- `pow_min_difficulty`: Minimum proof-of-work difficulty
+- ... (full list of config keys)
+
+## Examples
+
+### Enable Authentication & Add Blacklist
+```bash
+# 1. Enable auth system
+nak event -k 23455 --content "Enable authentication" \
+  -t "auth_enabled=true" \
+  --sec $ADMIN_PRIVKEY | nak event ws://localhost:8888
+
+# 2. Add user to blacklist
+nak event -k 23456 --content '{"action":"add","description":"Spam user"}' \
+  -t "blacklist=pubkey;$SPAM_USER_PUBKEY" \
+  --sec $ADMIN_PRIVKEY | nak event ws://localhost:8888
+
+# 3. Query all auth rules
+nak event -k 23456 --content '{"query":"list_auth_rules","description":"Get all rules"}' \
+  -t "auth_query=all" \
+  --sec $ADMIN_PRIVKEY | nak event ws://localhost:8888
+
+# 4. Clear all rules for testing
+nak event -k 23456 --content '{"action":"clear_all","description":"Clear all rules"}' \
+  -t "system_command=clear_all_auth_rules" \
+  --sec $ADMIN_PRIVKEY | nak event ws://localhost:8888
+```
+
+## Expected Response Formats
+
+### Configuration Query Response
+```json
+["EVENT", "subscription_id", {
+  "kind": 23455,
+  "content": "{\"config_keys\": [\"auth_enabled\", \"max_connections\"], \"descriptions\": {\"auth_enabled\": \"Enable whitelist/blacklist rules\"}}",
+  "tags": [["response_type", "config_keys_list"]]
+}]
+```
+
+### Current Config Response
+```json
+["EVENT", "subscription_id", {
+  "kind": 23455,
+  "content": "{\"current_config\": {\"auth_enabled\": \"true\", \"max_connections\": \"1000\"}}",
+  "tags": [["response_type", "current_config"]]
+}]
+```
+
+### Auth Rules Query Response
+```json
+["EVENT", "subscription_id", {
+  "kind": 23456,
+  "content": "{\"auth_rules\": [{\"rule_type\": \"blacklist\", \"pattern_type\": \"pubkey\", \"pattern_value\": \"deadbeef...\"}, {\"rule_type\": \"whitelist\", \"pattern_type\": \"pubkey\", \"pattern_value\": \"cafebabe...\"}]}",
+  "tags": [["response_type", "auth_rules_list"], ["query_type", "all"]]
+}]
+```
+
+### Pattern Check Response
+```json
+["EVENT", "subscription_id", {
+  "kind": 23456,
+  "content": "{\"pattern_exists\": true, \"rule_type\": \"blacklist\", \"pattern_value\": \"deadbeef...\"}",
+  "tags": [["response_type", "pattern_check"], ["pattern", "deadbeef..."]]
+}]
+```
+
+## Implementation Steps
+
+1. **Document API** (this file) ✅
+2. **Update to ephemeral event kinds** ✅
+3. **Fix request_validator.c** schema mismatch
+4. **Update tests** to use Kind 23455/23456
+5. **Add auth rule query functionality**
+6. **Add configuration discovery feature**
+7. **Test blacklist functionality**
+8. **Add remaining system commands**
+
+## Testing Plan
+
+1. Fix schema mismatch and test basic blacklist
+2. Add clear_auth_rules and test table cleanup
+3. Test whitelist/blacklist conflict scenarios  
+4. Test all admin API commands end-to-end
+5. Update integration tests
+
+This plan addresses the immediate blacklist issue while establishing a comprehensive admin API framework for future expansion.
+
+## NIP-44 Encryption Implementation Details
+
+### Server-Side Detection Logic
+```c
+// In admin event processing function
+bool is_encrypted_command(struct nostr_event *event) {
+    // Check if Kind 23455 or 23456 with empty tags
+    if ((event->kind == 23455 || event->kind == 23456) &&
+        event->tags_count == 0) {
+        return true;
+    }
+    return false;
+}
+
+cJSON *decrypt_admin_tags(struct nostr_event *event) {
+    cJSON *content_json = cJSON_Parse(event->content);
+    if (!content_json) return NULL;
+    
+    cJSON *encrypted_tags = cJSON_GetObjectItem(content_json, "encrypted_tags");
+    if (!encrypted_tags) {
+        cJSON_Delete(content_json);
+        return NULL;
+    }
+    
+    // Decrypt using NIP-44 with admin pubkey and relay privkey
+    char *decrypted = nip44_decrypt(
+        cJSON_GetStringValue(encrypted_tags),
+        admin_pubkey,           // Shared secret with admin
+        relay_private_key       // Our private key
+    );
+    
+    cJSON *decrypted_tags = cJSON_Parse(decrypted);
+    free(decrypted);
+    cJSON_Delete(content_json);
+    
+    return decrypted_tags; // Returns tag array: [["key1", "val1"], ["key2", "val2"]]
+}
+```
+
+### Admin Event Processing Flow
+1. **Receive Event**: Kind 23455/23456 with admin signature
+2. **Check Mode**: Empty tags = encrypted, populated tags = standard
+3. **Decrypt if Needed**: Extract and decrypt `encrypted_tags` from content
+4. **Process Commands**: Use decrypted/standard tags for command processing
+5. **Execute**: Same logic for both modes after tag extraction
+6. **Respond**: Standard response format (optionally encrypt response)
+
+### Security Benefits
+- **Command Privacy**: Admin operations invisible in event tags
+- **Replay Protection**: NIP-44 includes timestamp/randomness
+- **Key Management**: Uses existing admin/relay key pair
+- **Backward Compatible**: Standard mode still works
+- **Performance**: Only decrypt when needed (empty tags detection)
+
+### NIP-44 Library Integration
+The relay will need to integrate a NIP-44 encryption/decryption library:
+
+```c
+// Required NIP-44 functions
+char* nip44_encrypt(const char* plaintext, const char* sender_privkey, const char* recipient_pubkey);
+char* nip44_decrypt(const char* ciphertext, const char* recipient_privkey, const char* sender_pubkey);
+```
+
+### Implementation Priority (Updated)
+
+#### Phase 1: Core Infrastructure (Complete)
+- [x] Event-based admin authentication system
+- [x] Kind 23455/23456 (Configuration/Auth Rules) processing
+- [x] Basic configuration parameter updates
+- [x] Auth rule add/remove/clear functionality
+- [x] Updated to ephemeral event kinds
+- [x] Designed NIP-44 encryption support
+
+#### Phase 2: NIP-44 Encryption Support (Next Priority)
+- [ ] **Add NIP-44 library dependency** to project
+- [ ] **Implement encryption detection logic** (`is_encrypted_command()`)
+- [ ] **Add decrypt_admin_tags() function** with NIP-44 support
+- [ ] **Update admin command processing** to handle both modes
+- [ ] **Test encrypted admin commands** end-to-end
+
+#### Phase 3: Enhanced Features
+- [ ] **Auth rule query functionality** (both standard and encrypted modes)
+- [ ] **Configuration discovery API** (list available config keys)
+- [ ] **Enhanced error messages** with encryption status
+- [ ] **Performance optimization** (caching, async decrypt)
+
+#### Phase 4: Schema Fixes (Critical)
+- [ ] **Fix request_validator.c** schema mismatch
+- [ ] **Enable blacklist enforcement** with encrypted commands
+- [ ] **Update tests** to use both standard and encrypted modes
+
+This enhanced admin API provides enterprise-grade security while maintaining ease of use for basic operations.

make_and_restart_relay.sh

@@ -198,25 +198,54 @@ fi
 
 echo "Build successful. Proceeding with relay restart..."
 
-# Kill existing relay if running
+# Kill existing relay if running - start aggressive immediately
 echo "Stopping any existing relay servers..."
-pkill -f "c_relay_" 2>/dev/null
-sleep 2  # Give time for shutdown
 
-# Check if port is still bound
-if lsof -i :8888 >/dev/null 2>&1; then
-    echo "Port 8888 still in use, force killing..."
-    fuser -k 8888/tcp 2>/dev/null || echo "No process on port 8888"
+# Get all relay processes and kill them immediately with -9
+RELAY_PIDS=$(pgrep -f "c_relay_" || echo "")
+if [ -n "$RELAY_PIDS" ]; then
+    echo "Force killing relay processes immediately: $RELAY_PIDS"
+    kill -9 $RELAY_PIDS 2>/dev/null
+else
+    echo "No existing relay processes found"
 fi
 
-# Get any remaining processes
-REMAINING_PIDS=$(pgrep -f "c_relay_" || echo "")
-if [ -n "$REMAINING_PIDS" ]; then
-    echo "Force killing remaining processes: $REMAINING_PIDS"
-    kill -9 $REMAINING_PIDS 2>/dev/null
+# Ensure port 8888 is completely free with retry loop
+echo "Ensuring port 8888 is available..."
+for attempt in {1..15}; do
+    if ! lsof -i :8888 >/dev/null 2>&1; then
+        echo "Port 8888 is now free"
+        break
+    fi
+    
+    echo "Attempt $attempt: Port 8888 still in use, force killing..."
+    # Kill anything using port 8888
+    fuser -k 8888/tcp 2>/dev/null || true
+    
+    # Double-check for any remaining relay processes
+    REMAINING_PIDS=$(pgrep -f "c_relay_" || echo "")
+    if [ -n "$REMAINING_PIDS" ]; then
+        echo "Killing remaining relay processes: $REMAINING_PIDS"
+        kill -9 $REMAINING_PIDS 2>/dev/null || true
+    fi
+    
+    sleep 2
+    
+    if [ $attempt -eq 15 ]; then
+        echo "ERROR: Could not free port 8888 after 15 attempts"
+        echo "Current processes using port:"
+        lsof -i :8888 2>/dev/null || echo "No process details available"
+        echo "You may need to manually kill processes or reboot"
+        exit 1
+    fi
+done
+
+# Final safety check - ensure no relay processes remain
+FINAL_PIDS=$(pgrep -f "c_relay_" || echo "")
+if [ -n "$FINAL_PIDS" ]; then
+    echo "Final cleanup: killing processes $FINAL_PIDS"
+    kill -9 $FINAL_PIDS 2>/dev/null || true
     sleep 1
-else
-    echo "No existing relay found"
 fi
 
 # Clean up PID file

relay.pid

@@ -1 +1 @@
-1950163
+285781

src/config.c

@@ -10,6 +10,7 @@
 #include <dirent.h>
 #include <sys/stat.h>
 #include <errno.h>
+#include <libwebsockets.h>
 
 // External database connection (from main.c)
 extern sqlite3* g_db;
@@ -63,7 +64,6 @@ extern void log_error(const char* message);
 // Forward declarations for new admin API functions
 int populate_default_config_values(void);
 int process_admin_config_event(cJSON* event, char* error_message, size_t error_size);
-int process_admin_auth_event(cJSON* event, char* error_message, size_t error_size);
 void invalidate_config_cache(void);
 int add_auth_rule_from_config(const char* rule_type, const char* pattern_type,
                              const char* pattern_value, const char* action);
@@ -73,6 +73,12 @@ int is_config_table_ready(void);
 int migrate_config_from_events_to_table(void);
 int populate_config_table_from_event(const cJSON* event);
 
+// Forward declarations for tag parsing utilities
+const char* get_first_tag_name(cJSON* event);
+const char* get_tag_value(cJSON* event, const char* tag_name, int value_index);
+int parse_auth_query_parameters(cJSON* event, char** query_type, char** pattern_value);
+
+
 // Current configuration cache
 static cJSON* g_current_config = NULL;
 
