v0.3.18 - index.html improvements

v0.3.17 - Embedded login button
v0.3.16 - Admin system getting better
2025-09-30 07:51:23 -04:00 · 2025-09-30 06:47:09 -04:00 · 2025-09-30 05:32:23 -04:00 · 2025-09-27 15:50:42 -04:00
15 changed files with 3386 additions and 1510 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -8,4 +8,5 @@ src/version.h
 dev-config/
 db/
 copy_executable_local.sh
-nostr_login_lite/
+nostr_login_lite/
+style_guide/
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -27,7 +27,7 @@
 ## Critical Integration Issues

 ### Event-Based Configuration System
- **No traditional config files** - all configuration stored as kind 33334 Nostr events
+- **No traditional config files** - all configuration stored in config table
 - Admin private key shown **only once** on first startup
 - Configuration changes require cryptographically signed events
 - Database path determined by generated relay pubkey
@@ -35,7 +35,7 @@
 ### First-Time Startup Sequence
 1. Relay generates admin keypair and relay keypair
 2. Creates database file with relay pubkey as filename
-3. Stores default configuration as kind 33334 event
+3. Stores default configuration in config table
 4. **CRITICAL**: Admin private key displayed once and never stored on disk

 ### Port Management
@@ -48,20 +48,30 @@
 - Schema version 4 with JSON tag storage
 - **Critical**: Event expiration filtering done at application level, not SQL level

-### Configuration Event Structure
+### Admin API Event Structure
 ```json
 {
-  "kind": 33334,
-  "content": "C Nostr Relay Configuration",
+  "kind": 23456,
+  "content": "base64_nip44_encrypted_command_array",
  "tags": [
-    ["d", "<relay_pubkey>"],
-    ["relay_description", "value"],
-    ["max_subscriptions_per_client", "25"],
-    ["pow_min_difficulty", "16"]
+    ["p", "<relay_pubkey>"]
  ]
 }
 ```

+**Configuration Commands** (encrypted in content):
+- `["relay_description", "My Relay"]`
+- `["max_subscriptions_per_client", "25"]`
+- `["pow_min_difficulty", "16"]`
+
+**Auth Rule Commands** (encrypted in content):
+- `["blacklist", "pubkey", "hex_pubkey_value"]`
+- `["whitelist", "pubkey", "hex_pubkey_value"]`
+
+**Query Commands** (encrypted in content):
+- `["auth_query", "all"]`
+- `["system_command", "system_status"]`
+
 ### Process Management
 ```bash
 # Kill existing relay processes
--- a/IMPLEMENT_API.md
+++ b/IMPLEMENT_API.md
@@ -1,513 +0,0 @@
-# Implementation Plan: Enhanced Admin Event API Structure
-
-## Current Issue
-
-The current admin event routing at [`main.c:3248-3268`](src/main.c:3248) has a security vulnerability:
-
-```c
-if (event_kind == 23455 || event_kind == 23456) {
-    // Admin event processing
-    int admin_result = process_admin_event_in_config(event, admin_error, sizeof(admin_error), wsi);
-} else {
-    // Regular event storage and broadcasting
-}
-```
-
-**Problem**: Any event with these kinds gets routed to admin processing, regardless of authorization. This allows unauthorized users to send admin events that could be processed as legitimate admin commands.
-
-**Note**: Event kinds 33334 and 33335 are no longer used and have been removed from the admin event routing.
-
-## Required Security Enhancement
-
-Admin events must be validated for proper authorization BEFORE routing to admin processing:
-
-1. **Relay Public Key Check**: Event must have a `p` tag equal to the relay's public key
-2. **Admin Signature Check**: Event must be signed by an authorized admin private key
-3. **Fallback to Regular Processing**: If authorization fails, treat as regular event (not admin event)
-
-## Implementation Plan
-
-### Phase 1: Add Admin Authorization Validation
-
-#### 1.1 Create Consolidated Admin Authorization Function
-**Location**: [`src/main.c`](src/main.c) or [`src/config.c`](src/config.c)
-
-```c
-/**
- * Consolidated admin event authorization validator
- * Implements defense-in-depth security for admin events
- *
- * @param event - The event to validate for admin authorization
- * @param error_message - Buffer for detailed error messages
- * @param error_size - Size of error message buffer
- * @return 0 if authorized, -1 if unauthorized, -2 if validation error
- */
-int is_authorized_admin_event(cJSON* event, char* error_message, size_t error_size) {
-    if (!event) {
-        snprintf(error_message, error_size, "admin_auth: null event");
-        return -2;
-    }
-    
-    // Extract event components
-    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
-    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
-    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
-    
-    if (!kind_obj || !pubkey_obj || !tags_obj) {
-        snprintf(error_message, error_size, "admin_auth: missing required fields");
-        return -2;
-    }
-    
-    // Validation Layer 1: Kind Check
-    int event_kind = (int)cJSON_GetNumberValue(kind_obj);
-    if (event_kind != 23455 && event_kind != 23456) {
-        snprintf(error_message, error_size, "admin_auth: not an admin event kind");
-        return -1;
-    }
-    
-    // Validation Layer 2: Relay Targeting Check
-    const char* relay_pubkey = get_config_value("relay_pubkey");
-    if (!relay_pubkey) {
-        snprintf(error_message, error_size, "admin_auth: relay pubkey not configured");
-        return -2;
-    }
-    
-    // Check for 'p' tag targeting this relay
-    int has_relay_target = 0;
-    if (cJSON_IsArray(tags_obj)) {
-        cJSON* tag = NULL;
-        cJSON_ArrayForEach(tag, tags_obj) {
-            if (cJSON_IsArray(tag) && cJSON_GetArraySize(tag) >= 2) {
-                cJSON* tag_name = cJSON_GetArrayItem(tag, 0);
-                cJSON* tag_value = cJSON_GetArrayItem(tag, 1);
-                
-                if (cJSON_IsString(tag_name) && cJSON_IsString(tag_value)) {
-                    const char* name = cJSON_GetStringValue(tag_name);
-                    const char* value = cJSON_GetStringValue(tag_value);
-                    
-                    if (strcmp(name, "p") == 0 && strcmp(value, relay_pubkey) == 0) {
-                        has_relay_target = 1;
-                        break;
-                    }
-                }
-            }
-        }
-    }
-    
-    if (!has_relay_target) {
-        // Admin event for different relay - not unauthorized, just not for us
-        snprintf(error_message, error_size, "admin_auth: admin event for different relay");
-        return -1;
-    }
-    
-    // Validation Layer 3: Admin Signature Check (only if targeting this relay)
-    const char* event_pubkey = cJSON_GetStringValue(pubkey_obj);
-    if (!event_pubkey) {
-        snprintf(error_message, error_size, "admin_auth: invalid pubkey format");
-        return -2;
-    }
-    
-    const char* admin_pubkey = get_config_value("admin_pubkey");
-    if (!admin_pubkey || strcmp(event_pubkey, admin_pubkey) != 0) {
-        // This is the ONLY case where we log as "Unauthorized admin event attempt"
-        // because it's targeting THIS relay but from wrong admin
-        snprintf(error_message, error_size, "admin_auth: unauthorized admin for this relay");
-        log_warning("SECURITY: Unauthorized admin event attempt for this relay");
-        return -1;
-    }
-    
-    // All validation layers passed
-    log_info("ADMIN: Admin event authorized");
-    return 0;
-}
-
-```
-
-#### 1.2 Update Event Routing Logic
-**Location**: [`main.c:3248`](src/main.c:3248)
-
-```c
-// Current problematic code:
-if (event_kind == 23455 || event_kind == 23456) {
-    // Admin event processing
-    int admin_result = process_admin_event_in_config(event, admin_error, sizeof(admin_error), wsi);
-} else {
-    // Regular event storage and broadcasting
-}
-
-// Enhanced secure code with consolidated authorization:
-if (result == 0) {
-    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
-    if (kind_obj && cJSON_IsNumber(kind_obj)) {
-        int event_kind = (int)cJSON_GetNumberValue(kind_obj);
-        
-        // Check if this is an admin event
-        if (event_kind == 23455 || event_kind == 23456) {
-            // Use consolidated authorization check
-            char auth_error[512] = {0};
-            int auth_result = is_authorized_admin_event(event, auth_error, sizeof(auth_error));
-            
-            if (auth_result == 0) {
-                // Authorized admin event - process through admin API
-                char admin_error[512] = {0};
-                int admin_result = process_admin_event_in_config(event, admin_error, sizeof(admin_error), wsi);
-                
-                if (admin_result != 0) {
-                    result = -1;
-                    strncpy(error_message, admin_error, sizeof(error_message) - 1);
-                }
-                // Admin events are NOT broadcast to subscriptions
-            } else {
-                // Unauthorized admin event - treat as regular event
-                log_warning("Unauthorized admin event treated as regular event");
-                if (store_event(event) != 0) {
-                    result = -1;
-                    strncpy(error_message, "error: failed to store event", sizeof(error_message) - 1);
-                } else {
-                    broadcast_event_to_subscriptions(event);
-                }
-            }
-        } else {
-            // Regular event - normal processing
-            if (store_event(event) != 0) {
-                result = -1;
-                strncpy(error_message, "error: failed to store event", sizeof(error_message) - 1);
-            } else {
-                broadcast_event_to_subscriptions(event);
-            }
-        }
-    }
-}
-```
-
-### Phase 2: Enhanced Admin Event Processing
-
-#### 2.1 Admin Event Validation in Config System
-**Location**: [`src/config.c`](src/config.c) - [`process_admin_event_in_config()`](src/config.c:2065)
-
-Add additional validation within the admin processing function:
-
-```c
-int process_admin_event_in_config(cJSON* event, char* error_buffer, size_t error_buffer_size, struct lws* wsi) {
-    // Double-check authorization (defense in depth)
-    if (!is_authorized_admin_event(event)) {
-        snprintf(error_buffer, error_buffer_size, "unauthorized: not a valid admin event");
-        return -1;
-    }
-    
-    // Continue with existing admin event processing...
-    // ... rest of function unchanged
-}
-```
-
-#### 2.2 Logging and Monitoring
-Add comprehensive logging for admin event attempts:
-
-```c
-// In the routing logic - enhanced logging
-cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
-cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
-int event_kind = kind_obj ? cJSON_GetNumberValue(kind_obj) : -1;
-const char* event_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : "unknown";
-
-if (is_authorized_admin_event(event)) {
-    char log_msg[256];
-    snprintf(log_msg, sizeof(log_msg),
-            "ADMIN EVENT: Authorized admin event (kind=%d) from pubkey=%.16s...",
-            event_kind, event_pubkey);
-    log_info(log_msg);
-} else if (event_kind == 23455 || event_kind == 23456) {
-    // This catches unauthorized admin event attempts
-    char log_msg[256];
-    snprintf(log_msg, sizeof(log_msg),
-            "SECURITY: Unauthorized admin event attempt (kind=%d) from pubkey=%.16s...",
-            event_kind, event_pubkey);
-    log_warning(log_msg);
-}
-```
-
-## Phase 3: Unified Output Flow Architecture
-
-### 3.1 Current Output Flow Analysis
-
-After analyzing both [`main.c`](src/main.c) and [`config.c`](src/config.c), the **admin event responses already flow through the standard WebSocket output pipeline**. This is the correct architecture and requires no changes.
-
-#### Standard WebSocket Output Pipeline
-
-**Regular Events** ([`main.c:2978-2996`](src/main.c:2978)):
-```c
-// Database query responses
-unsigned char* buf = malloc(LWS_PRE + msg_len);
-memcpy(buf + LWS_PRE, msg_str, msg_len);
-lws_write(wsi, buf + LWS_PRE, msg_len, LWS_WRITE_TEXT);
-free(buf);
-```
-
-**OK Responses** ([`main.c:3342-3375`](src/main.c:3342)):
-```c
-// Event processing results: ["OK", event_id, success_boolean, message]
-unsigned char *buf = malloc(LWS_PRE + response_len);
-memcpy(buf + LWS_PRE, response_str, response_len);
-lws_write(wsi, buf + LWS_PRE, response_len, LWS_WRITE_TEXT);
-free(buf);
-```
-
-#### Admin Event Output Pipeline (Already Unified)
-
-**Admin Responses** ([`config.c:2363-2414`](src/config.c:2363)):
-```c
-// Admin query responses use IDENTICAL pattern
-int send_websocket_response_data(struct lws* wsi, cJSON* response_data) {
-    unsigned char* buf = malloc(LWS_PRE + response_len);
-    memcpy(buf + LWS_PRE, response_str, response_len);
-    
-    // Same lws_write() call as regular events
-    int result = lws_write(wsi, buf + LWS_PRE, response_len, LWS_WRITE_TEXT);
-    
-    free(buf);
-    return result;
-}
-```
-
-### 3.2 Unified Output Flow Confirmation
-
-✅ **Admin responses already use the same WebSocket transmission mechanism as regular events**
-
-✅ **Both admin and regular events use identical buffer allocation patterns**
-
-✅ **Both admin and regular events use the same [`lws_write()`](src/config.c:2393) function**
-
-✅ **Both admin and regular events follow the same cleanup patterns**
-
-### 3.3 Output Flow Integration Points
-
-The admin event processing in [`config.c:2436`](src/config.c:2436) already integrates correctly with the unified output system:
-
-1. **Admin Query Processing** ([`config.c:2568-2583`](src/config.c:2568)):
-   - Auth queries return structured JSON via [`send_websocket_response_data()`](src/config.c:2571)
-   - System commands return status data via [`send_websocket_response_data()`](src/config.c:2631)
-
-2. **Response Format Consistency**:
-   - Admin responses use standard JSON format
-   - Regular events use standard Nostr event format
-   - Both transmitted through same WebSocket pipeline
-
-3. **Error Handling Consistency**:
-   - Admin errors returned via same WebSocket connection
-   - Regular event errors returned via OK messages
-   - Both use identical transmission mechanism
-
-### 3.4 Key Architectural Benefits
-
-**No Changes Required**: The output flow is already unified and correctly implemented.
-
-**Security Separation**: Admin events are processed separately but responses flow through the same secure WebSocket channel.
-
-**Performance Consistency**: Both admin and regular responses use the same optimized transmission path.
-
-**Maintenance Simplicity**: Single WebSocket output pipeline reduces complexity and potential bugs.
-
-### 3.5 Admin Event Flow Summary
-
-```
-Admin Event Input → Authorization Check → Admin Processing → Unified WebSocket Output
-Regular Event Input → Validation → Storage + Broadcast → Unified WebSocket Output
-```
-
-Both flows converge at the **Unified WebSocket Output** stage, which is already correctly implemented.
-
-## Phase 4: Integration Points for Secure Admin Event Routing
-
-### 4.1 Configuration System Integration
-
-**Required Configuration Values**:
- `admin_pubkey` - Public key of authorized administrator
- `relay_pubkey` - Public key of this relay instance
-
-**Integration Points**:
-1. [`get_config_value()`](src/config.c) - Used by authorization function
-2. [`get_relay_pubkey_cached()`](src/config.c) - Used for relay targeting validation
-3. Configuration loading during startup - Must ensure admin/relay pubkeys are available
-
-### 4.3 Forward Declarations Required
-
-**Location**: [`src/main.c`](src/main.c) - Add near other forward declarations (around line 230)
-
-```c
-// Forward declarations for enhanced admin event authorization
-int is_authorized_admin_event(cJSON* event, char* error_message, size_t error_size);
-```
-
-### 4.4 Error Handling Integration
-
-**Enhanced Error Response System**:
-
-```c
-// In main.c event processing - enhanced error handling for admin events
-if (auth_result != 0) {
-    // Admin authorization failed - send detailed OK response
-    cJSON* event_id = cJSON_GetObjectItem(event, "id");
-    if (event_id && cJSON_IsString(event_id)) {
-        cJSON* response = cJSON_CreateArray();
-        cJSON_AddItemToArray(response, cJSON_CreateString("OK"));
-        cJSON_AddItemToArray(response, cJSON_CreateString(cJSON_GetStringValue(event_id)));
-        cJSON_AddItemToArray(response, cJSON_CreateBool(0)); // Failed
-        cJSON_AddItemToArray(response, cJSON_CreateString(auth_error));
-        
-        // Send via standard WebSocket output pipeline
-        char *response_str = cJSON_Print(response);
-        if (response_str) {
-            size_t response_len = strlen(response_str);
-            unsigned char *buf = malloc(LWS_PRE + response_len);
-            if (buf) {
-                memcpy(buf + LWS_PRE, response_str, response_len);
-                lws_write(wsi, buf + LWS_PRE, response_len, LWS_WRITE_TEXT);
-                free(buf);
-            }
-            free(response_str);
-        }
-        cJSON_Delete(response);
-    }
-}
-```
-
-### 4.5 Logging Integration Points
-
-**Console Logging**: Uses existing [`log_warning()`](src/main.c:993), [`log_info()`](src/main.c:972) functions
-
-**Security Event Categories**:
- Admin authorization success logged via `log_info()`
- Admin authorization failures logged via `log_warning()`
- Admin event processing logged via existing admin logging
-
-## Phase 5: Detailed Function Specifications
-
-### 5.1 Core Authorization Function
-
-**Function**: `is_authorized_admin_event()`
-**Location**: [`src/main.c`](src/main.c) or [`src/config.c`](src/config.c)
-**Dependencies**:
- `get_config_value()` for admin/relay pubkeys
- `log_warning()` and `log_info()` for logging
- `cJSON` library for event parsing
-
-**Return Values**:
- `0` - Event is authorized for admin processing
- `-1` - Event is unauthorized (treat as regular event)
- `-2` - Validation error (malformed event)
-
-**Error Handling**: Detailed error messages in provided buffer for client feedback
-
-### 5.2 Enhanced Event Routing
-
-**Location**: [`main.c:3248-3340`](src/main.c:3248)
-**Integration**: Replaces existing admin event routing logic
-**Dependencies**:
- `is_authorized_admin_event()` for authorization
- `process_admin_event_in_config()` for admin processing
- `store_event()` and `broadcast_event_to_subscriptions()` for regular events
-
-**Security Features**:
- Graceful degradation for unauthorized admin events
- Comprehensive logging of authorization attempts
- No broadcast of admin events to subscriptions
- Detailed error responses for failed authorization
-
-### 5.4 Defense-in-Depth Validation
-
-**Primary Validation**: In main event routing logic
-**Secondary Validation**: In `process_admin_event_in_config()` function
-**Tertiary Validation**: In individual admin command handlers
-
-**Validation Layers**:
-1. **Kind Check** - Must be admin event kind (23455/23456)
-2. **Relay Targeting Check** - Must have 'p' tag with this relay's pubkey
-3. **Admin Signature Check** - Must be signed by authorized admin (only if targeting this relay)
-4. **Processing Check** - Additional validation in admin handlers
-
-**Security Logic**:
- If no 'p' tag for this relay → Admin event for different relay (not unauthorized)
- If 'p' tag for this relay + wrong admin signature → "Unauthorized admin event attempt"
-
-## Phase 6: Event Flow Documentation
-
-### 6.1 Complete Event Processing Flow
-
-```
-┌─────────────────┐
-│ WebSocket Input │
-└─────────┬───────┘
-          │
-          ▼
-┌─────────────────┐
-│ Unified         │
-│ Validation      │ ← nostr_validate_unified_request()
-└─────────┬───────┘
-          │
-          ▼
-┌─────────────────┐
-│ Kind-Based      │
-│ Routing Check   │ ← Check if kind 23455/23456
-└─────────┬───────┘
-          │
-     ┌────▼────┐
-     │ Admin?  │
-     └────┬────┘
-          │
-    ┌─────▼─────┐         ┌─────────────┐
-    │ YES       │         │ NO          │
-    │           │         │             │
-    ▼           │         ▼             │
-┌─────────────┐ │    ┌─────────────┐    │
-│ Admin       │ │    │ Regular     │    │
-│ Authorization│ │    │ Event       │    │
-│ Check       │ │    │ Processing  │    │
-└─────┬───────┘ │    └─────┬───────┘    │
-      │         │          │            │
- ┌────▼────┐    │          ▼            │
- │Authorized?│   │    ┌─────────────┐    │
- └────┬────┘    │    │ store_event()│    │
-      │         │    │ +           │    │
-┌─────▼─────┐   │    │ broadcast() │    │
-│ YES   NO  │   │    └─────┬───────┘    │
-│  │     │  │   │          │            │
-│  ▼     ▼  │   │          ▼            │
-│┌─────┐┌───┴┐  │    ┌─────────────┐    │
-││Admin││Treat│  │    │ WebSocket   │    │
-││API  ││as   │  │    │ OK Response │    │
-││     ││Reg  │  │    └─────────────┘    │
-│└──┬──┘└───┬┘  │                       │
-│   │      │   │                       │
-│   ▼      │   │                       │
-│┌─────────┐│   │                       │
-││WebSocket││   │                       │
-││Response ││   │                       │
-│└─────────┘│   │                       │
-└───────────┴───┘                       │
-            │                           │
-            └───────────────────────────┘
-                        │
-                        ▼
-                ┌─────────────┐
-                │ Unified     │
-                │ WebSocket   │
-                │ Output      │
-                └─────────────┘
-```
-
-### 6.2 Security Decision Points
-
-1. **Event Kind Check** - Identifies potential admin events
-2. **Authorization Validation** - Three-layer security check
-3. **Routing Decision** - Admin API vs Regular processing
-4. **Response Generation** - Unified output pipeline
-5. **Audit Logging** - Security event tracking
-
-### 6.3 Error Handling Paths
-
-**Validation Errors**: Return detailed error messages via OK response
-**Authorization Failures**: Log security event + treat as regular event
-**Processing Errors**: Return admin-specific error responses
-**System Errors**: Fallback to standard error handling
-
-This completes the comprehensive implementation plan for the enhanced admin event API structure with unified output flow architecture.
--- a/README.md
+++ b/README.md
@@ -24,7 +24,7 @@ Do NOT modify the formatting, add emojis, or change the text. Keep the simple fo

 ## 🔧 Administrator API

-C-Relay uses an innovative **event-based administration system** where all configuration and management commands are sent as signed Nostr events using the admin private key generated during first startup. All admin commands use **tag-based parameters** for simplicity and compatibility.
+C-Relay uses an innovative **event-based administration system** where all configuration and management commands are sent as signed Nostr events using the admin private key generated during first startup. All admin commands use **NIP-44 encrypted command arrays** for security and compatibility.

 ### Authentication

@@ -32,7 +32,7 @@ All admin commands require signing with the admin private key displayed during f

 ### Event Structure

-All admin commands use the same unified event structure with tag-based parameters:
+All admin commands use the same unified event structure with NIP-44 encrypted content:

 **Admin Command Event:**
 ```json
@@ -41,14 +41,16 @@ All admin commands use the same unified event structure with tag-based parameter
  "pubkey": "admin_public_key",
  "created_at": 1234567890,
  "kind": 23456,
-  "content": "<nip44 encrypted command>",
+  "content": "AqHBUgcM7dXFYLQuDVzGwMST1G8jtWYyVvYxXhVGEu4nAb4LVw...",
  "tags": [
-    ["p", "relay_public_key"],
+    ["p", "relay_public_key"]
  ],
  "sig": "event_signature"
 }
 ```

+The `content` field contains a NIP-44 encrypted JSON array representing the command.
+
 **Admin Response Event:**
 ```json
 ["EVENT", "temp_sub_id", {
@@ -56,7 +58,7 @@ All admin commands use the same unified event structure with tag-based parameter
  "pubkey": "relay_public_key",
  "created_at": 1234567890,
  "kind": 23457,
-  "content": "<nip44 encrypted response>",
+  "content": "BpKCVhfN8eYtRmPqSvWxZnMkL2gHjUiOp3rTyEwQaS5dFg...",
  "tags": [
    ["p", "admin_public_key"]
  ],
@@ -64,18 +66,21 @@ All admin commands use the same unified event structure with tag-based parameter
 }]
 ```

+The `content` field contains a NIP-44 encrypted JSON response object.
+
 ### Admin Commands

-All commands are sent as nip44 encrypted content. The following table lists all available commands:
+All commands are sent as NIP-44 encrypted JSON arrays in the event content. The following table lists all available commands:

-| Command Type | Tag Format | Description |
-|--------------|------------|-------------|
+| Command Type | Command Format | Description |
+|--------------|----------------|-------------|
 | **Configuration Management** |
-| `config_update` | `["relay_description", "My Relay"]` | Update relay configuration parameters |
-| `config_query` | `["config_query", "list_all_keys"]` | List all available configuration keys |
+| `config_update` | `["config_update", [{"key": "auth_enabled", "value": "true", "data_type": "boolean", "category": "auth"}, {"key": "relay_description", "value": "My Relay", "data_type": "string", "category": "relay"}, ...]]` | Update relay configuration parameters (supports multiple updates) |
+| `config_query` | `["config_query", "all"]` | Query all configuration parameters |
 | **Auth Rules Management** |
 | `auth_add_blacklist` | `["blacklist", "pubkey", "abc123..."]` | Add pubkey to blacklist |
 | `auth_add_whitelist` | `["whitelist", "pubkey", "def456..."]` | Add pubkey to whitelist |
+| `auth_delete_rule` | `["delete_auth_rule", "blacklist", "pubkey", "abc123..."]` | Delete specific auth rule |
 | `auth_query_all` | `["auth_query", "all"]` | Query all auth rules |
 | `auth_query_type` | `["auth_query", "whitelist"]` | Query specific rule type |
 | `auth_query_pattern` | `["auth_query", "pattern", "abc123..."]` | Query specific pattern |
@@ -116,7 +121,7 @@ All admin commands return **signed EVENT responses** via WebSocket following sta
  "pubkey": "relay_public_key",
  "created_at": 1234567890,
  "kind": 23457,
-  "content": "nip44 encrypted:{\"status\": \"success\", \"message\": \"Operation completed successfully\"}",
+  "content": "nip44 encrypted:{\"query_type\": \"config_update\", \"status\": \"success\", \"message\": \"Operation completed successfully\", \"timestamp\": 1234567890}",
  "tags": [
    ["p", "admin_public_key"]
  ],
@@ -131,7 +136,7 @@ All admin commands return **signed EVENT responses** via WebSocket following sta
  "pubkey": "relay_public_key",
  "created_at": 1234567890,
  "kind": 23457,
-  "content": "nip44 encrypted:{\"status\": \"error\", \"message\": \"Error: invalid configuration value\"}",
+  "content": "nip44 encrypted:{\"query_type\": \"config_update\", \"status\": \"error\", \"error\": \"invalid configuration value\", \"timestamp\": 1234567890}",
  "tags": [
    ["p", "admin_public_key"]
  ],
@@ -146,7 +151,7 @@ All admin commands return **signed EVENT responses** via WebSocket following sta
  "pubkey": "relay_public_key",
  "created_at": 1234567890,
  "kind": 23457,
-  "content": "nip44 encrypted:{\"query_type\": \"auth_rules\", \"total_results\": 2, \"data\": [{\"rule_type\": \"blacklist\", \"pattern_type\": \"pubkey\", \"pattern_value\": \"abc123...\", \"action\": \"deny\"}]}",
+  "content": "nip44 encrypted:{\"query_type\": \"auth_rules_all\", \"total_results\": 2, \"timestamp\": 1234567890, \"data\": [{\"rule_type\": \"blacklist\", \"pattern_type\": \"pubkey\", \"pattern_value\": \"abc123...\", \"action\": \"allow\"}]}",
  "tags": [
    ["p", "admin_public_key"]
  ],
@@ -161,7 +166,7 @@ All admin commands return **signed EVENT responses** via WebSocket following sta
  "pubkey": "relay_public_key",
  "created_at": 1234567890,
  "kind": 23457,
-  "content": "nip44 encrypted:{\"query_type\": \"config_keys\", \"config_keys\": [\"auth_enabled\", \"max_connections\"], \"descriptions\": {\"auth_enabled\": \"Enable whitelist/blacklist rules\"}}",
+  "content": "nip44 encrypted:{\"query_type\": \"config_all\", \"total_results\": 27, \"timestamp\": 1234567890, \"data\": [{\"key\": \"auth_enabled\", \"value\": \"false\", \"data_type\": \"boolean\", \"category\": \"auth\", \"description\": \"Enable NIP-42 authentication\"}, {\"key\": \"relay_description\", \"value\": \"My Relay\", \"data_type\": \"string\", \"category\": \"relay\", \"description\": \"Relay description text\"}]}",
  "tags": [
    ["p", "admin_public_key"]
  ],
@@ -169,3 +174,32 @@ All admin commands return **signed EVENT responses** via WebSocket following sta
 }]
 ```