@@ -2055,52 +2061,98 @@ int add_pubkeys_to_config_table(void) {
 // ADMIN EVENT PROCESSING FUNCTIONS
 // ================================
 
-// Process admin events (moved from main.c)
-int process_admin_event_in_config(cJSON* event, char* error_message, size_t error_size) {
+// Forward declaration for admin authorization function from main.c
+extern int is_authorized_admin_event(cJSON* event);
+
+// Process admin events (updated for new Kind 23455/23456)
+int process_admin_event_in_config(cJSON* event, char* error_message, size_t error_size, struct lws* wsi) {
     cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
     if (!kind_obj || !cJSON_IsNumber(kind_obj)) {
         snprintf(error_message, error_size, "invalid: missing or invalid kind");
         return -1;
     }
     
-    // Verify admin authorization
-    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
-    if (!pubkey_obj || !cJSON_IsString(pubkey_obj)) {
-        snprintf(error_message, error_size, "invalid: missing pubkey");
-        return -1;
-    }
-    
-    const char* event_pubkey = cJSON_GetStringValue(pubkey_obj);
-    const char* admin_pubkey = get_config_value("admin_pubkey");
-    
-    if (!admin_pubkey || strcmp(event_pubkey, admin_pubkey) != 0) {
+    // DEFENSE-IN-DEPTH: Use comprehensive admin authorization validation
+    if (!is_authorized_admin_event(event)) {
+        // Log the unauthorized attempt for security monitoring
+        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        const char* event_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : "unknown";
+        
+        char log_msg[256];
+        snprintf(log_msg, sizeof(log_msg),
+                "Unauthorized admin event attempt in config processing - pubkey: %.16s...",
+                event_pubkey ? event_pubkey : "null");
+        log_warning(log_msg);
+        
         snprintf(error_message, error_size, "auth-required: not authorized admin");
         return -1;
     }
     
+    // Log successful admin authorization for audit trail
+    log_info("Admin event authorized successfully in config processing");
+    
     int kind = (int)cJSON_GetNumberValue(kind_obj);
     
     switch (kind) {
-        case 33334:
+        case 23455:  // New ephemeral configuration management
             return process_admin_config_event(event, error_message, error_size);
-        case 33335:
-            return process_admin_auth_event(event, error_message, error_size);
+        case 23456:  // New ephemeral auth rules management
+            return process_admin_auth_event(event, error_message, error_size, wsi);
+        case 33334:  // Legacy addressable config events (backward compatibility)
+            return process_admin_config_event(event, error_message, error_size);
+        case 33335:  // Legacy addressable auth events (backward compatibility)
+            return process_admin_auth_event(event, error_message, error_size, wsi);
         default:
-            snprintf(error_message, error_size, "invalid: unsupported admin event kind");
+            snprintf(error_message, error_size, "invalid: unsupported admin event kind %d", kind);
             return -1;
     }
 }
 
-// Handle kind 33334 config events
+// Handle Kind 23455 configuration management events and legacy Kind 33334
 int process_admin_config_event(cJSON* event, char* error_message, size_t error_size) {
+    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+    int kind = kind_obj ? (int)cJSON_GetNumberValue(kind_obj) : 0;
+    
+    log_info("Processing admin configuration event");
+    printf("  Kind: %d\n", kind);
+    
+    // Parse tags to find query commands according to API specification
     cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    if (tags_obj && cJSON_IsArray(tags_obj)) {
+        cJSON* tag = NULL;
+        cJSON_ArrayForEach(tag, tags_obj) {
+            if (!cJSON_IsArray(tag) || cJSON_GetArraySize(tag) < 2) {
+                continue;
+            }
+            
+            cJSON* tag_name = cJSON_GetArrayItem(tag, 0);
+            cJSON* tag_value = cJSON_GetArrayItem(tag, 1);
+            
+            if (!cJSON_IsString(tag_name) || !cJSON_IsString(tag_value)) {
+                continue;
+            }
+            
+            const char* tag_key = cJSON_GetStringValue(tag_name);
+            const char* tag_val = cJSON_GetStringValue(tag_value);
+            
+            // Handle config_query commands per API spec
+            if (strcmp(tag_key, "config_query") == 0) {
+                printf("  Config Query: %s\n", tag_val);
+                
+                // For now, config queries are not implemented in the unified handler
+                // They would need to be added to handle_kind_23455_unified similar to auth queries
+                snprintf(error_message, error_size, "config queries not yet implemented in unified handler");
+                return -1;
+            }
+        }
+    }
+    
+    // Handle configuration updates (set action) - parse remaining tags for config updates
     if (!tags_obj || !cJSON_IsArray(tags_obj)) {
         snprintf(error_message, error_size, "invalid: configuration event must have tags");
         return -1;
     }
     
-    // Config table should already exist from embedded schema
-    
     // Begin transaction for atomic config updates
     int rc = sqlite3_exec(g_db, "BEGIN IMMEDIATE TRANSACTION", NULL, NULL, NULL);
     if (rc != SQLITE_OK) {
@@ -2111,14 +2163,14 @@ int process_admin_config_event(cJSON* event, char* error_message, size_t error_s
     int updates_applied = 0;
     
     // Process each tag as a configuration parameter
-    cJSON* tag = NULL;
-    cJSON_ArrayForEach(tag, tags_obj) {
-        if (!cJSON_IsArray(tag) || cJSON_GetArraySize(tag) < 2) {
+    cJSON* config_tag = NULL;
+    cJSON_ArrayForEach(config_tag, tags_obj) {
+        if (!cJSON_IsArray(config_tag) || cJSON_GetArraySize(config_tag) < 2) {
             continue;
         }
         
-        cJSON* tag_name = cJSON_GetArrayItem(tag, 0);
-        cJSON* tag_value = cJSON_GetArrayItem(tag, 1);
+        cJSON* tag_name = cJSON_GetArrayItem(config_tag, 0);
+        cJSON* tag_value = cJSON_GetArrayItem(config_tag, 1);
         
         if (!cJSON_IsString(tag_name) || !cJSON_IsString(tag_value)) {
             continue;
@@ -2127,8 +2179,13 @@ int process_admin_config_event(cJSON* event, char* error_message, size_t error_s
         const char* key = cJSON_GetStringValue(tag_name);
         const char* value = cJSON_GetStringValue(tag_value);
         
-        // Skip relay identifier tag
-        if (strcmp(key, "d") == 0) {
+        // Skip query commands and system commands - only process config updates
+        if (strcmp(key, "config_query") == 0) {
+            continue;
+        }
+        
+        // Skip relay identifier tag (only for legacy addressable events)
+        if (kind == 33334 && strcmp(key, "d") == 0) {
             continue;
         }
         
@@ -2154,142 +2211,28 @@ int process_admin_config_event(cJSON* event, char* error_message, size_t error_s
     return 0;
 }
 
-// Handle kind 33335 auth rule events
-int process_admin_auth_event(cJSON* event, char* error_message, size_t error_size) {
-    log_info("=== SERVER-SIDE AUTH RULE EVENT DEBUG ===");
+// Handle Kind 23456 auth rules management and legacy Kind 33335
+int process_admin_auth_event(cJSON* event, char* error_message, size_t error_size, struct lws* wsi) {
+    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+    int kind = kind_obj ? (int)cJSON_GetNumberValue(kind_obj) : 0;
     
-    // Print the entire received event for debugging
-    char* debug_event_str = cJSON_Print(event);
-    if (debug_event_str) {
-        printf("Received Auth Event JSON: %s\n", debug_event_str);
-        free(debug_event_str);
+    log_info("Processing admin auth rule event through unified handler");
+    printf("  Kind: %d\n", kind);
+    
+    // Route all Kind 23456 events through the unified handler
+    if (kind == 23456) {
+        return handle_kind_23456_unified(event, error_message, error_size, wsi);
     }
     
-    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
-    if (!tags_obj || !cJSON_IsArray(tags_obj)) {
-        log_error("Auth event missing or invalid tags array");
-        snprintf(error_message, error_size, "invalid: auth rule event must have tags");
-        return -1;
+    // Legacy Kind 33335 events use the unified handler as well
+    if (kind == 33335) {
+        // For legacy events, we still use the unified handler but may need special processing
+        // The unified handler already supports all the functionality
+        return handle_kind_23456_unified(event, error_message, error_size, wsi);
     }
     
-    printf("Tags array size: %d\n", cJSON_GetArraySize(tags_obj));
-    
-    // Extract action from content or tags
-    cJSON* content_obj = cJSON_GetObjectItem(event, "content");
-    const char* content = content_obj ? cJSON_GetStringValue(content_obj) : "";
-    printf("Event content: '%s'\n", content);
-    
-    // Parse the action from content (should be "add" or "remove")
-    cJSON* content_json = cJSON_Parse(content);
-    char action_buffer[16] = "add"; // Local buffer for action string
-    const char* action = action_buffer; // default
-    if (content_json) {
-        cJSON* action_obj = cJSON_GetObjectItem(content_json, "action");
-        if (action_obj && cJSON_IsString(action_obj)) {
-            const char* action_str = cJSON_GetStringValue(action_obj);
-            if (action_str) {
-                strncpy(action_buffer, action_str, sizeof(action_buffer) - 1);
-                action_buffer[sizeof(action_buffer) - 1] = '\0';
-            }
-        }
-        cJSON_Delete(content_json);
-    }
-    printf("Parsed action: '%s'\n", action);
-    
-    // Begin transaction for atomic auth rule updates
-    int rc = sqlite3_exec(g_db, "BEGIN IMMEDIATE TRANSACTION", NULL, NULL, NULL);
-    if (rc != SQLITE_OK) {
-        snprintf(error_message, error_size, "failed to begin auth rule transaction");
-        return -1;
-    }
-    
-    int rules_processed = 0;
-    int tags_examined = 0;
-    int tags_skipped = 0;
-    
-    // Process each tag as an auth rule specification
-    cJSON* tag = NULL;
-    cJSON_ArrayForEach(tag, tags_obj) {
-        tags_examined++;
-        
-        printf("Examining tag #%d:\n", tags_examined);
-        char* tag_debug_str = cJSON_Print(tag);
-        if (tag_debug_str) {
-            printf("  Tag JSON: %s\n", tag_debug_str);
-            free(tag_debug_str);
-        }
-        
-        if (!cJSON_IsArray(tag)) {
-            printf("  SKIPPED: Not an array\n");
-            tags_skipped++;
-            continue;
-        }
-        
-        int tag_size = cJSON_GetArraySize(tag);
-        printf("  Tag array size: %d\n", tag_size);
-        
-        if (tag_size < 3) {
-            printf("  SKIPPED: Array size < 3 (need at least 3 elements for auth rules)\n");
-            tags_skipped++;
-            continue;
-        }
-        
-        cJSON* rule_type_obj = cJSON_GetArrayItem(tag, 0);
-        cJSON* pattern_type_obj = cJSON_GetArrayItem(tag, 1);
-        cJSON* pattern_value_obj = cJSON_GetArrayItem(tag, 2);
-        
-        if (!cJSON_IsString(rule_type_obj) ||
-            !cJSON_IsString(pattern_type_obj) ||
-            !cJSON_IsString(pattern_value_obj)) {
-            printf("  SKIPPED: One or more elements are not strings\n");
-            tags_skipped++;
-            continue;
-        }
-        
-        const char* rule_type = cJSON_GetStringValue(rule_type_obj);
-        const char* pattern_type = cJSON_GetStringValue(pattern_type_obj);
-        const char* pattern_value = cJSON_GetStringValue(pattern_value_obj);
-        
-        printf("  Extracted rule: type='%s', pattern_type='%s', pattern_value='%s'\n",
-               rule_type, pattern_type, pattern_value);
-        
-        // Process the auth rule based on action
-        if (strcmp(action, "add") == 0) {
-            printf("  Attempting to add rule to database...\n");
-            if (add_auth_rule_from_config(rule_type, pattern_type, pattern_value, "allow") == 0) {
-                printf("  SUCCESS: Rule added to database\n");
-                rules_processed++;
-            } else {
-                printf("  FAILED: Could not add rule to database\n");
-            }
-        } else if (strcmp(action, "remove") == 0) {
-            printf("  Attempting to remove rule from database...\n");
-            if (remove_auth_rule_from_config(rule_type, pattern_type, pattern_value) == 0) {
-                printf("  SUCCESS: Rule removed from database\n");
-                rules_processed++;
-            } else {
-                printf("  FAILED: Could not remove rule from database\n");
-            }
-        }
-    }
-    
-    printf("Processing summary: examined=%d, skipped=%d, processed=%d\n",
-           tags_examined, tags_skipped, rules_processed);
-    log_info("=== END SERVER-SIDE AUTH RULE EVENT DEBUG ===");
-    
-    if (rules_processed > 0) {
-        sqlite3_exec(g_db, "COMMIT", NULL, NULL, NULL);
-        
-        char success_msg[256];
-        snprintf(success_msg, sizeof(success_msg), "Processed %d auth rule updates", rules_processed);
-        log_success(success_msg);
-    } else {
-        sqlite3_exec(g_db, "ROLLBACK", NULL, NULL, NULL);
-        snprintf(error_message, error_size, "no valid auth rules found");
-        return -1;
-    }
-    
-    return 0;
+    snprintf(error_message, error_size, "invalid: unsupported auth event kind %d", kind);
+    return -1;
 }
 