+**Configuration Update Success Response:**
+```json
+["EVENT", "temp_sub_id", {
+  "id": "response_event_id",
+  "pubkey": "relay_public_key",
+  "created_at": 1234567890,
+  "kind": 23457,
+  "content": "nip44 encrypted:{\"query_type\": \"config_update\", \"total_results\": 2, \"timestamp\": 1234567890, \"status\": \"success\", \"data\": [{\"key\": \"auth_enabled\", \"value\": \"true\", \"status\": \"updated\"}, {\"key\": \"relay_description\", \"value\": \"My Updated Relay\", \"status\": \"updated\"}]}",
+  "tags": [
+    ["p", "admin_public_key"]
+  ],
+  "sig": "response_event_signature"
+}]
+```
+
+**Configuration Update Error Response:**
+```json
+["EVENT", "temp_sub_id", {
+  "id": "response_event_id",
+  "pubkey": "relay_public_key",
+  "created_at": 1234567890,
+  "kind": 23457,
+  "content": "nip44 encrypted:{\"query_type\": \"config_update\", \"status\": \"error\", \"error\": \"field validation failed: invalid port number '99999' (must be 1-65535)\", \"timestamp\": 1234567890}",
+  "tags": [
+    ["p", "admin_public_key"]
+  ],
+  "sig": "response_event_signature"
+}]
+```
--- a/api/button.html
+++ b/api/button.html
@@ -0,0 +1,134 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Embedded NOSTR_LOGIN_LITE</title>
+  <style>
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+      margin: 0;
+      padding: 40px;
+      background: white;
+      display: flex;
+      justify-content: center;
+      align-items: center;
+      min-height: 90vh;
+    }
+
+    .container {
+      max-width: 400px;
+      width: 100%;
+    }
+
+    #login-button {
+      background: #0066cc;
+      color: white;
+      padding: 12px 24px;
+      border: none;
+      border-radius: 6px;
+      cursor: pointer;
+      font-size: 16px;
+      text-align: center;
+      transition: background 0.2s;
+    }
+
+    #login-button:hover {
+      opacity: 0.8;
+    }
+  </style>
+</head>
+
+<body>
+  <div class="container">
+    <div id="login-button">Login</div>
+  </div>
+
+  <script src="../lite/nostr.bundle.js"></script>
+  <script src="../lite/nostr-lite.js"></script>
+
+  <script>
+    let isAuthenticated = false;
+    let currentUser = null;
+
+    document.addEventListener('DOMContentLoaded', async () => {
+      await window.NOSTR_LOGIN_LITE.init({
+
+        methods: {
+          extension: true,
+          local: true,
+          readonly: true,
+          connect: true,
+          remote: true,
+          otp: true
+        },
+        floatingTab: {
+          enabled: false
+        }
+      });
+
+      // Listen for authentication events
+      window.addEventListener('nlMethodSelected', handleAuthEvent);
+      window.addEventListener('nlLogout', handleLogoutEvent);
+
+      // Check for existing authentication state
+      checkAuthState();
+
+      // Initialize button
+      updateButtonState();
+    });
+
+    function handleAuthEvent(event) {
+      const { pubkey, method } = event.detail;
+      console.log(`Authenticated with ${method}, pubkey: ${pubkey}`);
+      
+      isAuthenticated = true;
+      currentUser = event.detail;
+      updateButtonState();
+    }
+
+    function handleLogoutEvent() {
+      console.log('Logout event received');
+      
+      isAuthenticated = false;
+      currentUser = null;
+      updateButtonState();
+    }
+
+    function checkAuthState() {
+      // Check if user is already authenticated (from persistent storage)
+      try {
+        // Try to get public key - this will work if already authenticated
+        window.nostr.getPublicKey().then(pubkey => {
+          console.log('Found existing authentication, pubkey:', pubkey);
+          isAuthenticated = true;
+          currentUser = { pubkey, method: 'persistent' };
+          updateButtonState();
+        }).catch(error => {
+          console.log('No existing authentication found:', error.message);
+          // User is not authenticated, button stays in login state
+        });
+      } catch (error) {
+        console.log('No existing authentication found');
+        // User is not authenticated, button stays in login state
+      }
+    }
+
+    function updateButtonState() {
+      const button = document.getElementById('login-button');
+      
+      if (isAuthenticated) {
+        button.textContent = 'Logout';
+        button.onclick = () => window.NOSTR_LOGIN_LITE.logout();
+        button.style.background = '#dc3545'; // Red for logout
+      } else {
+        button.textContent = 'Login';
+        button.onclick = () => window.NOSTR_LOGIN_LITE.launch('login');
+        button.style.background = '#0066cc'; // Blue for login
+      }
+    }
+  </script>
+</body>
+
+</html>
--- a/api/index.html
+++ b/api/index.html
--- a/docs/admin_api_plan.md
+++ b/docs/admin_api_plan.md
@@ -36,122 +36,70 @@ CREATE TABLE auth_rules (

 #### Admin API Commands (via WebSocket with admin private key)

-**Kind 23455: Configuration Management (Ephemeral)**
- Update relay settings, limits, authentication policies
- **Standard Mode**: Commands in tags `["config_key", "config_value"]`
- **Encrypted Mode**: Commands NIP-44 encrypted in content `{"encrypted_tags": "..."}`
- Content: Descriptive text or encrypted payload
- Security: Optional NIP-44 encryption for sensitive operations
-
-**Kind 23456: Auth Rules & System Management (Ephemeral)**
+**Kind 23456: Unified Admin API (Ephemeral)**
+- Configuration management: Update relay settings, limits, authentication policies
 - Auth rules: Add/remove/query whitelist/blacklist rules
 - System commands: clear rules, status, cache management
- **Standard Mode**: Commands in tags
-  - Rule format: `["rule_type", "pattern_type", "pattern_value"]`
-  - Query format: `["auth_query", "filter"]`
-  - System format: `["system_command", "command_name"]`
- **Encrypted Mode**: Commands NIP-44 encrypted in content `{"encrypted_tags": "..."}`
- Content: Action description + optional encrypted payload
- Security: Optional NIP-44 encryption for sensitive operations
+- **Unified Format**: All commands use NIP-44 encrypted content with `["p", "relay_pubkey"]` tags
+- **Command Types**:
+  - Configuration: `["config_key", "config_value"]`
+  - Auth rules: `["rule_type", "pattern_type", "pattern_value"]`
+  - Queries: `["auth_query", "filter"]` or `["system_command", "command_name"]`
+- **Security**: All admin commands use NIP-44 encryption for privacy and security

-#### Configuration Query Commands (using Kind 23455)
+#### Configuration Commands (using Kind 23456)

-1. **List All Configuration Keys (Standard)**:
-   ```json
-   {
-     "kind": 23455,
-     "content": "Discovery query",
-     "tags": [["config_query", "list_all_keys"]]
-   }
-   ```
-
-2. **List All Configuration Keys (Encrypted)**:
-   ```json
-   {
-     "kind": 23455,
-     "content": "{\"query\":\"list_config_keys\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
-     "tags": []
-   }
-   ```
-   *Encrypted payload contains:* `[["config_query", "list_all_keys"]]`
-
-3. **Get Current Configuration (Standard)**:
-   ```json
-   {
-     "kind": 23455,
-     "content": "Config query",
-     "tags": [["config_query", "get_current_config"]]
-   }
-   ```
-
-4. **Get Current Configuration (Encrypted)**:
-   ```json
-   {
-     "kind": 23455,
-     "content": "{\"query\":\"get_config\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
-     "tags": []
-   }
-   ```
-   *Encrypted payload contains:* `[["config_query", "get_current_config"]]`
-
-#### System Management Commands (using Kind 23456)
-
-1. **Clear All Auth Rules (Standard)**:
+1. **Update Configuration**:
   ```json
   {
     "kind": 23456,
-     "content": "{\"action\":\"clear_all\"}",
-     "tags": [["system_command", "clear_all_auth_rules"]]
+     "content": "base64_nip44_encrypted_command_array",
+     "tags": [["p", "relay_pubkey"]]
   }
   ```
+   *Encrypted content contains:* `["relay_description", "My Relay"]`

-2. **Clear All Auth Rules (Encrypted)**:
+2. **Query System Status**:
   ```json
   {
     "kind": 23456,
-     "content": "{\"action\":\"clear_all\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
-     "tags": []
+     "content": "base64_nip44_encrypted_command_array",
+     "tags": [["p", "relay_pubkey"]]
   }
   ```
-   *Encrypted payload contains:* `[["system_command", "clear_all_auth_rules"]]`
+   *Encrypted content contains:* `["system_command", "system_status"]`

-3. **Query All Auth Rules (Standard)**:
+#### Auth Rules and System Commands (using Kind 23456)
+
+1. **Clear All Auth Rules**:
   ```json
   {
     "kind": 23456,
-     "content": "{\"query\":\"list_auth_rules\"}",
-     "tags": [["auth_query", "all"]]
+     "content": "base64_nip44_encrypted_command_array",
+     "tags": [["p", "relay_pubkey"]]
   }
   ```
+   *Encrypted content contains:* `["system_command", "clear_all_auth_rules"]`

-4. **Query All Auth Rules (Encrypted)**:
+2. **Query All Auth Rules**:
   ```json
   {
     "kind": 23456,
-     "content": "{\"query\":\"list_auth_rules\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
-     "tags": []
+     "content": "base64_nip44_encrypted_command_array",
+     "tags": [["p", "relay_pubkey"]]
   }
   ```
-   *Encrypted payload contains:* `[["auth_query", "all"]]`
+   *Encrypted content contains:* `["auth_query", "all"]`

-5. **Add Blacklist Rule (Standard)**:
+3. **Add Blacklist Rule**:
   ```json
   {
     "kind": 23456,
-     "content": "{\"action\":\"add\"}",
-     "tags": [["blacklist", "pubkey", "deadbeef1234abcd..."]]
+     "content": "base64_nip44_encrypted_command_array",
+     "tags": [["p", "relay_pubkey"]]
   }
   ```
-
-6. **Add Blacklist Rule (Encrypted)**:
-   ```json
-   {
-     "kind": 23456,
-     "content": "{\"action\":\"add\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
-     "tags": []
-   }
-   ```
-   *Encrypted payload contains:* `[["blacklist", "pubkey", "deadbeef1234abcd..."]]`
+   *Encrypted content contains:* `["blacklist", "pubkey", "deadbeef1234abcd..."]`

 ### Phase 2: Auth Rules Schema Alignment

@@ -181,12 +129,12 @@ Would require changing schema, migration scripts, and storage logic.
 #### High Priority (Critical for blacklist functionality):
 1. Fix request_validator.c schema mismatch
 2. Ensure auth_required configuration is enabled
-3. Update tests to use ephemeral event kinds (23455/23456)
+3. Update tests to use unified ephemeral event kind (23456)
 4. Test blacklist enforcement

 #### Medium Priority (Enhanced Admin Features):
 1. **Implement NIP-44 Encryption Support**:
-   - Detect empty tags array for Kind 23455/23456 events
+   - Detect NIP-44 encrypted content for Kind 23456 events
   - Parse `encrypted_tags` field from content JSON
   - Decrypt using admin privkey and relay pubkey
   - Process decrypted tags as normal commands
@@ -218,45 +166,20 @@ Would require changing schema, migration scripts, and storage logic.
 ## Authentication
 All admin commands require signing with the admin private key generated during first startup.

-## Configuration Management (Kind 23455 - Ephemeral)
+## Unified Admin API (Kind 23456 - Ephemeral)
 Update relay configuration parameters or query available settings.

 **Configuration Update Event:**
 ```json
 {
-  "kind": 23455,
-  "content": "Configuration update",
-  "tags": [
-    ["config_key1", "config_value1"],
-    ["config_key2", "config_value2"]
-  ]
+  "kind": 23456,
+  "content": "base64_nip44_encrypted_command_array",
+  "tags": [["p", "relay_pubkey"]]
 }
 ```
+*Encrypted content contains:* `["relay_description", "My Relay Description"]`

-**List Available Config Keys:**
-```json
-{
-  "kind": 23455,
-  "content": "{\"query\":\"list_config_keys\",\"description\":\"Get editable config keys\"}",
-  "tags": [
-    ["config_query", "list_all_keys"]
-  ]
-}
-```
-
-**Get Current Configuration:**
-```json
-{
-  "kind": 23455,
-  "content": "{\"query\":\"get_config\",\"description\":\"Get current config values\"}",
-  "tags": [
-    ["config_query", "get_current_config"]
-  ]
-}
-```
-
-## Auth Rules Management (Kind 23456 - Ephemeral)
-Manage whitelist and blacklist rules.
+**Auth Rules Management:**

 **Add Rule Event:**
 ```json
@@ -364,7 +287,7 @@ All admin commands return JSON responses via WebSocket:
 ### Enable Authentication & Add Blacklist
 ```bash
 # 1. Enable auth system
-nak event -k 23455 --content "Enable authentication" \
+nak event -k 23456 --content "base64_nip44_encrypted_command" \
  -t "auth_enabled=true" \
  --sec $ADMIN_PRIVKEY | nak event ws://localhost:8888

@@ -389,18 +312,18 @@ nak event -k 23456 --content '{"action":"clear_all","description":"Clear all rul
 ### Configuration Query Response
 ```json
 ["EVENT", "subscription_id", {
-  "kind": 23455,
-  "content": "{\"config_keys\": [\"auth_enabled\", \"max_connections\"], \"descriptions\": {\"auth_enabled\": \"Enable whitelist/blacklist rules\"}}",
-  "tags": [["response_type", "config_keys_list"]]
+  "kind": 23457,
+  "content": "base64_nip44_encrypted_response",
+  "tags": [["p", "admin_pubkey"]]
 }]
 ```

 ### Current Config Response
 ```json
 ["EVENT", "subscription_id", {
-  "kind": 23455,
-  "content": "{\"current_config\": {\"auth_enabled\": \"true\", \"max_connections\": \"1000\"}}",
-  "tags": [["response_type", "current_config"]]
+  "kind": 23457,
+  "content": "base64_nip44_encrypted_response",
+  "tags": [["p", "admin_pubkey"]]
 }]
 ```

@@ -427,7 +350,7 @@ nak event -k 23456 --content '{"action":"clear_all","description":"Clear all rul
 1. **Document API** (this file) ✅
 2. **Update to ephemeral event kinds** ✅
 3. **Fix request_validator.c** schema mismatch
-4. **Update tests** to use Kind 23455/23456
+4. **Update tests** to use unified Kind 23456
 5. **Add auth rule query functionality**
 6. **Add configuration discovery feature**
 7. **Test blacklist functionality**
@@ -449,8 +372,8 @@ This plan addresses the immediate blacklist issue while establishing a comprehen
 ```c
 // In admin event processing function
 bool is_encrypted_command(struct nostr_event *event) {
-    // Check if Kind 23455 or 23456 with empty tags
-    if ((event->kind == 23455 || event->kind == 23456) &&
+    // Check if Kind 23456 with NIP-44 encrypted content
+    if (event->kind == 23456 &&
        event->tags_count == 0) {
        return true;
    }
@@ -483,7 +406,7 @@ cJSON *decrypt_admin_tags(struct nostr_event *event) {
 ```

 ### Admin Event Processing Flow
-1. **Receive Event**: Kind 23455/23456 with admin signature
+1. **Receive Event**: Kind 23456 with admin signature
 2. **Check Mode**: Empty tags = encrypted, populated tags = standard
 3. **Decrypt if Needed**: Extract and decrypt `encrypted_tags` from content
 4. **Process Commands**: Use decrypted/standard tags for command processing
@@ -510,7 +433,7 @@ char* nip44_decrypt(const char* ciphertext, const char* recipient_privkey, const

 #### Phase 1: Core Infrastructure (Complete)
 - [x] Event-based admin authentication system
- [x] Kind 23455/23456 (Configuration/Auth Rules) processing
+- [x] Kind 23456 (Unified Admin API) processing
 - [x] Basic configuration parameter updates
 - [x] Auth rule add/remove/clear functionality
 - [x] Updated to ephemeral event kinds
--- a/make_and_restart_relay.sh
+++ b/make_and_restart_relay.sh
@@ -282,14 +282,14 @@ cd build
 # Start relay in background and capture its PID
 if [ "$USE_TEST_KEYS" = true ]; then
    echo "Using deterministic test keys for development..."
-    ./$(basename $BINARY_PATH) -a aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa -r 1111111111111111111111111111111111111111111111111111111111111111 > ../relay.log 2>&1 &
+    ./$(basename $BINARY_PATH) -a aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa -r 1111111111111111111111111111111111111111111111111111111111111111 --strict-port > ../relay.log 2>&1 &
 elif [ -n "$RELAY_ARGS" ]; then
    echo "Starting relay with custom configuration..."
-    ./$(basename $BINARY_PATH) $RELAY_ARGS > ../relay.log 2>&1 &
+    ./$(basename $BINARY_PATH) $RELAY_ARGS --strict-port > ../relay.log 2>&1 &
 else
    # No command line arguments needed for random key generation
    echo "Starting relay with random key generation..."
-    ./$(basename $BINARY_PATH) > ../relay.log 2>&1 &
+    ./$(basename $BINARY_PATH) --strict-port > ../relay.log 2>&1 &
 fi
 RELAY_PID=$!
 # Change back to original directory
--- a/nip11_relay_connection_implementation_plan.md
+++ b/nip11_relay_connection_implementation_plan.md
@@ -0,0 +1,455 @@
+# NIP-11 Relay Connection Implementation Plan
+
+## Overview
+Implement NIP-11 relay information fetching in the web admin interface to replace hardcoded relay pubkey and provide proper relay connection flow.
+
+## Current Issues
+1. **Hardcoded Relay Pubkey**: `getRelayPubkey()` returns hardcoded value `'4f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa'`
+2. **Relay URL in Debug Section**: Currently in "DEBUG - TEST FETCH WITHOUT LOGIN" section (lines 336-385)
+3. **No Relay Verification**: Users can attempt admin operations without verifying relay identity
+4. **Missing NIP-11 Support**: No fetching of relay information document
+
+## Implementation Plan
+
+### 1. New Relay Connection Section (HTML Structure)
+
+Add after User Info section (around line 332):
+
+```html
+<!-- Relay Connection Section -->
+<div class="section">
+    <h2>RELAY CONNECTION</h2>
+    <div class="input-group">
+        <label for="relay-url-input">Relay URL:</label>
+        <input type="text" id="relay-url-input" value="ws://localhost:8888" placeholder="ws://localhost:8888 or wss://relay.example.com">
+    </div>
+    <div class="inline-buttons">
+        <button type="button" id="connect-relay-btn">CONNECT TO RELAY</button>
+        <button type="button" id="disconnect-relay-btn" style="display: none;">DISCONNECT</button>
+    </div>
+    <div class="status disconnected" id="relay-connection-status">NOT CONNECTED</div>
+    
+    <!-- Relay Information Display -->
+    <div id="relay-info-display" class="hidden">
+        <h3>Relay Information</h3>
+        <div class="user-info">
+            <div><strong>Name:</strong> <span id="relay-name">-</span></div>
+            <div><strong>Description:</strong> <span id="relay-description">-</span></div>
+            <div><strong>Public Key:</strong>
+                <div class="user-pubkey" id="relay-pubkey-display">-</div>
+            </div>
+            <div><strong>Software:</strong> <span id="relay-software">-</span></div>
+            <div><strong>Version:</strong> <span id="relay-version">-</span></div>
+            <div><strong>Contact:</strong> <span id="relay-contact">-</span></div>
+            <div><strong>Supported NIPs:</strong> <span id="relay-nips">-</span></div>
+        </div>
+    </div>
+</div>
+```
+
+### 2. JavaScript Implementation
+
+#### Global State Variables
+Add to global state section (around line 535):
+
+```javascript
+// Relay connection state
+let relayInfo = null;
+let isRelayConnected = false;
+let relayWebSocket = null;
+```
+
+#### NIP-11 Fetching Function
+Add new function:
+
+```javascript
+// Fetch relay information using NIP-11
+async function fetchRelayInfo(relayUrl) {
+    try {
+        console.log('=== FETCHING RELAY INFO VIA NIP-11 ===');
+        console.log('Relay URL:', relayUrl);
+        
+        // Convert WebSocket URL to HTTP URL for NIP-11
+        let httpUrl = relayUrl;
+        if (relayUrl.startsWith('ws://')) {
+            httpUrl = relayUrl.replace('ws://', 'http://');
+        } else if (relayUrl.startsWith('wss://')) {
+            httpUrl = relayUrl.replace('wss://', 'https://');
+        }
+        
+        console.log('HTTP URL for NIP-11:', httpUrl);
+        
+        // Fetch relay information document
+        const response = await fetch(httpUrl, {
+            method: 'GET',
+            headers: {
+                'Accept': 'application/nostr+json'
+            },
+            // Add timeout
+            signal: AbortSignal.timeout(10000) // 10 second timeout
+        });
+        
+        if (!response.ok) {
+            throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+        }
+        
+        const contentType = response.headers.get('content-type');
+        if (!contentType || !contentType.includes('application/json')) {
+            throw new Error(`Invalid content type: ${contentType}. Expected application/json or application/nostr+json`);
+        }
+        
+        const relayInfoData = await response.json();
+        console.log('Fetched relay info:', relayInfoData);
+        
+        // Validate required fields
+        if (!relayInfoData.pubkey) {
+            throw new Error('Relay information missing required pubkey field');
+        }
+        
+        // Validate pubkey format (64 hex characters)
+        if (!/^[0-9a-fA-F]{64}$/.test(relayInfoData.pubkey)) {
+            throw new Error(`Invalid relay pubkey format: ${relayInfoData.pubkey}`);
+        }
+        
+        return relayInfoData;
+        
+    } catch (error) {
+        console.error('Failed to fetch relay info:', error);
+        throw error;
+    }
+}
+```
+
+#### Relay Connection Function
+Add new function:
+
+```javascript
+// Connect to relay and fetch information
+async function connectToRelay() {
+    try {
+        const relayUrlInput = document.getElementById('relay-url-input');
+        const connectBtn = document.getElementById('connect-relay-btn');
+        const disconnectBtn = document.getElementById('disconnect-relay-btn');
+        const statusDiv = document.getElementById('relay-connection-status');
+        const infoDisplay = document.getElementById('relay-info-display');
+        
+        const url = relayUrlInput.value.trim();
+        if (!url) {
+            throw new Error('Please enter a relay URL');
+        }
+        
+        // Update UI to show connecting state
+        connectBtn.disabled = true;
+        statusDiv.textContent = 'CONNECTING...';
+        statusDiv.className = 'status connected';
+        
+        console.log('Connecting to relay:', url);
+        
+        // Fetch relay information via NIP-11
+        console.log('Fetching relay information...');
+        const fetchedRelayInfo = await fetchRelayInfo(url);
+        
+        // Test WebSocket connection
+        console.log('Testing WebSocket connection...');
+        await testWebSocketConnection(url);
+        
+        // Store relay information
+        relayInfo = fetchedRelayInfo;
+        isRelayConnected = true;
+        
+        // Update UI with relay information
+        displayRelayInfo(relayInfo);
+        
+        // Update connection status
+        statusDiv.textContent = 'CONNECTED';
+        statusDiv.className = 'status connected';
+        
+        // Update button states
+        connectBtn.style.display = 'none';
+        disconnectBtn.style.display = 'inline-block';
+        relayUrlInput.disabled = true;
+        
+        // Show relay info
+        infoDisplay.classList.remove('hidden');
+        
+        console.log('Successfully connected to relay:', relayInfo.name || url);
+        log(`Connected to relay: ${relayInfo.name || url}`, 'INFO');
+        
+    } catch (error) {
+        console.error('Failed to connect to relay:', error);
+        
+        // Reset UI state
+        const connectBtn = document.getElementById('connect-relay-btn');
+        const statusDiv = document.getElementById('relay-connection-status');
+        
+        connectBtn.disabled = false;
+        statusDiv.textContent = `CONNECTION FAILED: ${error.message}`;
+        statusDiv.className = 'status error';
+        
+        // Clear any partial state
+        relayInfo = null;
+        isRelayConnected = false;
+        
+        log(`Failed to connect to relay: ${error.message}`, 'ERROR');
+    }
+}
+```
+
+#### WebSocket Connection Test
+Add new function:
+
+```javascript
+// Test WebSocket connection to relay
+async function testWebSocketConnection(url) {
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+            ws.close();
+            reject(new Error('WebSocket connection timeout'));
+        }, 5000);
+        
+        const ws = new WebSocket(url);
+        
+        ws.onopen = () => {
+            clearTimeout(timeout);
+            console.log('WebSocket connection successful');
+            ws.close();
+            resolve();
+        };
+        
+        ws.onerror = (error) => {
+            clearTimeout(timeout);
+            console.error('WebSocket connection failed:', error);
+            reject(new Error('WebSocket connection failed'));
+        };
+        
+        ws.onclose = (event) => {
+            if (event.code !== 1000) {
+                clearTimeout(timeout);
+                reject(new Error(`WebSocket closed with code ${event.code}: ${event.reason}`));
+            }
+        };
+    });
+}
+```
+
+#### Display Relay Information
+Add new function:
+
+```javascript
+// Display relay information in the UI
+function displayRelayInfo(info) {
+    document.getElementById('relay-name').textContent = info.name || 'Unknown';
+    document.getElementById('relay-description').textContent = info.description || 'No description';
+    document.getElementById('relay-pubkey-display').textContent = info.pubkey || 'Unknown';
+    document.getElementById('relay-software').textContent = info.software || 'Unknown';
+    document.getElementById('relay-version').textContent = info.version || 'Unknown';
+    document.getElementById('relay-contact').textContent = info.contact || 'No contact info';
+    
+    // Format supported NIPs
+    let nipsText = 'None specified';
+    if (info.supported_nips && Array.isArray(info.supported_nips) && info.supported_nips.length > 0) {
+        nipsText = info.supported_nips.map(nip => `NIP-${nip.toString().padStart(2, '0')}`).join(', ');
+    }
+    document.getElementById('relay-nips').textContent = nipsText;
+}
+```
+
+#### Disconnect Function
+Add new function:
+
+```javascript
+// Disconnect from relay
+function disconnectFromRelay() {
+    console.log('Disconnecting from relay...');
+    
+    // Clear relay state
+    relayInfo = null;
+    isRelayConnected = false;
+    
+    // Close any existing connections
+    if (relayPool) {
+        const url = document.getElementById('relay-url-input').value.trim();
+        if (url) {
+            relayPool.close([url]);
+        }
+        relayPool = null;
+        subscriptionId = null;
+    }
+    
+    // Reset UI
+    const connectBtn = document.getElementById('connect-relay-btn');
+    const disconnectBtn = document.getElementById('disconnect-relay-btn');
+    const statusDiv = document.getElementById('relay-connection-status');
+    const infoDisplay = document.getElementById('relay-info-display');
+    const relayUrlInput = document.getElementById('relay-url-input');
+    
+    connectBtn.style.display = 'inline-block';
+    disconnectBtn.style.display = 'none';
+    connectBtn.disabled = false;
+    relayUrlInput.disabled = false;
+    
+    statusDiv.textContent = 'NOT CONNECTED';
+    statusDiv.className = 'status disconnected';
+    
+    infoDisplay.classList.add('hidden');
+    
+    // Reset configuration status
+    updateConfigStatus(false);
+    
+    log('Disconnected from relay', 'INFO');
+}
+```
+
+#### Update getRelayPubkey Function
+Replace existing function (around line 3142):
+
+```javascript
+// Helper function to get relay pubkey from connected relay info
+function getRelayPubkey() {
+    if (relayInfo && relayInfo.pubkey) {
+        return relayInfo.pubkey;
+    }
+    
+    // Fallback to hardcoded value if no relay connected (for testing)
+    console.warn('No relay connected, using fallback pubkey');
+    return '4f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa';
+}
+```
+
+### 3. Event Handlers
+
+Add event handlers in the DOMContentLoaded section:
+
+```javascript
+// Relay connection event handlers
+const connectRelayBtn = document.getElementById('connect-relay-btn');
+const disconnectRelayBtn = document.getElementById('disconnect-relay-btn');
+
+if (connectRelayBtn) {
+    connectRelayBtn.addEventListener('click', function(e) {
+        e.preventDefault();
+        connectToRelay().catch(error => {
+            console.error('Connect to relay failed:', error);
+        });
+    });
+}
+
+if (disconnectRelayBtn) {
+    disconnectRelayBtn.addEventListener('click', function(e) {
+        e.preventDefault();
+        disconnectFromRelay();
+    });
+}
+```
+
+### 4. Update Existing Functions
+
+#### Update fetchConfiguration Function
+Add relay connection check at the beginning:
+
+```javascript
+async function fetchConfiguration() {
+    try {
+        console.log('=== FETCHING CONFIGURATION VIA ADMIN API ===');
+        
+        // Check if relay is connected
+        if (!isRelayConnected || !relayInfo) {
+            throw new Error('Must be connected to relay first. Please connect to relay in the Relay Connection section.');
+        }
+        
+        // ... rest of existing function
+    } catch (error) {
+        // ... existing error handling
+    }
+}
+```
+
+#### Update subscribeToConfiguration Function
+Add relay connection check:
+
+```javascript
+async function subscribeToConfiguration() {
+    try {
+        console.log('=== STARTING SIMPLEPOOL CONFIGURATION SUBSCRIPTION ===');
+
+        if (!isRelayConnected || !relayInfo) {
+            console.error('Must be connected to relay first');
+            return false;
+        }
+
+        // Use the relay URL from the connection section instead of the debug section
+        const url = document.getElementById('relay-url-input').value.trim();
+        
+        // ... rest of existing function
+    } catch (error) {
+        // ... existing error handling
+    }
+}
+```
+
+### 5. Update UI Flow
+
+#### Modify showMainInterface Function
+Update to show relay connection requirement:
+
+```javascript
+function showMainInterface() {
+    loginSection.classList.add('hidden');
+    mainInterface.classList.remove('hidden');
+    userPubkeyDisplay.textContent = userPubkey;
+    
+    // Show message about relay connection requirement
+    if (!isRelayConnected) {
+        log('Please connect to a relay to access admin functions', 'INFO');
+    }
+}
+```
+
+### 6. Remove/Update Debug Section
+
+#### Option 1: Remove Debug Section Entirely
+Remove the "DEBUG - TEST FETCH WITHOUT LOGIN" section (lines 335-385) since relay URL is now in the proper connection section.
+
+#### Option 2: Keep Debug Section for Testing
+Update the debug section to use the connected relay URL and add a note that it's for testing purposes.
+
+### 7. Error Handling
+
+Add comprehensive error handling for:
+- Network timeouts
+- Invalid relay URLs
+- Missing NIP-11 support
+- Invalid relay pubkey format
+- WebSocket connection failures
+- CORS issues
+
+### 8. Security Considerations
+
+- Validate relay pubkey format (64 hex characters)
+- Verify relay identity before admin operations
+- Handle CORS properly for NIP-11 requests
+- Sanitize relay information display
+- Warn users about connecting to untrusted relays
+
+## Testing Plan
+
+1. **NIP-11 Fetching**: Test with various relay URLs (localhost, remote relays)
+2. **Error Handling**: Test with invalid URLs, non-Nostr servers, network failures
+3. **WebSocket Connection**: Verify WebSocket connectivity after NIP-11 fetch
+4. **Admin API Integration**: Ensure admin commands use correct relay pubkey
+5. **UI Flow**: Test complete user journey from login → relay connection → admin operations
+
+## Benefits
+
+1. **Proper Relay Identification**: Uses actual relay pubkey instead of hardcoded value
+2. **Better UX**: Clear connection flow and relay information display
+3. **Protocol Compliance**: Implements NIP-11 standard for relay discovery
+4. **Security**: Verifies relay identity before admin operations
+5. **Flexibility**: Works with any NIP-11 compliant relay
+
+## Migration Notes
+
+- Existing users will need to connect to relay after this update
+- Debug section can be kept for development/testing purposes
+- All admin functions will require relay connection
+- Relay pubkey will be dynamically fetched instead of hardcoded
--- a/relay.pid
+++ b/relay.pid
@@ -1 +1 @@
-652192
+1371445
--- a/src/config.c
+++ b/src/config.c
@@ -72,11 +72,14 @@ int remove_auth_rule_from_config(const char* rule_type, const char* pattern_type
 int is_config_table_ready(void);
 int migrate_config_from_events_to_table(void);
 int populate_config_table_from_event(const cJSON* event);
+int handle_config_query_unified(cJSON* event, const char* query_type, char* error_message, size_t error_size, struct lws* wsi);
+int handle_config_set_unified(cJSON* event, const char* config_key, const char* config_value, char* error_message, size_t error_size, struct lws* wsi);