 // ================================
@@ -2348,6 +2291,482 @@ int remove_auth_rule_from_config(const char* rule_type, const char* pattern_type
     return (rc == SQLITE_DONE) ? 0 : -1;
 }
 
+// ================================
+// UNIFIED TAG PARSING UTILITIES
+// ================================
+
+// Get the first tag name from an event
+const char* get_first_tag_name(cJSON* event) {
+    if (!event) return NULL;
+    
+    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    if (!tags_obj || !cJSON_IsArray(tags_obj)) return NULL;
+    
+    cJSON* first_tag = cJSON_GetArrayItem(tags_obj, 0);
+    if (!first_tag || !cJSON_IsArray(first_tag) || cJSON_GetArraySize(first_tag) < 1) {
+        return NULL;
+    }
+    
+    cJSON* tag_name = cJSON_GetArrayItem(first_tag, 0);
+    if (!tag_name || !cJSON_IsString(tag_name)) return NULL;
+    
+    return cJSON_GetStringValue(tag_name);
+}
+
+// Get tag value at specified index
+const char* get_tag_value(cJSON* event, const char* tag_name, int value_index) {
+    if (!event || !tag_name) return NULL;
+    
+    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    if (!tags_obj || !cJSON_IsArray(tags_obj)) return NULL;
+    
+    cJSON* tag = NULL;
+    cJSON_ArrayForEach(tag, tags_obj) {
+        if (!cJSON_IsArray(tag) || cJSON_GetArraySize(tag) <= value_index) {
+            continue;
+        }
+        
+        cJSON* tag_key = cJSON_GetArrayItem(tag, 0);
+        if (!tag_key || !cJSON_IsString(tag_key)) continue;
+        
+        if (strcmp(cJSON_GetStringValue(tag_key), tag_name) == 0) {
+            cJSON* tag_value = cJSON_GetArrayItem(tag, value_index);
+            if (tag_value && cJSON_IsString(tag_value)) {
+                return cJSON_GetStringValue(tag_value);
+            }
+        }
+    }
+    return NULL;
+}
+
+// Parse auth query parameters from event tags
+int parse_auth_query_parameters(cJSON* event, char** query_type, char** pattern_value) {
+    if (!event || !query_type) return -1;
+    
+    *query_type = NULL;
+    if (pattern_value) *pattern_value = NULL;
+    
+    const char* query_val = get_tag_value(event, "auth_query", 1);
+    if (query_val) {
+        *query_type = strdup(query_val);
+        
+        // For pattern queries, get the pattern value from the same tag
+        if (strcmp(query_val, "pattern") == 0 && pattern_value) {
+            const char* pattern_val = get_tag_value(event, "auth_query", 2);
+            if (pattern_val) {
+                *pattern_value = strdup(pattern_val);
+            }
+        }
+        return 0;
+    }
+    return -1;
+}
+
+// ================================
+// WEBSOCKET RESPONSE SYSTEM
+// ================================
+
+// Send WebSocket response data back to client
+int send_websocket_response_data(cJSON* event, cJSON* response_data, struct lws* wsi) {
+    if (!event || !response_data || !wsi) return -1;
+    
+    log_info("Sending WebSocket response data to client");
+    
+    // Serialize response data to JSON string
+    char* json_string = cJSON_Print(response_data);
+    if (!json_string) {
+        log_error("Failed to serialize response data to JSON");
+        return -1;
+    }
+    
+    printf("WebSocket Response Data: %s\n", json_string);
+    
+    // Calculate buffer size needed (LWS_PRE + JSON length)
+    size_t json_len = strlen(json_string);
+    size_t buf_size = 512 + json_len; // LWS_PRE is typically ~512 bytes
+    
+    // Allocate buffer with LWS_PRE space
+    unsigned char* buf = malloc(buf_size);
+    if (!buf) {
+        log_error("Failed to allocate WebSocket transmission buffer");
+        free(json_string);
+        return -1;
+    }
+    
+    // Copy JSON data to buffer at LWS_PRE offset
+    memcpy(buf + 512, json_string, json_len); // Using 512 as LWS_PRE equivalent
+    
+    // Implement actual WebSocket transmission using LibWebSockets
+    int write_result = lws_write(wsi, buf + LWS_PRE, json_len, LWS_WRITE_TEXT);
+    
+    if (write_result < 0) {
+        log_error("Failed to write WebSocket response data");
+        free(buf);
+        free(json_string);
+        return -1;
+    } else if ((size_t)write_result != json_len) {
+        log_warning("Partial WebSocket write - not all data transmitted");
+        printf("  Expected: %zu bytes, Written: %d bytes\n", json_len, write_result);
+    } else {
+        log_success("WebSocket response data transmitted successfully");
+        printf("  JSON length: %zu bytes\n", json_len);
+        printf("  Bytes written: %d\n", write_result);
+    }
+    
+    // Clean up
+    free(buf);
+    free(json_string);
+    
+    return 0;
+}
+
+// Build standardized query response
+cJSON* build_query_response(const char* query_type, cJSON* results_array, int total_count) {
+    if (!query_type || !results_array) return NULL;
+    
+    cJSON* response = cJSON_CreateObject();
+    if (!response) return NULL;
+    
+    cJSON_AddStringToObject(response, "query_type", query_type);
+    cJSON_AddNumberToObject(response, "total_results", total_count);
+    cJSON_AddNumberToObject(response, "timestamp", (double)time(NULL));
+    cJSON_AddItemToObject(response, "data", cJSON_Duplicate(results_array, 1));
+    
+    return response;
+}
+
+// ================================
+// UNIFIED KIND 23456 HANDLER
+// ================================
+
+// Single unified handler for all Kind 23456 requests
+int handle_kind_23456_unified(cJSON* event, char* error_message, size_t error_size, struct lws* wsi) {
+    if (!event) {
+        snprintf(error_message, error_size, "invalid: null event");
+        return -1;
+    }
+    
+    log_info("Processing Kind 23456 event through unified handler");
+    
+    // Parse first tag to determine action type
+    const char* action_type = get_first_tag_name(event);
+    if (!action_type) {
+        snprintf(error_message, error_size, "invalid: missing or invalid first tag");
+        return -1;
+    }
+    
+    printf("  Action type: %s\n", action_type);
+    
+    // Route to appropriate handler based on action type
+    if (strcmp(action_type, "auth_query") == 0) {
+        const char* query_type = get_tag_value(event, "auth_query", 1);
+        if (!query_type) {
+            snprintf(error_message, error_size, "invalid: missing auth_query type");
+            return -1;
+        }
+        return handle_auth_query_unified(event, query_type, error_message, error_size, wsi);
+    }
+    else if (strcmp(action_type, "system_command") == 0) {
+        const char* command = get_tag_value(event, "system_command", 1);
+        if (!command) {
+            snprintf(error_message, error_size, "invalid: missing system_command type");
+            return -1;
+        }
+        return handle_system_command_unified(event, command, error_message, error_size, wsi);
+    }
+    else if (strcmp(action_type, "whitelist") == 0 || strcmp(action_type, "blacklist") == 0) {
+        // Handle auth rule modifications (existing logic from process_admin_auth_event)
+        return handle_auth_rule_modification_unified(event, error_message, error_size);
+    }
+    else {
+        snprintf(error_message, error_size, "invalid: unknown Kind 23456 action type '%s'", action_type);
+        return -1;
+    }
+}
+
+// Unified auth query handler
+int handle_auth_query_unified(cJSON* event, const char* query_type, char* error_message, size_t error_size, struct lws* wsi) {
+    if (!g_db) {
+        snprintf(error_message, error_size, "database not available");
+        return -1;
+    }
+    
+    log_info("Processing unified auth query");
+    printf("  Query type: %s\n", query_type);
+    
+    const char* sql = NULL;
+    int use_pattern_param = 0;
+    char* pattern_value = NULL;
+    
+    // Build appropriate SQL query based on query type
+    if (strcmp(query_type, "all") == 0) {
+        sql = "SELECT rule_type, pattern_type, pattern_value, action FROM auth_rules ORDER BY rule_type, pattern_type";
+    }
+    else if (strcmp(query_type, "whitelist") == 0) {
+        sql = "SELECT rule_type, pattern_type, pattern_value, action FROM auth_rules WHERE rule_type LIKE '%whitelist%' ORDER BY pattern_type";
+    }
+    else if (strcmp(query_type, "blacklist") == 0) {
+        sql = "SELECT rule_type, pattern_type, pattern_value, action FROM auth_rules WHERE rule_type LIKE '%blacklist%' ORDER BY pattern_type";
+    }
+    else if (strcmp(query_type, "pattern") == 0) {
+        // Get pattern value from tags
+        pattern_value = (char*)get_tag_value(event, "auth_query", 2);
+        if (!pattern_value) {
+            snprintf(error_message, error_size, "invalid: pattern query requires pattern value");
+            return -1;
+        }
+        sql = "SELECT rule_type, pattern_type, pattern_value, action FROM auth_rules WHERE pattern_value = ? ORDER BY rule_type, pattern_type";
+        use_pattern_param = 1;
+    }
+    else {
+        snprintf(error_message, error_size, "invalid: unknown auth query type '%s'", query_type);
+        return -1;
+    }
+    
+    // Execute query
+    sqlite3_stmt* stmt;
+    int rc = sqlite3_prepare_v2(g_db, sql, -1, &stmt, NULL);
+    if (rc != SQLITE_OK) {
+        snprintf(error_message, error_size, "failed to prepare auth query");
+        return -1;
+    }
+    
+    if (use_pattern_param && pattern_value) {
+        sqlite3_bind_text(stmt, 1, pattern_value, -1, SQLITE_STATIC);
+    }
+    
+    // Build results array
+    cJSON* results_array = cJSON_CreateArray();
+    if (!results_array) {
+        sqlite3_finalize(stmt);
+        snprintf(error_message, error_size, "failed to create results array");
+        return -1;
+    }
+    
+    int rule_count = 0;
+    printf("=== Auth Query Results (%s) ===\n", query_type);
+    
+    while (sqlite3_step(stmt) == SQLITE_ROW) {
+        const char* rule_type = (const char*)sqlite3_column_text(stmt, 0);
+        const char* pattern_type = (const char*)sqlite3_column_text(stmt, 1);
+        const char* pattern_value_result = (const char*)sqlite3_column_text(stmt, 2);
+        const char* action = (const char*)sqlite3_column_text(stmt, 3);
+        
+        printf("  %s %s:%s -> %s\n",
+               rule_type ? rule_type : "",
+               pattern_type ? pattern_type : "",
+               pattern_value_result ? pattern_value_result : "",
+               action ? action : "allow");
+        
+        // Add rule to results array
+        cJSON* rule_obj = cJSON_CreateObject();
+        cJSON_AddStringToObject(rule_obj, "rule_type", rule_type ? rule_type : "");
+        cJSON_AddStringToObject(rule_obj, "pattern_type", pattern_type ? pattern_type : "");
+        cJSON_AddStringToObject(rule_obj, "pattern_value", pattern_value_result ? pattern_value_result : "");
+        cJSON_AddStringToObject(rule_obj, "action", action ? action : "allow");
+        cJSON_AddItemToArray(results_array, rule_obj);
+        
+        rule_count++;
+    }
+    
+    sqlite3_finalize(stmt);
+    
+    // Build and send response
+    cJSON* response = build_query_response(query_type, results_array, rule_count);
+    if (response) {
+        // Send response data via WebSocket
+        if (send_websocket_response_data(event, response, wsi) == 0) {
+            printf("Total results: %d\n", rule_count);
+            log_success("Auth query completed successfully with WebSocket response");
+            cJSON_Delete(response);
+            cJSON_Delete(results_array);
+            return 0;
+        }
+        cJSON_Delete(response);
+    }
+    
+    cJSON_Delete(results_array);
+    snprintf(error_message, error_size, "failed to send auth query response");
+    return -1;
+}
+
+// Unified system command handler
+int handle_system_command_unified(cJSON* event, const char* command, char* error_message, size_t error_size, struct lws* wsi) {
+    if (!g_db) {
+        snprintf(error_message, error_size, "database not available");
+        return -1;
+    }
+    
+    log_info("Processing unified system command");
+    printf("  Command: %s\n", command);
+    
+    if (strcmp(command, "clear_all_auth_rules") == 0) {
+        // Count existing rules first
+        const char* count_sql = "SELECT COUNT(*) FROM auth_rules";
+        sqlite3_stmt* count_stmt;
+        
+        int rc = sqlite3_prepare_v2(g_db, count_sql, -1, &count_stmt, NULL);
+        if (rc != SQLITE_OK) {
+            snprintf(error_message, error_size, "failed to prepare count query");
+            return -1;
+        }
+        
+        int rule_count = 0;
+        if (sqlite3_step(count_stmt) == SQLITE_ROW) {
+            rule_count = sqlite3_column_int(count_stmt, 0);
+        }
+        sqlite3_finalize(count_stmt);
+        
+        // Delete all auth rules
+        const char* delete_sql = "DELETE FROM auth_rules";
+        rc = sqlite3_exec(g_db, delete_sql, NULL, NULL, NULL);
+        
+        if (rc != SQLITE_OK) {
+            snprintf(error_message, error_size, "failed to execute clear auth rules command");
+            return -1;
+        }
+        
+        // Build response
+        cJSON* response = cJSON_CreateObject();
+        cJSON_AddStringToObject(response, "command", "clear_all_auth_rules");
+        cJSON_AddNumberToObject(response, "rules_cleared", rule_count);
+        cJSON_AddStringToObject(response, "status", "success");
+        cJSON_AddNumberToObject(response, "timestamp", (double)time(NULL));
+        
+        printf("Cleared %d auth rules from database\n", rule_count);
+        
+        // Send response via WebSocket
+        if (send_websocket_response_data(event, response, wsi) == 0) {
+            log_success("Clear auth rules command completed successfully");
+            cJSON_Delete(response);
+            return 0;
+        }
+        
+        cJSON_Delete(response);
+        snprintf(error_message, error_size, "failed to send clear auth rules response");
+        return -1;
+    }
+    else if (strcmp(command, "system_status") == 0) {
+        // Build system status response
+        cJSON* response = cJSON_CreateObject();
+        cJSON_AddStringToObject(response, "command", "system_status");
+        cJSON_AddNumberToObject(response, "timestamp", (double)time(NULL));
+        
+        cJSON* status_data = cJSON_CreateObject();
+        cJSON_AddStringToObject(status_data, "database", g_db ? "connected" : "not_available");
+        cJSON_AddStringToObject(status_data, "cache_status", g_unified_cache.cache_valid ? "valid" : "invalid");
+        
+        if (strlen(g_database_path) > 0) {
+            cJSON_AddStringToObject(status_data, "database_path", g_database_path);
+        }
+        
+        // Count configuration items and auth rules
+        if (g_db) {
+            sqlite3_stmt* stmt;
+            
+            // Config count
+            if (sqlite3_prepare_v2(g_db, "SELECT COUNT(*) FROM config", -1, &stmt, NULL) == SQLITE_OK) {
+                if (sqlite3_step(stmt) == SQLITE_ROW) {
+                    cJSON_AddNumberToObject(status_data, "config_items", sqlite3_column_int(stmt, 0));
+                }
+                sqlite3_finalize(stmt);
+            }
+            
+            // Auth rules count
+            if (sqlite3_prepare_v2(g_db, "SELECT COUNT(*) FROM auth_rules", -1, &stmt, NULL) == SQLITE_OK) {
+                if (sqlite3_step(stmt) == SQLITE_ROW) {
+                    cJSON_AddNumberToObject(status_data, "auth_rules", sqlite3_column_int(stmt, 0));
+                }
+                sqlite3_finalize(stmt);
+            }
+        }
+        
+        cJSON_AddItemToObject(response, "data", status_data);
+        
+        printf("=== System Status ===\n");
+        printf("Database: %s\n", g_db ? "Connected" : "Not available");
+        printf("Cache status: %s\n", g_unified_cache.cache_valid ? "Valid" : "Invalid");
+        
+        // Send response via WebSocket
+        if (send_websocket_response_data(event, response, wsi) == 0) {
+            log_success("System status query completed successfully");
+            cJSON_Delete(response);
+            return 0;
+        }
+        
+        cJSON_Delete(response);
+        snprintf(error_message, error_size, "failed to send system status response");
+        return -1;
+    }
+    else {
+        snprintf(error_message, error_size, "invalid: unknown system command '%s'", command);
+        return -1;
+    }
+}
+
+// Handle auth rule modifications (extracted from process_admin_auth_event)
+int handle_auth_rule_modification_unified(cJSON* event, char* error_message, size_t error_size) {
+    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    if (!tags_obj || !cJSON_IsArray(tags_obj)) {
+        snprintf(error_message, error_size, "invalid: auth rule event must have tags");
+        return -1;
+    }
+    
+    // Begin transaction for atomic auth rule updates
+    int rc = sqlite3_exec(g_db, "BEGIN IMMEDIATE TRANSACTION", NULL, NULL, NULL);
+    if (rc != SQLITE_OK) {
+        snprintf(error_message, error_size, "failed to begin auth rule transaction");
+        return -1;
+    }
+    
+    int rules_processed = 0;
+    
+    // Process each tag as an auth rule specification
+    cJSON* auth_tag = NULL;
+    cJSON_ArrayForEach(auth_tag, tags_obj) {
+        if (!cJSON_IsArray(auth_tag) || cJSON_GetArraySize(auth_tag) < 3) {
+            continue;
+        }
+        
+        cJSON* rule_type_obj = cJSON_GetArrayItem(auth_tag, 0);
+        cJSON* pattern_type_obj = cJSON_GetArrayItem(auth_tag, 1);
+        cJSON* pattern_value_obj = cJSON_GetArrayItem(auth_tag, 2);
+        
+        if (!cJSON_IsString(rule_type_obj) ||
+            !cJSON_IsString(pattern_type_obj) ||
+            !cJSON_IsString(pattern_value_obj)) {
+            continue;
+        }
+        
+        const char* rule_type = cJSON_GetStringValue(rule_type_obj);
+        const char* pattern_type = cJSON_GetStringValue(pattern_type_obj);
+        const char* pattern_value = cJSON_GetStringValue(pattern_value_obj);
+        
+        // Process auth rule: ["blacklist"|"whitelist", "pubkey"|"hash", "value"]
+        if (strcmp(rule_type, "blacklist") == 0 || strcmp(rule_type, "whitelist") == 0) {
+            if (add_auth_rule_from_config(rule_type, pattern_type, pattern_value, "allow") == 0) {
+                rules_processed++;
+            }
+        }
+    }
+    
+    if (rules_processed > 0) {
+        sqlite3_exec(g_db, "COMMIT", NULL, NULL, NULL);
+        
+        char success_msg[256];
+        snprintf(success_msg, sizeof(success_msg), "Processed %d auth rule updates", rules_processed);
+        log_success(success_msg);
+        
+        return 0;
+    } else {
+        sqlite3_exec(g_db, "ROLLBACK", NULL, NULL, NULL);
+        snprintf(error_message, error_size, "no valid auth rules found");
+        return -1;
+    }
+}
+
+
+
 // ================================
 // CONFIGURATION CACHE MANAGEMENT
 // ================================