 // Forward declarations for tag parsing utilities
 const char* get_first_tag_name(cJSON* event);
 const char* get_tag_value(cJSON* event, const char* tag_name, int value_index);
 int parse_auth_query_parameters(cJSON* event, char** query_type, char** pattern_value);
+int handle_config_update_unified(cJSON* event, char* error_message, size_t error_size, struct lws* wsi);


 // Current configuration cache
@@ -342,7 +345,7 @@ int store_config_event_in_database(const cJSON* event) {
        return -1;
    }
    
-    // Insert or replace the configuration event (kind 33334 is replaceable)
+    // Insert or replace the configuration event
    const char* sql = "INSERT OR REPLACE INTO events (id, pubkey, created_at, kind, event_type, content, sig, tags) VALUES (?, ?, ?, ?, ?, ?, ?, ?)";
    sqlite3_stmt* stmt;
    
@@ -357,7 +360,7 @@ int store_config_event_in_database(const cJSON* event) {
    sqlite3_bind_text(stmt, 2, cJSON_GetStringValue(pubkey_obj), -1, SQLITE_STATIC);
    sqlite3_bind_int64(stmt, 3, (sqlite3_int64)cJSON_GetNumberValue(created_at_obj));
    sqlite3_bind_int(stmt, 4, (int)cJSON_GetNumberValue(kind_obj));
-    sqlite3_bind_text(stmt, 5, "addressable", -1, SQLITE_STATIC);  // kind 33334 is addressable
+    sqlite3_bind_text(stmt, 5, "regular", -1, SQLITE_STATIC);
    sqlite3_bind_text(stmt, 6, cJSON_GetStringValue(content_obj), -1, SQLITE_STATIC);
    sqlite3_bind_text(stmt, 7, cJSON_GetStringValue(sig_obj), -1, SQLITE_STATIC);
    sqlite3_bind_text(stmt, 8, tags_str, -1, SQLITE_TRANSIENT);
@@ -380,65 +383,9 @@ cJSON* load_config_event_from_database(const char* relay_pubkey) {
        return NULL;
    }
    
-    const char* sql;
-    sqlite3_stmt* stmt;
-    int rc;
-    
-    // Try to get admin pubkey from cache, otherwise find the most recent kind 33334 event
-    const char* admin_pubkey = get_admin_pubkey_cached();
-    if (admin_pubkey && strlen(admin_pubkey) > 0) {
-        sql = "SELECT id, pubkey, created_at, kind, content, sig, tags FROM events WHERE kind = 33334 AND pubkey = ? ORDER BY created_at DESC LIMIT 1";
-        rc = sqlite3_prepare_v2(g_db, sql, -1, &stmt, NULL);
-        if (rc != SQLITE_OK) {
-            log_error("Failed to prepare configuration event query");
-            return NULL;
-        }
-        sqlite3_bind_text(stmt, 1, admin_pubkey, -1, SQLITE_STATIC);
-    } else {
-        // During existing relay startup, we don't know the admin pubkey yet
-        // Look for any kind 33334 configuration event (should only be one per relay)
-        sql = "SELECT id, pubkey, created_at, kind, content, sig, tags FROM events WHERE kind = 33334 ORDER BY created_at DESC LIMIT 1";
-        rc = sqlite3_prepare_v2(g_db, sql, -1, &stmt, NULL);
-        if (rc != SQLITE_OK) {
-            log_error("Failed to prepare configuration event query");
-            return NULL;
-        }
-    }
-    
-    cJSON* event = NULL;
-    if (sqlite3_step(stmt) == SQLITE_ROW) {
-        // Reconstruct the event JSON from database columns
-        event = cJSON_CreateObject();
-        if (event) {
-            const char* event_pubkey = (const char*)sqlite3_column_text(stmt, 1);
-            
-            cJSON_AddStringToObject(event, "id", (const char*)sqlite3_column_text(stmt, 0));
-            cJSON_AddStringToObject(event, "pubkey", event_pubkey);
-            cJSON_AddNumberToObject(event, "created_at", sqlite3_column_int64(stmt, 2));
-            cJSON_AddNumberToObject(event, "kind", sqlite3_column_int(stmt, 3));
-            cJSON_AddStringToObject(event, "content", (const char*)sqlite3_column_text(stmt, 4));
-            cJSON_AddStringToObject(event, "sig", (const char*)sqlite3_column_text(stmt, 5));
-            
-            // If we didn't have admin pubkey in cache, we should update the cache
-            // Note: This will be handled by the cache refresh mechanism automatically
-            
-            // Parse tags JSON
-            const char* tags_str = (const char*)sqlite3_column_text(stmt, 6);
-            if (tags_str) {
-                cJSON* tags = cJSON_Parse(tags_str);
-                if (tags) {
-                    cJSON_AddItemToObject(event, "tags", tags);
-                } else {
-                    cJSON_AddItemToObject(event, "tags", cJSON_CreateArray());
-                }
-            } else {
-                cJSON_AddItemToObject(event, "tags", cJSON_CreateArray());
-            }
-        }
-    }
-    
-    sqlite3_finalize(stmt);
-    return event;
+    // Configuration is now managed through config table, not events
+    log_info("Configuration events are no longer stored in events table");
+    return NULL;
 }

 // ================================
@@ -1775,7 +1722,7 @@ int apply_runtime_config_handlers(const cJSON* old_config, const cJSON* new_conf
    if (handlers_applied > 0) {
        char audit_msg[512];
        snprintf(audit_msg, sizeof(audit_msg),
-                "Configuration updated via kind 33334 event - %d system components reinitialized",
+                "Configuration updated via admin event - %d system components reinitialized",
                handlers_applied);
        log_success(audit_msg);
    } else {
@@ -1832,7 +1779,7 @@ int apply_configuration_from_event(const cJSON* event) {
 // REAL-TIME EVENT HANDLER (called from main.c)
 // ================================

-// Handle kind 33334 configuration events received via WebSocket
+// Handle configuration events received via WebSocket
 int handle_configuration_event(cJSON* event, char* error_message, size_t error_size) {
    if (!event) {
        snprintf(error_message, error_size, "invalid: null configuration event");
@@ -2064,7 +2011,7 @@ int add_pubkeys_to_config_table(void) {
 // Forward declaration for admin authorization function from main.c
 extern int is_authorized_admin_event(cJSON* event);

-// Process admin events (updated for new Kind 23455/23456)
+// Process admin events (updated for Kind 23456)
 int process_admin_event_in_config(cJSON* event, char* error_message, size_t error_size, struct lws* wsi) {
    log_info("DEBUG: Entering process_admin_event_in_config()");
    
@@ -2115,18 +2062,9 @@ int process_admin_event_in_config(cJSON* event, char* error_message, size_t erro
    // Route to appropriate handler based on kind
    log_info("DEBUG: Routing to kind-specific handler");
    switch (kind) {
-        case 23455:  // New ephemeral configuration management
-            log_info("DEBUG: Routing to process_admin_config_event (kind 23455)");
-            return process_admin_config_event(event, error_message, error_size);
        case 23456:  // New ephemeral auth rules management
            log_info("DEBUG: Routing to process_admin_auth_event (kind 23456)");
            return process_admin_auth_event(event, error_message, error_size, wsi);
-        case 33334:  // Legacy addressable config events (backward compatibility)
-            log_info("DEBUG: Routing to process_admin_config_event (legacy kind 33334)");
-            return process_admin_config_event(event, error_message, error_size);
-        case 33335:  // Legacy addressable auth events (backward compatibility)
-            log_info("DEBUG: Routing to process_admin_auth_event (legacy kind 33335)");
-            return process_admin_auth_event(event, error_message, error_size, wsi);
        default:
            log_error("DEBUG: Unsupported admin event kind");
            printf("  Unsupported kind: %d\n", kind);
@@ -2135,7 +2073,7 @@ int process_admin_event_in_config(cJSON* event, char* error_message, size_t erro
    }
 }

-// Handle Kind 23455 configuration management events and legacy Kind 33334
+// Handle legacy Kind 33334 configuration management events
 int process_admin_config_event(cJSON* event, char* error_message, size_t error_size) {
    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
    int kind = kind_obj ? (int)cJSON_GetNumberValue(kind_obj) : 0;
@@ -2166,9 +2104,8 @@ int process_admin_config_event(cJSON* event, char* error_message, size_t error_s
            if (strcmp(tag_key, "config_query") == 0) {
                printf("  Config Query: %s\n", tag_val);
                
-                // For now, config queries are not implemented in the unified handler
-                // They would need to be added to handle_kind_23455_unified similar to auth queries
-                snprintf(error_message, error_size, "config queries not yet implemented in unified handler");
+                // Config queries are not implemented for legacy kind 33334
+                snprintf(error_message, error_size, "config queries not supported for legacy kind 33334");
                return -1;
            }
        }
@@ -2211,10 +2148,6 @@ int process_admin_config_event(cJSON* event, char* error_message, size_t error_s
            continue;
        }
        
-        // Skip relay identifier tag (only for legacy addressable events)
-        if (kind == 33334 && strcmp(key, "d") == 0) {
-            continue;
-        }
        
        // Update configuration in table
        if (update_config_in_table(key, value) == 0) {
@@ -2238,7 +2171,7 @@ int process_admin_config_event(cJSON* event, char* error_message, size_t error_s
    return 0;
 }

-// Handle Kind 23456 auth rules management and legacy Kind 33335
+// Handle Kind 23456 auth rules management
 int process_admin_auth_event(cJSON* event, char* error_message, size_t error_size, struct lws* wsi) {
    log_info("DEBUG: Entering process_admin_auth_event()");
    
@@ -2267,13 +2200,6 @@ int process_admin_auth_event(cJSON* event, char* error_message, size_t error_siz
        return handle_kind_23456_unified(event, error_message, error_size, wsi);
    }
    
-    // Legacy Kind 33335 events use the unified handler as well
-    if (kind == 33335) {
-        log_info("DEBUG: Routing legacy Kind 33335 to unified handler");
-        // For legacy events, we still use the unified handler but may need special processing
-        // The unified handler already supports all the functionality
-        return handle_kind_23456_unified(event, error_message, error_size, wsi);
-    }
    
    log_error("DEBUG: Unsupported auth event kind in process_admin_auth_event");
    printf("  Unsupported kind: %d\n", kind);
@@ -2626,6 +2552,38 @@ int send_admin_response_event(const cJSON* response_data, const char* recipient_
 // ================================