src/config.h

@@ -6,6 +6,9 @@
 #include <time.h>
 #include <pthread.h>
 
+// Forward declaration for WebSocket support
+struct lws;
+
 // Configuration constants
 #define CONFIG_VALUE_MAX_LENGTH 1024
 #define RELAY_NAME_MAX_LENGTH 256
@@ -160,10 +163,20 @@ int update_config_in_table(const char* key, const char* value);
 int populate_default_config_values(void);
 int add_pubkeys_to_config_table(void);
 
-// Admin event processing functions
-int process_admin_event_in_config(cJSON* event, char* error_message, size_t error_size);
+// Admin event processing functions (updated with WebSocket support)
+int process_admin_event_in_config(cJSON* event, char* error_message, size_t error_size, struct lws* wsi);
 int process_admin_config_event(cJSON* event, char* error_message, size_t error_size);
-int process_admin_auth_event(cJSON* event, char* error_message, size_t error_size);
+int process_admin_auth_event(cJSON* event, char* error_message, size_t error_size, struct lws* wsi);
+
+// Unified Kind 23456 handler functions
+int handle_kind_23456_unified(cJSON* event, char* error_message, size_t error_size, struct lws* wsi);
+int handle_auth_query_unified(cJSON* event, const char* query_type, char* error_message, size_t error_size, struct lws* wsi);
+int handle_system_command_unified(cJSON* event, const char* command, char* error_message, size_t error_size, struct lws* wsi);
+int handle_auth_rule_modification_unified(cJSON* event, char* error_message, size_t error_size);
+
+// WebSocket response functions
+int send_websocket_response_data(cJSON* event, cJSON* response_data, struct lws* wsi);
+cJSON* build_query_response(const char* query_type, cJSON* results_array, int total_count);
 
 // Auth rules management functions
 int add_auth_rule_from_config(const char* rule_type, const char* pattern_type,

src/main.c

@@ -228,7 +228,10 @@ int nostr_validate_unified_request(const char* json_string, size_t json_length);
 int handle_configuration_event(cJSON* event, char* error_message, size_t error_size);
 