+// Map query command types to proper response types for frontend routing
+static const char* map_auth_query_type_to_response(const char* query_type) {
+    if (!query_type) return "auth_rules_unknown";
+    
+    if (strcmp(query_type, "all") == 0) {
+        return "auth_rules_all";
+    } else if (strcmp(query_type, "whitelist") == 0) {
+        return "auth_rules_whitelist";
+    } else if (strcmp(query_type, "blacklist") == 0) {
+        return "auth_rules_blacklist";
+    } else if (strcmp(query_type, "pattern") == 0) {
+        return "auth_rules_pattern";
+    } else {
+        return "auth_rules_unknown";
+    }
+}
+
+// Map config query command types to proper response types for frontend routing
+static const char* map_config_query_type_to_response(const char* query_type) {
+    if (!query_type) return "config_unknown";
+    
+    if (strcmp(query_type, "all") == 0) {
+        return "config_all";
+    } else if (strcmp(query_type, "category") == 0) {
+        return "config_category";
+    } else if (strcmp(query_type, "key") == 0) {
+        return "config_key";
+    } else {
+        return "config_unknown";
+    }
+}
+
 // Build standardized query response
 cJSON* build_query_response(const char* query_type, cJSON* results_array, int total_count) {
    if (!query_type || !results_array) return NULL;
@@ -2860,6 +2818,33 @@ int handle_kind_23456_unified(cJSON* event, char* error_message, size_t error_si
        printf("  Query type: %s\n", query_type);
        return handle_auth_query_unified(event, query_type, error_message, error_size, wsi);
    }
+    else if (strcmp(action_type, "config_query") == 0) {
+        log_info("DEBUG: Routing to config_query handler");
+        const char* query_type = get_tag_value(event, action_type, 1);
+        if (!query_type) {
+            log_error("DEBUG: Missing config_query type parameter");
+            snprintf(error_message, error_size, "invalid: missing config_query type");
+            return -1;
+        }
+        printf("  Query type: %s\n", query_type);
+        return handle_config_query_unified(event, query_type, error_message, error_size, wsi);
+    }
+    else if (strcmp(action_type, "config_set") == 0) {
+        log_info("DEBUG: Routing to config_set handler");
+        const char* config_key = get_tag_value(event, action_type, 1);
+        const char* config_value = get_tag_value(event, action_type, 2);
+        if (!config_key || !config_value) {
+            log_error("DEBUG: Missing config_set parameters");
+            snprintf(error_message, error_size, "invalid: missing config_set key or value");
+            return -1;
+        }
+        printf("  Key: %s, Value: %s\n", config_key, config_value);
+        return handle_config_set_unified(event, config_key, config_value, error_message, error_size, wsi);
+    }
+    else if (strcmp(action_type, "config_update") == 0) {
+        log_info("DEBUG: Routing to config_update handler");
+        return handle_config_update_unified(event, error_message, error_size, wsi);
+    }
    else if (strcmp(action_type, "system_command") == 0) {
        log_info("DEBUG: Routing to system_command handler");
        const char* command = get_tag_value(event, action_type, 1);
@@ -2974,8 +2959,9 @@ int handle_auth_query_unified(cJSON* event, const char* query_type, char* error_
    
    sqlite3_finalize(stmt);
    
-    // Build and send response
-    cJSON* response = build_query_response(query_type, results_array, rule_count);
+    // Build and send response with mapped query type for frontend routing
+    const char* mapped_query_type = map_auth_query_type_to_response(query_type);
+    cJSON* response = build_query_response(mapped_query_type, results_array, rule_count);
    if (response) {
        // Get admin pubkey from event for response
        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
@@ -2992,6 +2978,7 @@ int handle_auth_query_unified(cJSON* event, const char* query_type, char* error_
        if (send_admin_response_event(response, admin_pubkey, wsi) == 0) {
            printf("Total results: %d\n", rule_count);
            log_success("Auth query completed successfully with signed response");
+            printf("  Response query_type: %s (mapped from %s)\n", mapped_query_type, query_type);
            cJSON_Delete(response);
            cJSON_Delete(results_array);
            return 0;
@@ -3004,6 +2991,219 @@ int handle_auth_query_unified(cJSON* event, const char* query_type, char* error_
    return -1;
 }