 // Forward declaration for admin event processing (kinds 33334 and 33335)
-int process_admin_event_in_config(cJSON* event, char* error_message, size_t error_size);
+int process_admin_event_in_config(cJSON* event, char* error_message, size_t error_size, struct lws* wsi);
+
+// Forward declaration for enhanced admin event authorization
+int is_authorized_admin_event(cJSON* event, char* error_message, size_t error_size);
 
 // Forward declaration for NOTICE message support
 void send_notice_message(struct lws* wsi, const char* message);
@@ -972,28 +975,28 @@ static void get_timestamp_string(char* buffer, size_t buffer_size) {
 void log_info(const char* message) {
     char timestamp[32];
     get_timestamp_string(timestamp, sizeof(timestamp));
-    printf("[%s] " BLUE "[INFO]" RESET " %s\n", timestamp, message);
+    printf("[%s] [INFO] %s\n", timestamp, message);
     fflush(stdout);
 }
 
 void log_success(const char* message) {
     char timestamp[32];
     get_timestamp_string(timestamp, sizeof(timestamp));
-    printf("[%s] " GREEN "[SUCCESS]" RESET " %s\n", timestamp, message);
+    printf("[%s] [SUCCESS] %s\n", timestamp, message);
     fflush(stdout);
 }
 
 void log_error(const char* message) {
     char timestamp[32];
     get_timestamp_string(timestamp, sizeof(timestamp));
-    printf("[%s] " RED "[ERROR]" RESET " %s\n", timestamp, message);
+    printf("[%s] [ERROR] %s\n", timestamp, message);
     fflush(stdout);
 }
 
 void log_warning(const char* message) {
     char timestamp[32];
     get_timestamp_string(timestamp, sizeof(timestamp));
-    printf("[%s] " YELLOW "[WARNING]" RESET " %s\n", timestamp, message);
+    printf("[%s] [WARNING] %s\n", timestamp, message);
     fflush(stdout);
 }
 
@@ -3009,6 +3012,109 @@ int handle_req_message(const char* sub_id, cJSON* filters, struct lws *wsi, stru
     
     return events_sent;
 }
+/////////////////////////////////////////////////////////////////////////////////////////
+/////////////////////////////////////////////////////////////////////////////////////////
+//             ADMIN EVENT AUTHORIZATION
+/////////////////////////////////////////////////////////////////////////////////////////
+/////////////////////////////////////////////////////////////////////////////////////////
+
+// Enhanced admin event authorization function
+int is_authorized_admin_event(cJSON* event, char* error_buffer, size_t error_buffer_size) {
+    if (!event || !error_buffer) {
+        if (error_buffer && error_buffer_size > 0) {
+            snprintf(error_buffer, error_buffer_size, "Invalid parameters for admin authorization");
+        }
+        return -1;
+    }
+    
+    // Step 1: Verify event kind is admin type
+    cJSON *kind_json = cJSON_GetObjectItem(event, "kind");
+    if (!kind_json || !cJSON_IsNumber(kind_json)) {
+        snprintf(error_buffer, error_buffer_size, "Missing or invalid event kind");
+        return -1;
+    }
+    
+    int event_kind = kind_json->valueint;
+    if (event_kind != 33334 && event_kind != 33335 && event_kind != 23455 && event_kind != 23456) {
+        snprintf(error_buffer, error_buffer_size, "Event kind %d is not an admin event type", event_kind);
+        return -1;
+    }
+    
+    // Step 2: Check if event targets this relay (look for 'p' tag with our relay pubkey)
+    cJSON *tags = cJSON_GetObjectItem(event, "tags");
+    if (!tags || !cJSON_IsArray(tags)) {
+        // No tags array - treat as regular event for different relay
+        log_info("Admin event has no tags array - treating as event for different relay");
+        snprintf(error_buffer, error_buffer_size, "Admin event not targeting this relay (no tags)");
+        return -1;
+    }
+    
+    int targets_this_relay = 0;
+    cJSON *tag;
+    cJSON_ArrayForEach(tag, tags) {
+        if (cJSON_IsArray(tag)) {
+            cJSON *tag_name = cJSON_GetArrayItem(tag, 0);
+            cJSON *tag_value = cJSON_GetArrayItem(tag, 1);
+            
+            if (tag_name && cJSON_IsString(tag_name) &&
+                tag_value && cJSON_IsString(tag_value) &&
+                strcmp(tag_name->valuestring, "p") == 0) {
+                
+                // Compare with our relay pubkey
+                const char* relay_pubkey = get_config_value("relay_pubkey");
+                if (relay_pubkey && strcmp(tag_value->valuestring, relay_pubkey) == 0) {
+                    targets_this_relay = 1;
+                    break;
+                }
+            }
+        }
+    }
+    
+    if (!targets_this_relay) {
+        // Admin event for different relay - not an error, just not for us
+        log_info("Admin event targets different relay - treating as regular event");
+        snprintf(error_buffer, error_buffer_size, "Admin event not targeting this relay");
+        return -1;
+    }
+    
+    // Step 3: Verify admin signature authorization
+    cJSON *pubkey_json = cJSON_GetObjectItem(event, "pubkey");
+    if (!pubkey_json || !cJSON_IsString(pubkey_json)) {
+        log_warning("Unauthorized admin event attempt: missing or invalid pubkey");
+        snprintf(error_buffer, error_buffer_size, "Unauthorized admin event attempt: missing pubkey");
+        return -1;
+    }
+    
+    // Get admin pubkey from configuration
+    const char* admin_pubkey = get_config_value("admin_pubkey");
+    if (!admin_pubkey || strlen(admin_pubkey) == 0) {
+        log_warning("Unauthorized admin event attempt: no admin pubkey configured");
+        snprintf(error_buffer, error_buffer_size, "Unauthorized admin event attempt: no admin configured");
+        return -1;
+    }
+    
+    // Compare pubkeys
+    if (strcmp(pubkey_json->valuestring, admin_pubkey) != 0) {
+        log_warning("Unauthorized admin event attempt: pubkey mismatch");
+        char warning_msg[256];
+        snprintf(warning_msg, sizeof(warning_msg), 
+                "Unauthorized admin event attempt from pubkey: %.32s...", pubkey_json->valuestring);
+        log_warning(warning_msg);
+        snprintf(error_buffer, error_buffer_size, "Unauthorized admin event attempt: invalid admin pubkey");
+        return -1;
+    }
+    
+    // Step 4: Verify event signature
+    if (nostr_verify_event_signature(event) != 0) {
+        log_warning("Unauthorized admin event attempt: invalid signature");
+        snprintf(error_buffer, error_buffer_size, "Unauthorized admin event attempt: signature verification failed");
+        return -1;
+    }
+    
+    // All checks passed - authorized admin event
+    log_info("Admin event authorization successful");
+    return 0;
+}
 
 
 
@@ -3243,7 +3349,7 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                     // Cleanup event JSON string
                                     free(event_json_str);
                                     
-                                    // Check for admin events (kinds 33334 and 33335) and intercept them
+                                    // Check for admin events (kinds 33334, 33335, 23455, and 23456) and intercept them
                                     if (result == 0) {
                                         cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
                                         if (kind_obj && cJSON_IsNumber(kind_obj)) {
@@ -3251,33 +3357,83 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                             
                                             log_info("DEBUG ADMIN: Checking if admin event processing is needed");
                                             
-                                            if (event_kind == 33334 || event_kind == 33335) {
-                                                // This is an admin event - process it through the admin API instead of normal storage
-                                                log_info("DEBUG ADMIN: Admin event detected, processing through admin API");
+                                            // Log reception of Kind 23455 and 23456 events
+                                            if (event_kind == 23455 || event_kind == 23456) {
+                                                char* event_json_debug = cJSON_Print(event);
+                                                char debug_received_msg[1024];
+                                                snprintf(debug_received_msg, sizeof(debug_received_msg),
+                                                        "RECEIVED Kind %d event: %s", event_kind,
+                                                        event_json_debug ? event_json_debug : "Failed to serialize");
+                                                log_info(debug_received_msg);
                                                 
-                                                char admin_error[512] = {0};
-                                                int admin_result = process_admin_event_in_config(event, admin_error, sizeof(admin_error));
+                                                if (event_json_debug) {
+                                                    free(event_json_debug);
+                                                }
+                                            }
+                                            
+                                            if (event_kind == 33334 || event_kind == 33335 || event_kind == 23455 || event_kind == 23456) {
+                                                // Enhanced admin event security - check authorization first
+                                                log_info("DEBUG ADMIN: Admin event detected, checking authorization");
                                                 
-                                                char debug_admin_msg[256];
-                                                snprintf(debug_admin_msg, sizeof(debug_admin_msg),
-                                                        "DEBUG ADMIN: process_admin_event_in_config returned %d", admin_result);
-                                                log_info(debug_admin_msg);
+                                                char auth_error[512] = {0};
+                                                int auth_result = is_authorized_admin_event(event, auth_error, sizeof(auth_error));
                                                 
-                                                if (admin_result != 0) {
-                                                    log_error("DEBUG ADMIN: Failed to process admin event through admin API");
+                                                if (auth_result != 0) {
+                                                    // Authorization failed - log and reject
+                                                    log_warning("DEBUG ADMIN: Admin event authorization failed");
                                                     result = -1;
-                                                    size_t error_len = strlen(admin_error);
+                                                    size_t error_len = strlen(auth_error);
                                                     size_t copy_len = (error_len < sizeof(error_message) - 1) ? error_len : sizeof(error_message) - 1;
-                                                    memcpy(error_message, admin_error, copy_len);
+                                                    memcpy(error_message, auth_error, copy_len);
                                                     error_message[copy_len] = '\0';
                                                     
-                                                    char debug_admin_error_msg[600];
-                                                    snprintf(debug_admin_error_msg, sizeof(debug_admin_error_msg),
-                                                            "DEBUG ADMIN ERROR: %.400s", admin_error);
-                                                    log_error(debug_admin_error_msg);
+                                                    char debug_auth_error_msg[600];
+                                                    snprintf(debug_auth_error_msg, sizeof(debug_auth_error_msg),
+                                                            "DEBUG ADMIN AUTH ERROR: %.400s", auth_error);
+                                                    log_warning(debug_auth_error_msg);
                                                 } else {
-                                                    log_success("DEBUG ADMIN: Admin event processed successfully through admin API");
-                                                    // Admin events are processed by the admin API, not broadcast to subscriptions
+                                                    // Authorization successful - process through admin API
+                                                    log_info("DEBUG ADMIN: Admin event authorized, processing through admin API");
+                                                    
+                                                    char admin_error[512] = {0};
+                                                    int admin_result = process_admin_event_in_config(event, admin_error, sizeof(admin_error), wsi);
+                                                    
+                                                    char debug_admin_msg[256];
+                                                    snprintf(debug_admin_msg, sizeof(debug_admin_msg),
+                                                            "DEBUG ADMIN: process_admin_event_in_config returned %d", admin_result);
+                                                    log_info(debug_admin_msg);
+                                                    
+                                                    // Log results for Kind 23455 and 23456 events
+                                                    if (event_kind == 23455 || event_kind == 23456) {
+                                                        if (admin_result == 0) {
+                                                            char success_result_msg[256];
+                                                            snprintf(success_result_msg, sizeof(success_result_msg),
+                                                                    "SUCCESS: Kind %d event processed successfully", event_kind);
+                                                            log_success(success_result_msg);
+                                                        } else {
+                                                            char error_result_msg[512];
+                                                            snprintf(error_result_msg, sizeof(error_result_msg),
+                                                                    "ERROR: Kind %d event processing failed: %s", event_kind, admin_error);
+                                                            log_error(error_result_msg);
+                                                        }
+                                                    }
+                                                    
+                                                    if (admin_result != 0) {
+                                                        log_error("DEBUG ADMIN: Failed to process admin event through admin API");
+                                                        result = -1;
+                                                        size_t error_len = strlen(admin_error);
+                                                        size_t copy_len = (error_len < sizeof(error_message) - 1) ? error_len : sizeof(error_message) - 1;
+                                                        memcpy(error_message, admin_error, copy_len);
+                                                        error_message[copy_len] = '\0';
+                                                        
+                                                        char debug_admin_error_msg[600];
+                                                        snprintf(debug_admin_error_msg, sizeof(debug_admin_error_msg),
+                                                                "DEBUG ADMIN ERROR: %.400s", admin_error);
+                                                        log_error(debug_admin_error_msg);
+                                                    } else {
+                                                        log_success("DEBUG ADMIN: Admin event processed successfully through admin API");
+                                                        // Admin events are processed by the admin API, not broadcast to subscriptions
+                                                    }
                                                 }
                                             } else {
                                                 // Regular event - store in database and broadcast