+// Unified config query handler
+int handle_config_query_unified(cJSON* event, const char* query_type, char* error_message, size_t error_size, struct lws* wsi) {
+    // Suppress unused parameter warning
+    (void)wsi;
+    if (!g_db) {
+        snprintf(error_message, error_size, "database not available");
+        return -1;
+    }
+    
+    log_info("Processing unified config query");
+    printf("  Query type: %s\n", query_type);
+    
+    const char* sql = NULL;
+    int use_pattern_param = 0;
+    char* pattern_value = NULL;
+    
+    // Build appropriate SQL query based on query type
+    if (strcmp(query_type, "all") == 0) {
+        sql = "SELECT key, value, data_type, category, description FROM config ORDER BY category, key";
+    }
+    else if (strcmp(query_type, "category") == 0) {
+        // Get category value from tags
+        pattern_value = (char*)get_tag_value(event, "config_query", 2);
+        if (!pattern_value) {
+            snprintf(error_message, error_size, "invalid: category query requires category value");
+            return -1;
+        }
+        sql = "SELECT key, value, data_type, category, description FROM config WHERE category = ? ORDER BY key";
+        use_pattern_param = 1;
+    }
+    else if (strcmp(query_type, "key") == 0) {
+        // Get key value from tags
+        pattern_value = (char*)get_tag_value(event, "config_query", 2);
+        if (!pattern_value) {
+            snprintf(error_message, error_size, "invalid: key query requires key value");
+            return -1;
+        }
+        sql = "SELECT key, value, data_type, category, description FROM config WHERE key = ? ORDER BY key";
+        use_pattern_param = 1;
+    }
+    else {
+        snprintf(error_message, error_size, "invalid: unknown config query type '%s'", query_type);
+        return -1;
+    }
+    
+    // Execute query
+    sqlite3_stmt* stmt;
+    int rc = sqlite3_prepare_v2(g_db, sql, -1, &stmt, NULL);
+    if (rc != SQLITE_OK) {
+        snprintf(error_message, error_size, "failed to prepare config query");
+        return -1;
+    }
+    
+    if (use_pattern_param && pattern_value) {
+        sqlite3_bind_text(stmt, 1, pattern_value, -1, SQLITE_STATIC);
+    }
+    
+    // Build results array
+    cJSON* results_array = cJSON_CreateArray();
+    if (!results_array) {
+        sqlite3_finalize(stmt);
+        snprintf(error_message, error_size, "failed to create results array");
+        return -1;
+    }
+    
+    int config_count = 0;
+    printf("=== Config Query Results (%s) ===\n", query_type);
+    
+    while (sqlite3_step(stmt) == SQLITE_ROW) {
+        const char* key = (const char*)sqlite3_column_text(stmt, 0);
+        const char* value = (const char*)sqlite3_column_text(stmt, 1);
+        const char* data_type = (const char*)sqlite3_column_text(stmt, 2);
+        const char* category = (const char*)sqlite3_column_text(stmt, 3);
+        const char* description = (const char*)sqlite3_column_text(stmt, 4);
+        
+        printf("  %s = %s [%s] (%s)\n",
+               key ? key : "",
+               value ? value : "",
+               data_type ? data_type : "string",
+               category ? category : "general");
+        
+        // Add config item to results array
+        cJSON* config_obj = cJSON_CreateObject();
+        cJSON_AddStringToObject(config_obj, "key", key ? key : "");
+        cJSON_AddStringToObject(config_obj, "value", value ? value : "");
+        cJSON_AddStringToObject(config_obj, "data_type", data_type ? data_type : "string");
+        cJSON_AddStringToObject(config_obj, "category", category ? category : "general");
+        cJSON_AddStringToObject(config_obj, "description", description ? description : "");
+        cJSON_AddItemToArray(results_array, config_obj);
+        
+        config_count++;
+    }
+    
+    sqlite3_finalize(stmt);
+    
+    // Build and send response with mapped query type for frontend routing
+    const char* mapped_query_type = map_config_query_type_to_response(query_type);
+    cJSON* response = build_query_response(mapped_query_type, results_array, config_count);
+    if (response) {
+        // Get admin pubkey from event for response
+        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
+        
+        if (!admin_pubkey) {
+            cJSON_Delete(response);
+            cJSON_Delete(results_array);
+            snprintf(error_message, error_size, "missing admin pubkey for response");
+            return -1;
+        }
+        
+        // Send response as signed kind 23457 event
+        if (send_admin_response_event(response, admin_pubkey, wsi) == 0) {
+            printf("Total results: %d\n", config_count);
+            log_success("Config query completed successfully with signed response");
+            printf("  Response query_type: %s (mapped from %s)\n", mapped_query_type, query_type);
+            cJSON_Delete(response);
+            cJSON_Delete(results_array);
+            return 0;
+        }
+        cJSON_Delete(response);
+    }
+    
+    cJSON_Delete(results_array);
+    snprintf(error_message, error_size, "failed to send config query response");
+    return -1;
+}
+
+// Unified config set handler
+int handle_config_set_unified(cJSON* event, const char* config_key, const char* config_value, char* error_message, size_t error_size, struct lws* wsi) {
+    // Suppress unused parameter warning
+    (void)wsi;
+    if (!g_db) {
+        snprintf(error_message, error_size, "database not available");
+        return -1;
+    }
+    
+    log_info("Processing unified config set command");
+    printf("  Key: %s\n", config_key);
+    printf("  Value: %s\n", config_value);
+    
+    // Validate the configuration field before updating
+    char validation_error[512];
+    if (validate_config_field(config_key, config_value, validation_error, sizeof(validation_error)) != 0) {
+        log_error("Config field validation failed");
+        printf("  Validation error: %s\n", validation_error);
+        snprintf(error_message, error_size, "validation failed: %s", validation_error);
+        return -1;
+    }
+    
+    // Check if the config key exists in the table
+    const char* check_sql = "SELECT COUNT(*) FROM config WHERE key = ?";
+    sqlite3_stmt* check_stmt;
+    
+    int check_rc = sqlite3_prepare_v2(g_db, check_sql, -1, &check_stmt, NULL);
+    if (check_rc != SQLITE_OK) {
+        snprintf(error_message, error_size, "failed to prepare config existence check");
+        return -1;
+    }
+    
+    sqlite3_bind_text(check_stmt, 1, config_key, -1, SQLITE_STATIC);
+    
+    int config_exists = 0;
+    if (sqlite3_step(check_stmt) == SQLITE_ROW) {
+        config_exists = sqlite3_column_int(check_stmt, 0) > 0;
+    }
+    sqlite3_finalize(check_stmt);
+    
+    if (!config_exists) {
+        snprintf(error_message, error_size, "error: configuration key '%s' not found", config_key);
+        return -1;
+    }
+    
+    // Update the configuration value
+    if (update_config_in_table(config_key, config_value) != 0) {
+        snprintf(error_message, error_size, "failed to update configuration in database");
+        return -1;
+    }
+    
+    // Invalidate cache to ensure fresh reads
+    invalidate_config_cache();
+    
+    // Build response
+    cJSON* response = cJSON_CreateObject();
+    cJSON_AddStringToObject(response, "command", "config_set");
+    cJSON_AddStringToObject(response, "key", config_key);
+    cJSON_AddStringToObject(response, "value", config_value);
+    cJSON_AddStringToObject(response, "status", "success");
+    cJSON_AddNumberToObject(response, "timestamp", (double)time(NULL));
+    
+    printf("Updated config: %s = %s\n", config_key, config_value);
+    
+    // Get admin pubkey from event for response
+    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
+    
+    if (!admin_pubkey) {
+        cJSON_Delete(response);
+        snprintf(error_message, error_size, "missing admin pubkey for response");
+        return -1;
+    }
+    
+    // Send response as signed kind 23457 event
+    if (send_admin_response_event(response, admin_pubkey, wsi) == 0) {
+        log_success("Config set command completed successfully with signed response");
+        cJSON_Delete(response);
+        return 0;
+    }
+    
+    cJSON_Delete(response);
+    snprintf(error_message, error_size, "failed to send config set response");
+    return -1;
+}
+
 // Unified system command handler
 int handle_system_command_unified(cJSON* event, const char* command, char* error_message, size_t error_size, struct lws* wsi) {
    // Suppress unused parameter warning
@@ -3072,6 +3272,85 @@ int handle_system_command_unified(cJSON* event, const char* command, char* error
        snprintf(error_message, error_size, "failed to send clear auth rules response");
        return -1;
    }
+    else if (strcmp(command, "delete_auth_rule") == 0) {
+        // Get rule parameters from tags
+        const char* rule_type = get_tag_value(event, "system_command", 2);
+        const char* pattern_type = get_tag_value(event, "system_command", 3);
+        const char* pattern_value = get_tag_value(event, "system_command", 4);
+        
+        if (!rule_type || !pattern_type || !pattern_value) {
+            snprintf(error_message, error_size, "invalid: delete_auth_rule requires rule_type, pattern_type, and pattern_value");
+            return -1;
+        }
+        
+        log_info("Processing delete auth rule command");
+        printf("  Rule type: %s\n", rule_type);
+        printf("  Pattern type: %s\n", pattern_type);
+        printf("  Pattern value: %s\n", pattern_value);
+        
+        // Check if rule exists before deletion
+        const char* check_sql = "SELECT COUNT(*) FROM auth_rules WHERE rule_type = ? AND pattern_type = ? AND pattern_value = ?";
+        sqlite3_stmt* check_stmt;
+        
+        int check_rc = sqlite3_prepare_v2(g_db, check_sql, -1, &check_stmt, NULL);
+        if (check_rc != SQLITE_OK) {
+            snprintf(error_message, error_size, "failed to prepare rule existence check");
+            return -1;
+        }
+        
+        sqlite3_bind_text(check_stmt, 1, rule_type, -1, SQLITE_STATIC);
+        sqlite3_bind_text(check_stmt, 2, pattern_type, -1, SQLITE_STATIC);
+        sqlite3_bind_text(check_stmt, 3, pattern_value, -1, SQLITE_STATIC);
+        
+        int rule_exists = 0;
+        if (sqlite3_step(check_stmt) == SQLITE_ROW) {
+            rule_exists = sqlite3_column_int(check_stmt, 0) > 0;
+        }
+        sqlite3_finalize(check_stmt);
+        
+        if (!rule_exists) {
+            snprintf(error_message, error_size, "error: auth rule not found");
+            return -1;
+        }
+        
+        // Delete the specific auth rule
+        if (remove_auth_rule_from_config(rule_type, pattern_type, pattern_value) != 0) {
+            snprintf(error_message, error_size, "failed to delete auth rule from database");
+            return -1;
+        }
+        
+        // Build response
+        cJSON* response = cJSON_CreateObject();
+        cJSON_AddStringToObject(response, "command", "delete_auth_rule");
+        cJSON_AddStringToObject(response, "rule_type", rule_type);
+        cJSON_AddStringToObject(response, "pattern_type", pattern_type);
+        cJSON_AddStringToObject(response, "pattern_value", pattern_value);
+        cJSON_AddStringToObject(response, "status", "success");
+        cJSON_AddNumberToObject(response, "timestamp", (double)time(NULL));
+        
+        printf("Deleted auth rule: %s %s:%s\n", rule_type, pattern_type, pattern_value);
+        
+        // Get admin pubkey from event for response
+        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
+        
+        if (!admin_pubkey) {
+            cJSON_Delete(response);
+            snprintf(error_message, error_size, "missing admin pubkey for response");
+            return -1;
+        }
+        
+        // Send response as signed kind 23457 event
+        if (send_admin_response_event(response, admin_pubkey, wsi) == 0) {
+            log_success("Delete auth rule command completed successfully with signed response");
+            cJSON_Delete(response);
+            return 0;
+        }
+        
+        cJSON_Delete(response);
+        snprintf(error_message, error_size, "failed to send delete auth rule response");
+        return -1;
+    }
    else if (strcmp(command, "system_status") == 0) {
        // Build system status response
        cJSON* response = cJSON_CreateObject();
@@ -3253,6 +3532,340 @@ int handle_auth_rule_modification_unified(cJSON* event, char* error_message, siz
        return -1;
    }
 }
+// Unified config update handler - handles multiple config objects in single atomic command
+int handle_config_update_unified(cJSON* event, char* error_message, size_t error_size, struct lws* wsi) {
+    // Suppress unused parameter warning
+    (void)wsi;
+    if (!g_db) {
+        snprintf(error_message, error_size, "database not available");
+        return -1;
+    }
+    
+    log_info("Processing unified config update command");
+    
+    // Extract config objects array from synthetic tags created by NIP-44 decryption
+    // The decryption process creates synthetic tags like: ["config_update", [config_objects]]
+    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    if (!tags_obj || !cJSON_IsArray(tags_obj)) {
+        snprintf(error_message, error_size, "invalid: config update event must have tags");
+        return -1;
+    }
+    
+    // Find the config_update tag with config objects array
+    cJSON* config_objects_array = NULL;
+    cJSON* tag = NULL;
+    cJSON_ArrayForEach(tag, tags_obj) {
+        if (!cJSON_IsArray(tag) || cJSON_GetArraySize(tag) < 2) {
+            continue;
+        }
+        
+        cJSON* tag_name = cJSON_GetArrayItem(tag, 0);
+        if (!tag_name || !cJSON_IsString(tag_name)) {
+            continue;
+        }
+        
+        if (strcmp(cJSON_GetStringValue(tag_name), "config_update") == 0) {
+            // Found config_update tag, get the config objects array
+            cJSON* config_array_item = cJSON_GetArrayItem(tag, 1);
+            if (config_array_item) {
+                // The config objects should be in a JSON string format in the tag
+                if (cJSON_IsString(config_array_item)) {
+                    // Parse the JSON string to get the actual array
+                    const char* config_json = cJSON_GetStringValue(config_array_item);
+                    config_objects_array = cJSON_Parse(config_json);
+                } else if (cJSON_IsArray(config_array_item)) {
+                    // Direct array reference
+                    config_objects_array = cJSON_Duplicate(config_array_item, 1);
+                }
+            }
+            break;
+        }
+    }
+    
+    if (!config_objects_array || !cJSON_IsArray(config_objects_array)) {
+        snprintf(error_message, error_size, "invalid: config_update command requires config objects array");
+        return -1;
+    }
+    
+    int config_count = cJSON_GetArraySize(config_objects_array);
+    log_info("Config update command contains config objects");
+    printf("  Config objects count: %d\n", config_count);
+    
+    if (config_count == 0) {
+        cJSON_Delete(config_objects_array);
+        snprintf(error_message, error_size, "invalid: config_update command requires at least one config object");
+        return -1;
+    }
+    
+    // Begin transaction for atomic config updates
+    int rc = sqlite3_exec(g_db, "BEGIN IMMEDIATE TRANSACTION", NULL, NULL, NULL);
+    if (rc != SQLITE_OK) {
+        cJSON_Delete(config_objects_array);
+        snprintf(error_message, error_size, "failed to begin config update transaction");
+        return -1;
+    }
+    
+    int updates_applied = 0;
+    int validation_errors = 0;
+    char first_validation_error[512] = {0};  // Track first specific validation error
+    char first_error_field[128] = {0};       // Track which field failed first
+    cJSON* processed_configs = cJSON_CreateArray();
+    if (!processed_configs) {
+        sqlite3_exec(g_db, "ROLLBACK", NULL, NULL, NULL);
+        cJSON_Delete(config_objects_array);
+        snprintf(error_message, error_size, "failed to create response array");
+        return -1;
+    }
+    
+    // Process each config object in the array
+    cJSON* config_obj = NULL;
+    cJSON_ArrayForEach(config_obj, config_objects_array) {
+        if (!cJSON_IsObject(config_obj)) {
+            log_warning("Skipping non-object item in config objects array");
+            continue;
+        }
+        
+        // Extract required fields from config object
+        cJSON* key_obj = cJSON_GetObjectItem(config_obj, "key");
+        cJSON* value_obj = cJSON_GetObjectItem(config_obj, "value");
+        cJSON* data_type_obj = cJSON_GetObjectItem(config_obj, "data_type");
+        cJSON* category_obj = cJSON_GetObjectItem(config_obj, "category");
+        
+        if (!key_obj || !cJSON_IsString(key_obj) ||
+            !value_obj || !cJSON_IsString(value_obj)) {
+            log_error("Config object missing required key or value fields");
+            validation_errors++;
+            continue;
+        }
+        
+        const char* key = cJSON_GetStringValue(key_obj);
+        const char* value = cJSON_GetStringValue(value_obj);
+        const char* data_type = data_type_obj && cJSON_IsString(data_type_obj) ? 
+                               cJSON_GetStringValue(data_type_obj) : "string";
+        const char* category = category_obj && cJSON_IsString(category_obj) ? 
+                              cJSON_GetStringValue(category_obj) : "general";
+        
+        log_info("Processing config object");
+        printf("  Key: %s\n", key);
+        printf("  Value: %s\n", value);
+        printf("  Data type: %s\n", data_type);
+        printf("  Category: %s\n", category);
+        
+        // Validate the configuration field before updating
+        char validation_error[512];
+        if (validate_config_field(key, value, validation_error, sizeof(validation_error)) != 0) {
+            log_error("Config field validation failed");
+            printf("  Validation error: %s\n", validation_error);
+            validation_errors++;
+            
+            // Capture first validation error for enhanced error message
+            if (validation_errors == 1) {
+                strncpy(first_validation_error, validation_error, sizeof(first_validation_error) - 1);
+                first_validation_error[sizeof(first_validation_error) - 1] = '\0';
+                strncpy(first_error_field, key, sizeof(first_error_field) - 1);
+                first_error_field[sizeof(first_error_field) - 1] = '\0';
+            }
+            
+            // Add failed config to response array
+            cJSON* failed_config = cJSON_CreateObject();
+            cJSON_AddStringToObject(failed_config, "key", key);
+            cJSON_AddStringToObject(failed_config, "value", value);
+            cJSON_AddStringToObject(failed_config, "data_type", data_type);
+            cJSON_AddStringToObject(failed_config, "category", category);
+            cJSON_AddStringToObject(failed_config, "status", "validation_failed");
+            cJSON_AddStringToObject(failed_config, "error", validation_error);
+            cJSON_AddItemToArray(processed_configs, failed_config);
+            continue;
+        }
+        
+        // Check if the config key exists in the table
+        const char* check_sql = "SELECT COUNT(*) FROM config WHERE key = ?";
+        sqlite3_stmt* check_stmt;
+        
+        int check_rc = sqlite3_prepare_v2(g_db, check_sql, -1, &check_stmt, NULL);
+        if (check_rc != SQLITE_OK) {
+            log_error("Failed to prepare config existence check");
+            validation_errors++;
+            continue;
+        }
+        
+        sqlite3_bind_text(check_stmt, 1, key, -1, SQLITE_STATIC);
+        
+        int config_exists = 0;
+        if (sqlite3_step(check_stmt) == SQLITE_ROW) {
+            config_exists = sqlite3_column_int(check_stmt, 0) > 0;
+        }
+        sqlite3_finalize(check_stmt);
+        
+        if (!config_exists) {
+            log_error("Configuration key not found");
+            printf("  Key not found: %s\n", key);
+            validation_errors++;
+            
+            // Add failed config to response array
+            cJSON* failed_config = cJSON_CreateObject();
+            cJSON_AddStringToObject(failed_config, "key", key);
+            cJSON_AddStringToObject(failed_config, "value", value);
+            cJSON_AddStringToObject(failed_config, "data_type", data_type);
+            cJSON_AddStringToObject(failed_config, "category", category);
+            cJSON_AddStringToObject(failed_config, "status", "key_not_found");
+            cJSON_AddStringToObject(failed_config, "error", "configuration key not found in database");
+            cJSON_AddItemToArray(processed_configs, failed_config);
+            continue;
+        }
+        
+        // Update the configuration value in the table
+        if (update_config_in_table(key, value) == 0) {
+            updates_applied++;
+            
+            // Add successful config to response array
+            cJSON* success_config = cJSON_CreateObject();
+            cJSON_AddStringToObject(success_config, "key", key);
+            cJSON_AddStringToObject(success_config, "value", value);
+            cJSON_AddStringToObject(success_config, "data_type", data_type);
+            cJSON_AddStringToObject(success_config, "category", category);
+            cJSON_AddStringToObject(success_config, "status", "updated");
+            cJSON_AddItemToArray(processed_configs, success_config);
+            
+            log_success("Config field updated successfully");
+            printf("  Updated: %s = %s\n", key, value);
+        } else {
+            log_error("Failed to update config field in database");
+            printf("  Failed to update: %s = %s\n", key, value);
+            validation_errors++;
+            
+            // Add failed config to response array
+            cJSON* failed_config = cJSON_CreateObject();
+            cJSON_AddStringToObject(failed_config, "key", key);
+            cJSON_AddStringToObject(failed_config, "value", value);
+            cJSON_AddStringToObject(failed_config, "data_type", data_type);
+            cJSON_AddStringToObject(failed_config, "category", category);
+            cJSON_AddStringToObject(failed_config, "status", "database_error");
+            cJSON_AddStringToObject(failed_config, "error", "failed to update configuration in database");
+            cJSON_AddItemToArray(processed_configs, failed_config);
+        }
+    }
+    
+    // Clean up config objects array
+    cJSON_Delete(config_objects_array);
+    
+    // Determine transaction outcome
+    if (updates_applied > 0 && validation_errors == 0) {
+        // All updates successful
+        sqlite3_exec(g_db, "COMMIT", NULL, NULL, NULL);
+        invalidate_config_cache();
+        
+        char success_msg[256];
+        snprintf(success_msg, sizeof(success_msg), "Applied %d configuration updates successfully", updates_applied);
+        log_success(success_msg);
+    } else if (updates_applied > 0 && validation_errors > 0) {
+        // Partial success - rollback for atomic behavior
+        sqlite3_exec(g_db, "ROLLBACK", NULL, NULL, NULL);
+        
+        char error_msg[256];
+        snprintf(error_msg, sizeof(error_msg), "Config update failed: %d validation errors (atomic rollback)", validation_errors);
+        log_error(error_msg);
+        
+        // Build error response with validation details
+        cJSON* error_response = cJSON_CreateObject();
+        cJSON_AddStringToObject(error_response, "query_type", "config_update");
+        cJSON_AddStringToObject(error_response, "status", "error");
+        // Create enhanced error message with specific validation details
+        char enhanced_error_message[1024];
+        if (strlen(first_validation_error) > 0 && strlen(first_error_field) > 0) {
+            snprintf(enhanced_error_message, sizeof(enhanced_error_message),
+                    "field validation failed: %s - %s",
+                    first_error_field, first_validation_error);
+        } else {
+            snprintf(enhanced_error_message, sizeof(enhanced_error_message),
+                    "field validation failed: atomic rollback performed");
+        }
+        cJSON_AddStringToObject(error_response, "error", enhanced_error_message);
+        cJSON_AddNumberToObject(error_response, "validation_errors", validation_errors);
+        cJSON_AddNumberToObject(error_response, "timestamp", (double)time(NULL));
+        cJSON_AddItemToObject(error_response, "data", processed_configs);
+        
+        // Get admin pubkey from event for error response
+        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
+        
+        if (admin_pubkey) {
+            // Send error response as signed kind 23457 event
+            if (send_admin_response_event(error_response, admin_pubkey, wsi) == 0) {
+                log_info("Config update validation error response sent successfully");
+                cJSON_Delete(error_response);
+                return 0; // Return success after sending error response
+            }
+        }
+        
+        cJSON_Delete(error_response);
+        snprintf(error_message, error_size, "validation failed: %d errors, atomic rollback performed", validation_errors);
+        return -1;
+    } else {
+        // No updates applied
+        sqlite3_exec(g_db, "ROLLBACK", NULL, NULL, NULL);
+        
+        // Build error response for no valid updates
+        cJSON* error_response = cJSON_CreateObject();
+        cJSON_AddStringToObject(error_response, "query_type", "config_update");
+        cJSON_AddStringToObject(error_response, "status", "error");
+        cJSON_AddStringToObject(error_response, "error", "no valid configuration updates found");
+        cJSON_AddNumberToObject(error_response, "timestamp", (double)time(NULL));
+        cJSON_AddItemToObject(error_response, "data", processed_configs);
+        
+        // Get admin pubkey from event for error response
+        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
+        
+        if (admin_pubkey) {
+            // Send error response as signed kind 23457 event
+            if (send_admin_response_event(error_response, admin_pubkey, wsi) == 0) {
+                log_info("Config update 'no valid updates' error response sent successfully");
+                cJSON_Delete(error_response);
+                return 0; // Return success after sending error response
+            }
+        }
+        
+        cJSON_Delete(error_response);
+        snprintf(error_message, error_size, "no valid configuration updates found");
+        return -1;
+    }
+    
+    // Build response with query_type for frontend routing
+    cJSON* response = cJSON_CreateObject();
+    cJSON_AddStringToObject(response, "query_type", "config_update");
+    cJSON_AddStringToObject(response, "command", "config_update");
+    cJSON_AddNumberToObject(response, "configs_processed", updates_applied);
+    cJSON_AddNumberToObject(response, "total_configs", config_count);
+    cJSON_AddStringToObject(response, "status", "success");
+    cJSON_AddNumberToObject(response, "timestamp", (double)time(NULL));
+    cJSON_AddItemToObject(response, "processed_configs", processed_configs);
+    
+    printf("Config update completed: %d/%d configs updated successfully\n", updates_applied, config_count);
+    
+    // Get admin pubkey from event for response
+    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
+    
+    if (!admin_pubkey) {
+        cJSON_Delete(response);
+        snprintf(error_message, error_size, "missing admin pubkey for response");
+        return -1;
+    }
+    
+    // Send response as signed kind 23457 event
+    if (send_admin_response_event(response, admin_pubkey, wsi) == 0) {
+        log_success("Config update command completed successfully with signed response");
+        printf("  Response query_type: config_update\n");
+        cJSON_Delete(response);
+        return 0;
+    }
+    
+    cJSON_Delete(response);
+    snprintf(error_message, error_size, "failed to send config update response");
+    return -1;
+}
+