src/request_validator.c

@@ -629,28 +629,26 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,
 
   // Step 1: Check pubkey blacklist (highest priority)
   const char *blacklist_sql =
-      "SELECT rule_type, description FROM auth_rules WHERE rule_type = "
-      "'pubkey_blacklist' AND rule_target = ? AND operation = ? AND enabled = "
-      "1 ORDER BY priority LIMIT 1";
+      "SELECT rule_type, action FROM auth_rules WHERE rule_type = "
+      "'blacklist' AND pattern_type = 'pubkey' AND pattern_value = ? LIMIT 1";
   rc = sqlite3_prepare_v2(db, blacklist_sql, -1, &stmt, NULL);
   if (rc == SQLITE_OK) {
     sqlite3_bind_text(stmt, 1, pubkey, -1, SQLITE_STATIC);
-    sqlite3_bind_text(stmt, 2, operation ? operation : "", -1, SQLITE_STATIC);
 
     if (sqlite3_step(stmt) == SQLITE_ROW) {
-      const char *description = (const char *)sqlite3_column_text(stmt, 1);
+      const char *action = (const char *)sqlite3_column_text(stmt, 1);
       validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 1 FAILED - "
                           "Pubkey blacklisted\n");
       char blacklist_msg[256];
       sprintf(blacklist_msg,
-              "VALIDATOR_DEBUG: RULES ENGINE - Blacklist rule matched: %s\n",
-              description ? description : "Unknown");
+              "VALIDATOR_DEBUG: RULES ENGINE - Blacklist rule matched: action=%s\n",
+              action ? action : "deny");
       validator_debug_log(blacklist_msg);
 
       // Set specific violation details for status code mapping
       strcpy(g_last_rule_violation.violation_type, "pubkey_blacklist");
-      sprintf(g_last_rule_violation.reason, "%s: Public key blacklisted",
-              description ? description : "TEST_PUBKEY_BLACKLIST");
+      sprintf(g_last_rule_violation.reason, "Public key blacklisted: %s",
+              action ? action : "PUBKEY_BLACKLIST");
 
       sqlite3_finalize(stmt);
       sqlite3_close(db);
@@ -664,29 +662,27 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,
   // Step 2: Check hash blacklist
   if (resource_hash) {
     const char *hash_blacklist_sql =
-        "SELECT rule_type, description FROM auth_rules WHERE rule_type = "
-        "'hash_blacklist' AND rule_target = ? AND operation = ? AND enabled = "
-        "1 ORDER BY priority LIMIT 1";
+        "SELECT rule_type, action FROM auth_rules WHERE rule_type = "
+        "'blacklist' AND pattern_type = 'hash' AND pattern_value = ? LIMIT 1";
     rc = sqlite3_prepare_v2(db, hash_blacklist_sql, -1, &stmt, NULL);
     if (rc == SQLITE_OK) {
       sqlite3_bind_text(stmt, 1, resource_hash, -1, SQLITE_STATIC);
-      sqlite3_bind_text(stmt, 2, operation ? operation : "", -1, SQLITE_STATIC);
 
       if (sqlite3_step(stmt) == SQLITE_ROW) {
-        const char *description = (const char *)sqlite3_column_text(stmt, 1);
+        const char *action = (const char *)sqlite3_column_text(stmt, 1);
         validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 2 FAILED - "
                             "Hash blacklisted\n");
         char hash_blacklist_msg[256];
         sprintf(
             hash_blacklist_msg,
-            "VALIDATOR_DEBUG: RULES ENGINE - Hash blacklist rule matched: %s\n",
-            description ? description : "Unknown");
+            "VALIDATOR_DEBUG: RULES ENGINE - Hash blacklist rule matched: action=%s\n",
+            action ? action : "deny");
         validator_debug_log(hash_blacklist_msg);
 
         // Set specific violation details for status code mapping
         strcpy(g_last_rule_violation.violation_type, "hash_blacklist");
-        sprintf(g_last_rule_violation.reason, "%s: File hash blacklisted",
-                description ? description : "TEST_HASH_BLACKLIST");
+        sprintf(g_last_rule_violation.reason, "File hash blacklisted: %s",
+                action ? action : "HASH_BLACKLIST");
 
         sqlite3_finalize(stmt);
         sqlite3_close(db);
@@ -703,22 +699,20 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,
 
   // Step 3: Check pubkey whitelist
   const char *whitelist_sql =
-      "SELECT rule_type, description FROM auth_rules WHERE rule_type = "
-      "'pubkey_whitelist' AND rule_target = ? AND operation = ? AND enabled = "
-      "1 ORDER BY priority LIMIT 1";
+      "SELECT rule_type, action FROM auth_rules WHERE rule_type = "
+      "'whitelist' AND pattern_type = 'pubkey' AND pattern_value = ? LIMIT 1";
   rc = sqlite3_prepare_v2(db, whitelist_sql, -1, &stmt, NULL);
   if (rc == SQLITE_OK) {
     sqlite3_bind_text(stmt, 1, pubkey, -1, SQLITE_STATIC);
-    sqlite3_bind_text(stmt, 2, operation ? operation : "", -1, SQLITE_STATIC);
 
     if (sqlite3_step(stmt) == SQLITE_ROW) {
-      const char *description = (const char *)sqlite3_column_text(stmt, 1);
+      const char *action = (const char *)sqlite3_column_text(stmt, 1);
       validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 3 PASSED - "
                           "Pubkey whitelisted\n");
       char whitelist_msg[256];
       sprintf(whitelist_msg,
-              "VALIDATOR_DEBUG: RULES ENGINE - Whitelist rule matched: %s\n",
-              description ? description : "Unknown");
+              "VALIDATOR_DEBUG: RULES ENGINE - Whitelist rule matched: action=%s\n",
+              action ? action : "allow");
       validator_debug_log(whitelist_msg);
       sqlite3_finalize(stmt);
       sqlite3_close(db);
@@ -731,12 +725,10 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,
 
   // Step 4: Check if any whitelist rules exist - if yes, deny by default
   const char *whitelist_exists_sql =
-      "SELECT COUNT(*) FROM auth_rules WHERE rule_type = 'pubkey_whitelist' "
-      "AND operation = ? AND enabled = 1 LIMIT 1";
+      "SELECT COUNT(*) FROM auth_rules WHERE rule_type = 'whitelist' "
+      "AND pattern_type = 'pubkey' LIMIT 1";
   rc = sqlite3_prepare_v2(db, whitelist_exists_sql, -1, &stmt, NULL);
   if (rc == SQLITE_OK) {
-    sqlite3_bind_text(stmt, 1, operation ? operation : "", -1, SQLITE_STATIC);
-
     if (sqlite3_step(stmt) == SQLITE_ROW) {
       int whitelist_count = sqlite3_column_int(stmt, 0);
       if (whitelist_count > 0) {

tests/white_black_list_test.sh

@@ -20,21 +20,27 @@ set -e  # Exit on any error
 # CONFIGURATION
 # =======================================================================
 
-# Test mode credentials (provided by user)
+# Test mode credentials (from current relay startup)
 ADMIN_PRIVKEY="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
 ADMIN_PUBKEY="6a04ab98d9e4774ad806e302dddeb63bea16b5cb5f223ee77478e861bb583eb3"
 RELAY_PUBKEY="4f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa"
 
 # Server configuration
-RELAY_HOST="localhost"
+RELAY_HOST="127.0.0.1"
 RELAY_PORT="8888"
 RELAY_URL="ws://${RELAY_HOST}:${RELAY_PORT}"
 
 # Test configuration
 TIMEOUT=5
-LOG_FILE="whitelist_blacklist_test.log"
 TEMP_DIR="/tmp/c_relay_test_$$"
 
+# WebSocket connection state
+WS_PID=""
+WS_INPUT_FIFO=""
+WS_OUTPUT_FIFO=""
+WS_CONNECTED=0
+WS_RESPONSE_LOG=""
+
 # Color codes for output
 RED='\033[0;31m'
 GREEN='\033[0;32m'
@@ -53,23 +59,23 @@ TESTS_FAILED=0
 # =======================================================================
 
 log() {
-    echo -e "${BLUE}[$(date '+%H:%M:%S')]${RESET} $1" | tee -a "$LOG_FILE"
+    echo -e "${BLUE}[$(date '+%H:%M:%S')]${RESET} $1"
 }
 
 log_success() {
-    echo -e "${GREEN}[SUCCESS]${RESET} $1" | tee -a "$LOG_FILE"
+    echo -e "${GREEN}[SUCCESS]${RESET} $1"
 }
 
 log_error() {
-    echo -e "${RED}[ERROR]${RESET} $1" | tee -a "$LOG_FILE"
+    echo -e "${RED}[ERROR]${RESET} $1"
 }
 
 log_warning() {
-    echo -e "${YELLOW}[WARNING]${RESET} $1" | tee -a "$LOG_FILE"
+    echo -e "${YELLOW}[WARNING]${RESET} $1"
 }
 
 log_info() {
-    echo -e "${BLUE}[INFO]${RESET} $1" | tee -a "$LOG_FILE"
+    echo -e "${BLUE}[INFO]${RESET} $1"
 }
 
 increment_test() {
@@ -79,11 +85,15 @@ increment_test() {
 pass_test() {
     TESTS_PASSED=$((TESTS_PASSED + 1))
     log_success "Test $TESTS_RUN: PASSED - $1"
+    echo ""
+    echo ""
 }
 
 fail_test() {
     TESTS_FAILED=$((TESTS_FAILED + 1))
     log_error "Test $TESTS_RUN: FAILED - $1"
+    echo ""
+    echo ""
 }
 
 # Generate test keypairs
@@ -123,20 +133,166 @@ send_websocket_message() {
     local expected_response="$2"
     local timeout="${3:-$TIMEOUT}"
     
-    log_info "Sending WebSocket message: ${message:0:100}..."
-    
-    # Use wscat to send message and capture response
+    # Use websocat to send message and capture response (following pattern from tests/1_nip_test.sh)
     local response=""
-    if command -v wscat &> /dev/null; then
-        response=$(echo "$message" | timeout "$timeout" wscat -c "$RELAY_URL" 2>/dev/null | head -1)
+    if command -v websocat &> /dev/null; then
+        # Capture output from websocat (following working pattern from 1_nip_test.sh)
+        response=$(echo "$message" | timeout "$timeout" websocat "$RELAY_URL" 2>&1 || echo "Connection failed")
+        
+        # Check if connection failed
+        if [[ "$response" == *"Connection failed"* ]]; then
+            log_error "Failed to connect to relay"
+            return 1
+        fi
+        
     else
-        log_error "wscat not found - required for WebSocket testing"
+        log_error "websocat not found - required for WebSocket testing"
+        log_error "Please install websocat for WebSocket communication"
         return 1
     fi
     
     echo "$response"
 }
 
+# =======================================================================
+# PERSISTENT WEBSOCKET CONNECTION MANAGEMENT
+# =======================================================================
+
+# Open persistent WebSocket connection
+open_websocket_connection() {
+    log_info "Opening persistent WebSocket connection to $RELAY_URL..."
+    
+    # Create unique named pipes for this test session
+    WS_INPUT_FIFO="${TEMP_DIR}/ws_input_$$"
+    WS_OUTPUT_FIFO="${TEMP_DIR}/ws_output_$$"
+    WS_RESPONSE_LOG="${TEMP_DIR}/ws_responses_$$"
+    
+    # Create named pipes
+    mkfifo "$WS_INPUT_FIFO" "$WS_OUTPUT_FIFO"
+    
+    # Start websocat in background with bidirectional pipes
+    # Input: we write to WS_INPUT_FIFO, websocat reads and sends to relay
+    # Output: websocat receives from relay and writes to WS_OUTPUT_FIFO
+    websocat "$RELAY_URL" < "$WS_INPUT_FIFO" > "$WS_OUTPUT_FIFO" &
+    WS_PID=$!
+    
+    # Start background response logger
+    tail -f "$WS_OUTPUT_FIFO" >> "$WS_RESPONSE_LOG" &
+    local logger_pid=$!
+    
+    # Keep input pipe open by redirecting from /dev/null in background
+    exec {ws_fd}> "$WS_INPUT_FIFO"
+    
+    # Test connection with a simple REQ message
+    sleep 1
+    echo '["REQ","test_conn",{}]' >&${ws_fd}
+    
+    # Wait for response to confirm connection
+    local connection_timeout=5
+    local start_time=$(date +%s)
+    
+    while [ $(($(date +%s) - start_time)) -lt $connection_timeout ]; do
+        if [ -s "$WS_RESPONSE_LOG" ]; then
+            WS_CONNECTED=1
+            log_success "Persistent WebSocket connection established"
+            log_info "WebSocket PID: $WS_PID"
+            return 0
+        fi
+        sleep 0.1
+    done
+    
+    # Connection failed
+    log_error "Failed to establish persistent WebSocket connection"
+    close_websocket_connection
+    return 1
+}
+
+# Close persistent WebSocket connection
+close_websocket_connection() {
+    log_info "Closing persistent WebSocket connection..."
+    
+    if [ -n "$WS_PID" ] && kill -0 "$WS_PID" 2>/dev/null; then
+        # Close input pipe first
+        if [ -n "${ws_fd}" ]; then
+            exec {ws_fd}>&-
+        fi
+        
+        # Send close frame and terminate websocat
+        kill "$WS_PID" 2>/dev/null
+        wait "$WS_PID" 2>/dev/null
+    fi
+    
+    # Kill any remaining background processes
+    pkill -f "tail -f.*$WS_OUTPUT_FIFO" 2>/dev/null || true
+    
+    # Clean up pipes
+    [ -p "$WS_INPUT_FIFO" ] && rm -f "$WS_INPUT_FIFO"
+    [ -p "$WS_OUTPUT_FIFO" ] && rm -f "$WS_OUTPUT_FIFO"
+    
+    WS_PID=""
+    WS_CONNECTED=0
+    
+    log_info "WebSocket connection closed"
+}
+
+# Send event through persistent WebSocket connection
+send_websocket_event() {
+    local event_json="$1"
+    local timeout_seconds="${2:-10}"
+    
+    if [ "$WS_CONNECTED" != "1" ]; then
+        log_error "WebSocket connection not established"
+        return 1
+    fi
+    
+    # Clear previous responses
+    > "$WS_RESPONSE_LOG"
+    
+    # Create EVENT message
+    local event_message="[\"EVENT\",$event_json]"
+    
+    # Send through persistent connection
+    echo "$event_message" >&${ws_fd}
+    
+    # Wait for OK response
+    local start_time=$(date +%s)
+    while [ $(($(date +%s) - start_time)) -lt $timeout_seconds ]; do
+        if grep -q '"OK"' "$WS_RESPONSE_LOG" 2>/dev/null; then
+            local response=$(tail -1 "$WS_RESPONSE_LOG")
+            echo "$response"
+            return 0
+        fi
+        sleep 0.1
+    done
+    
+    log_error "Timeout waiting for WebSocket response"
+    return 1
+}
+
+# Wait for query response data from relay
+wait_for_query_response() {
+    local timeout_seconds="${1:-10}"
+    local start_time=$(date +%s)
+    
+    log_info "Waiting for query response data..."
+    
+    # Clear any OK responses and wait for JSON data
+    sleep 0.5  # Brief delay to ensure OK response is processed first
+    
+    while [ $(($(date +%s) - start_time)) -lt $timeout_seconds ]; do
+        # Look for JSON response with query data (not just OK responses)
+        if grep -q '"query_type"' "$WS_RESPONSE_LOG" 2>/dev/null; then
+            local response=$(grep '"query_type"' "$WS_RESPONSE_LOG" | tail -1)
+            echo "$response"
+            return 0
+        fi
+        sleep 0.1
+    done
+    
+    log_error "Timeout waiting for query response data"
+    return 1
+}
+
 # Create and send auth rule event
 send_auth_rule_event() {
     local action="$1"        # "add" or "remove"
@@ -147,13 +303,13 @@ send_auth_rule_event() {
     
     log_info "Creating auth rule event: $action $rule_type $pattern_type ${pattern_value:0:16}..."
     
-    # Create the auth rule event using nak - match the working NIP-42 pattern
+    # Create the auth rule event using nak with correct tag format for the actual implementation
+    # Server expects tags like ["whitelist", "pubkey", "abc123..."] or ["blacklist", "pubkey", "def456..."]
+    # Using Kind 23456 (ephemeral auth rules management) with proper relay targeting
     local event_json
-    event_json=$(nak event -k 33335 --content "{\"action\":\"$action\",\"description\":\"$description\"}" \
-        -t "d=$RELAY_PUBKEY" \
-        -t "$rule_type=$pattern_type" \
-        -t "pattern=$pattern_value" \
-        -t "action=$action" \
+    event_json=$(nak event -k 23456 --content "" \
+        -t "p=$RELAY_PUBKEY" \
+        -t "$rule_type=$pattern_type=$pattern_value" \
         --sec "$ADMIN_PRIVKEY" 2>/dev/null)
     
     if [ $? -ne 0 ] || [ -z "$event_json" ]; then
@@ -161,22 +317,91 @@ send_auth_rule_event() {
         return 1
     fi
     
-    # Send the event using nak directly to relay (more reliable than wscat)
+    # Send the event through persistent WebSocket connection
     log_info "Publishing auth rule event to relay..."
     local result
-    result=$(echo "$event_json" | timeout 10s nak event "$RELAY_URL" 2>&1)
-    local exit_code=$?
-    
-    log_info "Auth rule event result: $result"
-    
-    # Check if response indicates success
-    if [ $exit_code -eq 0 ] && echo "$result" | grep -q -i "success\|OK.*true\|published"; then
-        log_success "Auth rule $action successful"
-        return 0
+    if [ "$WS_CONNECTED" = "1" ]; then
+        result=$(send_websocket_event "$event_json")
+        local exit_code=$?
+        
+        log_info "Auth rule event result: $result"
+        
+        # Check if response indicates success
+        if [ $exit_code -eq 0 ] && echo "$result" | grep -q -i '"OK".*true'; then
+            log_success "Auth rule $action successful"
+            return 0
+        else
+            log_error "Auth rule $action failed: $result (exit code: $exit_code)"
+            return 1
+        fi
     else
-        log_error "Auth rule $action failed: $result (exit code: $exit_code)"
+        # Fallback to one-shot connection if persistent connection not available
+        result=$(echo "$event_json" | timeout 10s nak event "$RELAY_URL" 2>&1)
+        local exit_code=$?
+        
+        log_info "Auth rule event result: $result"
+        
+        # Check if response indicates success
+        if [ $exit_code -eq 0 ] && echo "$result" | grep -q -i "success\|OK.*true\|published"; then
+            log_success "Auth rule $action successful"
+            return 0
+        else
+            log_error "Auth rule $action failed: $result (exit code: $exit_code)"
+            return 1
+        fi
+    fi
+}
+
+# Clear all auth rules using the new system command functionality
+clear_all_auth_rules() {
+    log_info "Clearing all existing auth rules..."
+    
+    # Create system command event to clear all auth rules
+    # Using Kind 23456 (ephemeral auth rules management) with proper relay targeting
+    local event_json
+    event_json=$(nak event -k 23456 --content "" \
+        -t "p=$RELAY_PUBKEY" \
+        -t "system_command=clear_all_auth_rules" \
+        --sec "$ADMIN_PRIVKEY" 2>/dev/null)
+    
+    if [ $? -ne 0 ] || [ -z "$event_json" ]; then
+        log_error "Failed to create clear auth rules event with nak"
         return 1
     fi
+    
+    # Send the event through persistent WebSocket connection
+    log_info "Sending clear all auth rules command..."
+    local result
+    if [ "$WS_CONNECTED" = "1" ]; then
+        result=$(send_websocket_event "$event_json")
+        local exit_code=$?
+        
+        log_info "Clear auth rules result: $result"
+        
+        # Check if response indicates success
+        if [ $exit_code -eq 0 ] && echo "$result" | grep -q -i '"OK".*true'; then
+            log_success "All auth rules cleared successfully"
+            return 0
+        else
+            log_error "Failed to clear auth rules: $result (exit code: $exit_code)"
+            return 1
+        fi
+    else
+        # Fallback to one-shot connection if persistent connection not available
+        result=$(echo "$event_json" | timeout 10s nak event "$RELAY_URL" 2>&1)
+        local exit_code=$?
+        
+        log_info "Clear auth rules result: $result"
+        
+        # Check if response indicates success
+        if [ $exit_code -eq 0 ] && echo "$result" | grep -q -i "success\|OK.*true\|published"; then
+            log_success "All auth rules cleared successfully"
+            return 0
+        else
+            log_error "Failed to clear auth rules: $result (exit code: $exit_code)"
+            return 1
+        fi
+    fi
 }
 
 # Test event publishing with a specific key
@@ -198,7 +423,7 @@ test_event_publishing() {
         return 1
     fi
     
-    # Send the event using nak directly (more reliable than wscat)
+    # Send the event using nak directly (more reliable than websocat)
     log_info "Publishing test event to relay..."
     local result
     result=$(echo "$test_event" | timeout 10s nak event "$RELAY_URL" 2>&1)
@@ -236,9 +461,6 @@ setup_test_environment() {
     # Create temporary directory
     mkdir -p "$TEMP_DIR"
     
-    # Clear log file
-    echo "=== C-Relay Whitelist/Blacklist Test Started at $(date) ===" > "$LOG_FILE"
-    
     # Check if required tools are available - like NIP-42 test
     log_info "Checking dependencies..."
     