@@ -3633,14 +4246,14 @@ int process_startup_config_event_with_fallback(const cJSON* event) {
 // DYNAMIC EVENT GENERATION FROM CONFIG TABLE
 // ================================

-// Generate synthetic kind 33334 configuration event from current config table data
+// Generate synthetic configuration event from current config table data
 cJSON* generate_config_event_from_table(void) {
    if (!g_db) {
        log_error("Database not available for config event generation");
        return NULL;
    }
    
-    log_info("Generating synthetic kind 33334 event from config table...");
+    log_info("Generating synthetic configuration event from config table...");
    
    // Get relay pubkey for event generation
    const char* relay_pubkey = get_config_value("relay_pubkey");
@@ -3724,13 +4337,13 @@ cJSON* generate_config_event_from_table(void) {
    
    char success_msg[256];
    snprintf(success_msg, sizeof(success_msg),
-             "Generated synthetic kind 33334 event with %d configuration items", config_items_added);
+             "Generated synthetic configuration event with %d configuration items", config_items_added);
    log_success(success_msg);
    
    return event;
 }

-// Check if a REQ filter requests kind 33334 events
+// Check if a REQ filter requests configuration events
 int req_filter_requests_config_events(const cJSON* filter) {
    if (!filter || !cJSON_IsObject(filter)) {
        return 0;
@@ -3741,10 +4354,11 @@ int req_filter_requests_config_events(const cJSON* filter) {
        return 0;
    }
    
-    // Check if kinds array contains 33334
+    // Check if kinds array contains configuration event kinds
    cJSON* kind_item = NULL;
    cJSON_ArrayForEach(kind_item, kinds) {
-        if (cJSON_IsNumber(kind_item) && (int)cJSON_GetNumberValue(kind_item) == 33334) {
+        int kind_val = (int)cJSON_GetNumberValue(kind_item);
+        if (cJSON_IsNumber(kind_item) && kind_val == 33334) {
            return 1;
        }
    }
@@ -3758,7 +4372,7 @@ cJSON* generate_synthetic_config_event_for_subscription(const char* sub_id, cons
        return NULL;
    }
    
-    // Check if any filter requests kind 33334
+    // Check if any filter requests configuration events
    int requests_config = 0;
    
    if (cJSON_IsArray(filters)) {
@@ -3778,7 +4392,7 @@ cJSON* generate_synthetic_config_event_for_subscription(const char* sub_id, cons
        return NULL;
    }
    
-    log_info("Generating synthetic kind 33334 event for subscription");
+    log_info("Generating synthetic configuration event for subscription");
    
    // Generate synthetic config event from table
    cJSON* config_event = generate_config_event_from_table();
@@ -3793,12 +4407,12 @@ cJSON* generate_synthetic_config_event_for_subscription(const char* sub_id, cons
    cJSON_AddItemToArray(event_msg, cJSON_CreateString(sub_id));
    cJSON_AddItemToArray(event_msg, config_event);
    
-    log_success("Generated synthetic kind 33334 configuration event message");
+    log_success("Generated synthetic configuration event message");
    return event_msg;
 }

 /**
- * Generate a synthetic kind 33334 configuration event from config table data
+ * Generate a synthetic configuration event from config table data
 * This allows WebSocket clients to fetch configuration via REQ messages
 * Returns JSON string that must be freed by caller
 */
--- a/src/config.h
+++ b/src/config.h
@@ -98,6 +98,7 @@ typedef struct {
    int port_override;  // -1 = not set, >0 = port value
    char admin_privkey_override[65];  // Empty string = not set, 64-char hex = override
    char relay_privkey_override[65];  // Empty string = not set, 64-char hex = override
+    int strict_port;  // 0 = allow port increment, 1 = fail if exact port unavailable
 } cli_options_t;

 // Global unified configuration cache
--- a/src/default_config_event.h
+++ b/src/default_config_event.h
@@ -8,8 +8,7 @@
 * Default Configuration Event Template
 * 
 * This header contains the default configuration values for the C Nostr Relay.
- * These values are used to create the initial kind 33334 configuration event
- * during first-time startup.
+ * These values are used to populate the config table during first-time startup.
 * 
 * IMPORTANT: These values should never be accessed directly by other parts
 * of the program. They are only used during initial configuration event creation.
--- a/src/main.c
+++ b/src/main.c
@@ -224,10 +224,7 @@ int handle_event_message(cJSON* event, char* error_message, size_t error_size);
 // Forward declaration for unified validation
 int nostr_validate_unified_request(const char* json_string, size_t json_length);

-// Forward declaration for configuration event handling (kind 33334)
-int handle_configuration_event(cJSON* event, char* error_message, size_t error_size);
-
-// Forward declaration for admin event processing (kinds 33334 and 33335)
+// Forward declaration for admin event processing (kind 23456)
 int process_admin_event_in_config(cJSON* event, char* error_message, size_t error_size, struct lws* wsi);

 // Forward declaration for enhanced admin event authorization
@@ -3035,7 +3032,7 @@ int is_authorized_admin_event(cJSON* event, char* error_buffer, size_t error_buf
    }
    
    int event_kind = kind_json->valueint;
-    if (event_kind != 33334 && event_kind != 33335 && event_kind != 23455 && event_kind != 23456) {
+    if (event_kind != 23456) {
        snprintf(error_buffer, error_buffer_size, "Event kind %d is not an admin event type", event_kind);
        return -1;
    }
@@ -3356,7 +3353,7 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                    // Cleanup event JSON string
                                    free(event_json_str);
                                    
-                                    // Check for admin events (kinds 33334, 33335, 23455, and 23456) and intercept them
+                                    // Check for admin events (kind 23456) and intercept them
                                    if (result == 0) {
                                        cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
                                        if (kind_obj && cJSON_IsNumber(kind_obj)) {
@@ -3364,8 +3361,8 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                            
                                            log_info("DEBUG ADMIN: Checking if admin event processing is needed");
                                            
-                                            // Log reception of Kind 23455 and 23456 events
-                                            if (event_kind == 23455 || event_kind == 23456) {
+                                            // Log reception of Kind 23456 events
+                                            if (event_kind == 23456) {
                                                char* event_json_debug = cJSON_Print(event);
                                                char debug_received_msg[1024];
                                                snprintf(debug_received_msg, sizeof(debug_received_msg),
@@ -3378,7 +3375,7 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                                }
                                            }
                                            
-                                            if (event_kind == 33334 || event_kind == 33335 || event_kind == 23455 || event_kind == 23456) {
+                                            if (event_kind == 23456) {
                                                // Enhanced admin event security - check authorization first
                                                log_info("DEBUG ADMIN: Admin event detected, checking authorization");
                                                
@@ -3410,8 +3407,8 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                                            "DEBUG ADMIN: process_admin_event_in_config returned %d", admin_result);
                                                    log_info(debug_admin_msg);
                                                    
-                                                    // Log results for Kind 23455 and 23456 events
-                                                    if (event_kind == 23455 || event_kind == 23456) {
+                                                    // Log results for Kind 23456 events
+                                                    if (event_kind == 23456) {
                                                        if (admin_result == 0) {
                                                            char success_result_msg[256];
                                                            snprintf(success_result_msg, sizeof(success_result_msg),
@@ -3673,6 +3670,7 @@ int check_port_available(int port) {
    int sockfd;
    struct sockaddr_in addr;
    int result;
+    int reuse = 1;

    // Create a socket
    sockfd = socket(AF_INET, SOCK_STREAM, 0);
@@ -3680,6 +3678,13 @@ int check_port_available(int port) {
        return 0; // Cannot create socket, assume port unavailable
    }

+    // Set SO_REUSEADDR to allow binding to ports in TIME_WAIT state
+    // This matches libwebsockets behavior and prevents false unavailability
+    if (setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &reuse, sizeof(reuse)) < 0) {
+        close(sockfd);
+        return 0; // Failed to set socket option
+    }
+
    // Set up the address structure
    memset(&addr, 0, sizeof(addr));
    addr.sin_family = AF_INET;
@@ -3697,7 +3702,7 @@ int check_port_available(int port) {
 }

 // Start libwebsockets-based WebSocket Nostr relay server
-int start_websocket_relay(int port_override) {
+int start_websocket_relay(int port_override, int strict_port) {
    struct lws_context_creation_info info;

    log_info("Starting libwebsockets-based Nostr relay server...");
@@ -3707,7 +3712,7 @@ int start_websocket_relay(int port_override) {
    int configured_port = (port_override > 0) ? port_override : get_config_int("relay_port", DEFAULT_PORT);
    int actual_port = configured_port;
    int port_attempts = 0;
-    const int max_port_attempts = 5;
+    const int max_port_attempts = 10;  // Increased from 5 to 10

    // Minimal libwebsockets configuration
    info.protocols = protocols;
@@ -3726,8 +3731,8 @@ int start_websocket_relay(int port_override) {
    // Max payload size for Nostr events
    info.max_http_header_data = 4096;

-    // Find an available port with pre-checking
-    while (port_attempts < max_port_attempts) {
+    // Find an available port with pre-checking (or fail immediately in strict mode)
+    while (port_attempts < (strict_port ? 1 : max_port_attempts)) {
        char attempt_msg[256];
        snprintf(attempt_msg, sizeof(attempt_msg), "Checking port availability: %d", actual_port);
        log_info(attempt_msg);
@@ -3735,7 +3740,13 @@ int start_websocket_relay(int port_override) {
        // Pre-check if port is available
        if (!check_port_available(actual_port)) {
            port_attempts++;
-            if (port_attempts < max_port_attempts) {
+            if (strict_port) {
+                char error_msg[256];
+                snprintf(error_msg, sizeof(error_msg),
+                         "Strict port mode: port %d is not available", actual_port);
+                log_error(error_msg);
+                return -1;
+            } else if (port_attempts < max_port_attempts) {
                char retry_msg[256];
                snprintf(retry_msg, sizeof(retry_msg), "Port %d is in use, trying port %d (attempt %d/%d)",
                         actual_port, actual_port + 1, port_attempts + 1, max_port_attempts);
@@ -3774,7 +3785,13 @@ int start_websocket_relay(int port_override) {
        log_warning(lws_error_msg);
        
        port_attempts++;
-        if (port_attempts < max_port_attempts) {
+        if (strict_port) {
+            char error_msg[256];
+            snprintf(error_msg, sizeof(error_msg),
+                     "Strict port mode: failed to bind to port %d", actual_port);
+            log_error(error_msg);
+            break;
+        } else if (port_attempts < max_port_attempts) {
            actual_port++;
            continue;
        }
@@ -3840,6 +3857,7 @@ void print_usage(const char* program_name) {
    printf("  -p, --port PORT          Override relay port (first-time startup only)\n");
    printf("  -a, --admin-privkey HEX  Override admin private key (64-char hex)\n");
    printf("  -r, --relay-privkey HEX  Override relay private key (64-char hex)\n");
+    printf("  --strict-port            Fail if exact port is unavailable (no port increment)\n");
    printf("\n");
    printf("Configuration:\n");
    printf("  This relay uses event-based configuration stored in the database.\n");
@@ -3848,10 +3866,16 @@ void print_usage(const char* program_name) {
    printf("  After initial setup, all configuration is managed via database events.\n");
    printf("  Database file: <relay_pubkey>.db (created automatically)\n");
    printf("\n");
+    printf("Port Binding:\n");
+    printf("  Default: Try up to 10 consecutive ports if requested port is busy\n");
+    printf("  --strict-port: Fail immediately if exact requested port is unavailable\n");
+    printf("\n");
    printf("Examples:\n");
    printf("  %s                       # Start relay (auto-configure on first run)\n", program_name);
    printf("  %s -p 8080              # First-time setup with port 8080\n", program_name);
    printf("  %s --port 9000          # First-time setup with port 9000\n", program_name);
+    printf("  %s --strict-port        # Fail if default port 8888 is unavailable\n", program_name);
+    printf("  %s -p 8080 --strict-port # Fail if port 8080 is unavailable\n", program_name);
    printf("  %s --help               # Show this help\n", program_name);
    printf("  %s --version            # Show version info\n", program_name);
    printf("\n");
@@ -3870,7 +3894,8 @@ int main(int argc, char* argv[]) {
    cli_options_t cli_options = {
        .port_override = -1,  // -1 = not set
        .admin_privkey_override = {0},  // Empty string = not set
-        .relay_privkey_override = {0}   // Empty string = not set
+        .relay_privkey_override = {0},   // Empty string = not set
+        .strict_port = 0  // 0 = allow port increment (default)
    };
    
    // Parse command line arguments
@@ -3965,6 +3990,10 @@ int main(int argc, char* argv[]) {
            i++; // Skip the key argument
            
            log_info("Relay private key override specified");
+        } else if (strcmp(argv[i], "--strict-port") == 0) {
+            // Strict port mode option
+            cli_options.strict_port = 1;
+            log_info("Strict port mode enabled - will fail if exact port is unavailable");
        } else {
            log_error("Unknown argument. Use --help for usage information.");
            print_usage(argv[0]);
@@ -4186,7 +4215,7 @@ int main(int argc, char* argv[]) {
    log_info("Starting relay server...");
    
    // Start WebSocket Nostr relay server (port from configuration)
-    int result = start_websocket_relay(-1);  // Let config system determine port
+    int result = start_websocket_relay(-1, cli_options.strict_port);  // Let config system determine port, pass strict_port flag
    
    // Cleanup
    cleanup_relay_info();
--- a/src/sql_schema.h
+++ b/src/sql_schema.h
@@ -12,7 +12,7 @@
 static const char* const EMBEDDED_SCHEMA_SQL = 
 "-- C Nostr Relay Database Schema\n\
 -- SQLite schema for storing Nostr events with JSON tags support\n\
-- Event-based configuration system using kind 33334 Nostr events\n\
+-- Configuration system using config table\n\
 \n\
 -- Schema version tracking\n\
 PRAGMA user_version = 7;\n\
Author	SHA1	Message	Date
Your Name	eefb0e427e	v0.3.18 - index.html improvements	2025-09-30 07:51:23 -04:00
Your Name	c23d81b740	v0.3.17 - Embedded login button	2025-09-30 06:47:09 -04:00
Your Name	6dac231040	v0.3.16 - Admin system getting better	2025-09-30 05:32:23 -04:00
Your Name	6fd3e531c3	v0.3.15 - How can administration take so long	2025-09-27 15:50:42 -04:00
@@ -1 +1 @@
 
 1371445