@@ -258,9 +480,10 @@ setup_test_environment() {
         exit 1
     fi
     
-    if ! command -v wscat &> /dev/null; then
-        log_warning "wscat not found. Some WebSocket tests may be limited"
-        log_warning "Install with: npm install -g wscat"
+    if ! command -v websocat &> /dev/null; then
+        log_error "websocat not found - required for WebSocket testing"
+        log_error "Please install websocat for WebSocket communication"
+        exit 1
     fi
     
     log_success "Dependencies check complete"
@@ -283,11 +506,11 @@ test_admin_authentication() {
     log "Test $TESTS_RUN: Admin Authentication"
     
     # Create a simple configuration event to test admin authentication
-    local content="Testing admin authentication"
+    # Using Kind 23456 (admin commands) with proper relay targeting
     local config_event
-    config_event=$(nak event -k 33334 --content "$content" \
-        -t "d=$RELAY_PUBKEY" \
-        -t "test_auth=true" \
+    config_event=$(nak event -k 23456 --content "" \
+        -t "p=$RELAY_PUBKEY" \
+        -t "system_command=system_status" \
         --sec "$ADMIN_PRIVKEY" 2>/dev/null)
     
     if [ $? -ne 0 ]; then
@@ -295,25 +518,11 @@ test_admin_authentication() {
         return
     fi
     
-    # DEBUG: Print the full event that will be sent
-    log_info "=== DEBUG: Full admin event being sent ==="
-    echo "$config_event" | jq . 2>/dev/null || echo "$config_event"
-    log_info "=== END DEBUG EVENT ==="
-    
     # Send admin event
     local message="[\"EVENT\",$config_event]"
-    log_info "=== DEBUG: Full WebSocket message ==="
-    echo "$message"
-    log_info "=== END DEBUG MESSAGE ==="
-    
     local response
     response=$(send_websocket_message "$message" "OK" 10)
     
-    # DEBUG: Print the full response from server
-    log_info "=== DEBUG: Full server response ==="
-    echo "$response"
-    log_info "=== END DEBUG RESPONSE ==="
-    
     if echo "$response" | grep -q '"OK".*true'; then
         pass_test "Admin authentication successful"
     else
@@ -321,11 +530,66 @@ test_admin_authentication() {
     fi
 }
 
-# Test 2: Basic Whitelist Functionality
+# Test 2: Auth Rules Storage and Query Test
+test_auth_rules_storage_query() {
+    increment_test
+    log "Test $TESTS_RUN: Auth Rules Storage and Query Test"
+    
+    # Clear all existing rules to start fresh
+    clear_all_auth_rules
+    
+    # Add a simple blacklist rule
+    log_info "Adding test blacklist rule..."
+    if send_auth_rule_event "add" "blacklist" "pubkey" "$TEST1_PUBKEY" "Test storage blacklist entry"; then
+        log_success "Auth rule added successfully"
+        
+        # Wait a moment for rule to be processed
+        sleep 1
+        
+        # Query all auth rules using admin query
+        log_info "Querying all auth rules..."
+        local query_event
+        query_event=$(nak event -k 23456 --content "" \
+            -t "p=$RELAY_PUBKEY" \
+            -t "auth_query=all" \
+            --sec "$ADMIN_PRIVKEY" 2>/dev/null)
+        
+        if [ $? -ne 0 ] || [ -z "$query_event" ]; then
+            fail_test "Failed to create auth query event"
+            return
+        fi
+        
+        # Send the query event
+        log_info "Sending auth query to relay..."
+        local query_result
+        query_result=$(echo "$query_event" | timeout 10s nak event "$RELAY_URL" 2>&1)
+        local exit_code=$?
+        
+        log_info "Auth query result: $query_result"
+        
+        # Check if we got a response and if it contains our test rule
+        if [ $exit_code -eq 0 ]; then
+            if echo "$query_result" | grep -q "$TEST1_PUBKEY"; then
+                pass_test "Auth rule storage and query working - found test rule in query results"
+            else
+                fail_test "Auth rule not found in query results - rule may not have been stored"
+            fi
+        else
+            fail_test "Auth query failed: $query_result"
+        fi
+    else
+        fail_test "Failed to add auth rule for storage test"
+    fi
+}
+
+# Test 3: Basic Whitelist Functionality
 test_basic_whitelist() {
     increment_test
     log "Test $TESTS_RUN: Basic Whitelist Functionality"
     
+    # Clear all existing rules to start fresh
+    clear_all_auth_rules
+    
     # Add TEST1 pubkey to whitelist
     if send_auth_rule_event "add" "whitelist" "pubkey" "$TEST1_PUBKEY" "Test whitelist entry"; then
         # Test that whitelisted pubkey can publish
@@ -339,11 +603,14 @@ test_basic_whitelist() {
     fi
 }
 
-# Test 3: Basic Blacklist Functionality  
+# Test 4: Basic Blacklist Functionality
 test_basic_blacklist() {
     increment_test
     log "Test $TESTS_RUN: Basic Blacklist Functionality"
     
+    # Clear all existing rules to start fresh
+    clear_all_auth_rules
+    
     # Add TEST2 pubkey to blacklist
     if send_auth_rule_event "add" "blacklist" "pubkey" "$TEST2_PUBKEY" "Test blacklist entry"; then
         # Test that blacklisted pubkey cannot publish
@@ -357,11 +624,20 @@ test_basic_blacklist() {
     fi
 }
 
-# Test 4: Rule Removal
+# Test 5: Rule Removal
 test_rule_removal() {
     increment_test
     log "Test $TESTS_RUN: Rule Removal"
     
+    # Clear all existing rules to start fresh
+    clear_all_auth_rules
+    
+    # First add TEST2 to blacklist to test removal
+    if ! send_auth_rule_event "add" "blacklist" "pubkey" "$TEST2_PUBKEY" "Test blacklist for removal"; then
+        fail_test "Failed to add pubkey to blacklist for removal test"
+        return
+    fi
+    
     # Remove TEST2 from blacklist
     if send_auth_rule_event "remove" "blacklist" "pubkey" "$TEST2_PUBKEY" "Remove test blacklist entry"; then
         # Test that previously blacklisted pubkey can now publish
@@ -375,11 +651,14 @@ test_rule_removal() {
     fi
 }
 
-# Test 5: Multiple Users Scenario
+# Test 6: Multiple Users Scenario
 test_multiple_users() {
     increment_test
     log "Test $TESTS_RUN: Multiple Users Scenario"
     
+    # Clear all existing rules to start fresh
+    clear_all_auth_rules
+    
     # Add TEST1 to whitelist and TEST3 to blacklist
     local success_count=0
     
@@ -408,11 +687,14 @@ test_multiple_users() {
     fi
 }
 
-# Test 6: Priority Testing (Blacklist vs Whitelist)
+# Test 7: Priority Testing (Blacklist vs Whitelist)
 test_priority_rules() {
     increment_test
     log "Test $TESTS_RUN: Priority Rules Testing"
     
+    # Clear all existing rules to start fresh
+    clear_all_auth_rules
+    
     # Add same pubkey to both whitelist and blacklist
     local setup_success=0
     
@@ -438,11 +720,14 @@ test_priority_rules() {
     fi
 }
 
-# Test 7: Hash-based Blacklist
+# Test 8: Hash-based Blacklist
 test_hash_blacklist() {
     increment_test
     log "Test $TESTS_RUN: Hash-based Blacklist"
     
+    # Clear all existing rules to start fresh
+    clear_all_auth_rules
+    
     # Create a test event to get its hash
     local test_content="Content to be blacklisted by hash"
     local test_event
@@ -482,11 +767,14 @@ test_hash_blacklist() {
     fi
 }
 
-# Test 8: WebSocket Connection Behavior
+# Test 9: WebSocket Connection Behavior
 test_websocket_behavior() {
     increment_test
     log "Test $TESTS_RUN: WebSocket Connection Behavior"
     
+    # Clear all existing rules to start fresh
+    clear_all_auth_rules
+    
     # Test that the WebSocket connection handles multiple rapid requests
     local rapid_success_count=0
     
@@ -516,11 +804,14 @@ test_websocket_behavior() {
     fi
 }
 
-# Test 9: Rule Persistence Verification
+# Test 10: Rule Persistence Verification
 test_rule_persistence() {
     increment_test
     log "Test $TESTS_RUN: Rule Persistence Verification"
     
+    # Clear all existing rules to start fresh
+    clear_all_auth_rules
+    
     # Add a rule, then verify it persists by testing enforcement
     if send_auth_rule_event "add" "blacklist" "pubkey" "$TEST3_PUBKEY" "Persistence test blacklist"; then
         # Wait a moment for rule to be processed
@@ -546,7 +837,7 @@ test_rule_persistence() {
     fi
 }
 
-# Test 10: Cleanup and Final Verification
+# Test 11: Cleanup and Final Verification
 test_cleanup_verification() {
     increment_test
     log "Test $TESTS_RUN: Cleanup and Final Verification"
@@ -589,10 +880,11 @@ run_all_tests() {
     # Setup
     setup_test_environment
     
-    # Run only test 1 for debugging admin authentication
-    test_admin_authentication
+
+    clear_all_auth_rules
     
-    # Comment out other tests for now to focus on debugging
+    test_admin_authentication
+    test_auth_rules_storage_query
     # test_basic_whitelist
     # test_basic_blacklist
     # test_rule_removal
@@ -648,8 +940,8 @@ main() {
     echo -e "${BLUE}===============================================${RESET}"
     echo ""
     
-    # Check if relay is running - use the same method we verified manually
-    if ! echo '["REQ","connection_test",{}]' | timeout 5 wscat -c "$RELAY_URL" >/dev/null 2>&1; then
+    # Check if relay is running - using websocat like the working tests
+    if ! echo '["REQ","connection_test",{}]' | timeout 5 websocat "$RELAY_URL" >/dev/null 2>&1; then
         log_error "Cannot connect to relay at $RELAY_URL"
         log_error "Please ensure the C-Relay server is running in test mode"
         exit 1
@@ -661,12 +953,10 @@ main() {
     if run_all_tests; then
         echo ""
         log_success "All whitelist/blacklist tests completed successfully!"
-        echo -e "Test log saved to: ${YELLOW}$LOG_FILE${RESET}"
         exit 0
     else
         echo ""
-        log_error "Some tests failed. Check the log for details."
-        echo -e "Test log saved to: ${YELLOW}$LOG_FILE${RESET}"
+        log_error "Some tests failed."
         exit 1
     fi
 }

whitelist_blacklist_test.log

@@ -1,21 +0,0 @@
-=== C-Relay Whitelist/Blacklist Test Started at Tue Sep 23 11:20:40 AM EDT 2025 ===
-[INFO] Checking dependencies...
-[SUCCESS] Dependencies check complete
-[INFO] Generated keypair for TEST1: pubkey=eab7cac03049d07f...
-[INFO] Generated keypair for TEST2: pubkey=4e07a99f656d5301...
-[INFO] Generated keypair for TEST3: pubkey=bf48b836426805cb...
-[SUCCESS] Test environment setup complete
-[11:20:41] Test 1: Admin Authentication
-[INFO] === DEBUG: Full admin event being sent ===
-[INFO] === END DEBUG EVENT ===
-[INFO] === DEBUG: Full WebSocket message ===
-[INFO] === END DEBUG MESSAGE ===
-[INFO] Sending WebSocket message: ["EVENT",{"kind":33334,"id":"ce73fa326eb558505742770eb927a50edc16a69512089939f76da90c7ca5291f","pubk...
-[INFO] === DEBUG: Full server response ===
-[INFO] === END DEBUG RESPONSE ===
-[ERROR] Test 1: FAILED - Admin authentication failed: [INFO] Sending WebSocket message: ["EVENT",{"kind":33334,"id":"ce73fa326eb558505742770eb927a50edc16a69512089939f76da90c7ca5291f","pubk...
-[ERROR] 1 out of 1 tests failed.
-[ERROR] Some tests failed. Check the log for details.
-[11:20:42] Cleaning up test environment...
-[INFO] Temporary directory removed: /tmp/c_relay_test_1773069
-[11:20:42] Test cleanup completed.