v0.3.14 - I think the admin api is finally working

v0.3.13 - Working on admin system
v0.3.12 - Working through auth still
2025-09-27 14:08:45 -04:00 · 2025-09-27 13:32:21 -04:00 · 2025-09-25 17:33:38 -04:00 · 2025-09-25 16:35:16 -04:00 · 2025-09-25 11:25:50 -04:00 · 2025-09-24 10:49:48 -04:00
14 changed files with 11739 additions and 1811 deletions
--- a/IMPLEMENT_API.md
+++ b/IMPLEMENT_API.md
@@ -0,0 +1,513 @@
+# Implementation Plan: Enhanced Admin Event API Structure
+
+## Current Issue
+
+The current admin event routing at [`main.c:3248-3268`](src/main.c:3248) has a security vulnerability:
+
+```c
+if (event_kind == 23455 || event_kind == 23456) {
+    // Admin event processing
+    int admin_result = process_admin_event_in_config(event, admin_error, sizeof(admin_error), wsi);
+} else {
+    // Regular event storage and broadcasting
+}
+```
+
+**Problem**: Any event with these kinds gets routed to admin processing, regardless of authorization. This allows unauthorized users to send admin events that could be processed as legitimate admin commands.
+
+**Note**: Event kinds 33334 and 33335 are no longer used and have been removed from the admin event routing.
+
+## Required Security Enhancement
+
+Admin events must be validated for proper authorization BEFORE routing to admin processing:
+
+1. **Relay Public Key Check**: Event must have a `p` tag equal to the relay's public key
+2. **Admin Signature Check**: Event must be signed by an authorized admin private key
+3. **Fallback to Regular Processing**: If authorization fails, treat as regular event (not admin event)
+
+## Implementation Plan
+
+### Phase 1: Add Admin Authorization Validation
+
+#### 1.1 Create Consolidated Admin Authorization Function
+**Location**: [`src/main.c`](src/main.c) or [`src/config.c`](src/config.c)
+
+```c
+/**
+ * Consolidated admin event authorization validator
+ * Implements defense-in-depth security for admin events
+ *
+ * @param event - The event to validate for admin authorization
+ * @param error_message - Buffer for detailed error messages
+ * @param error_size - Size of error message buffer
+ * @return 0 if authorized, -1 if unauthorized, -2 if validation error
+ */
+int is_authorized_admin_event(cJSON* event, char* error_message, size_t error_size) {
+    if (!event) {
+        snprintf(error_message, error_size, "admin_auth: null event");
+        return -2;
+    }
+    
+    // Extract event components
+    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    
+    if (!kind_obj || !pubkey_obj || !tags_obj) {
+        snprintf(error_message, error_size, "admin_auth: missing required fields");
+        return -2;
+    }
+    
+    // Validation Layer 1: Kind Check
+    int event_kind = (int)cJSON_GetNumberValue(kind_obj);
+    if (event_kind != 23455 && event_kind != 23456) {
+        snprintf(error_message, error_size, "admin_auth: not an admin event kind");
+        return -1;
+    }
+    
+    // Validation Layer 2: Relay Targeting Check
+    const char* relay_pubkey = get_config_value("relay_pubkey");
+    if (!relay_pubkey) {
+        snprintf(error_message, error_size, "admin_auth: relay pubkey not configured");
+        return -2;
+    }
+    
+    // Check for 'p' tag targeting this relay
+    int has_relay_target = 0;
+    if (cJSON_IsArray(tags_obj)) {
+        cJSON* tag = NULL;
+        cJSON_ArrayForEach(tag, tags_obj) {
+            if (cJSON_IsArray(tag) && cJSON_GetArraySize(tag) >= 2) {
+                cJSON* tag_name = cJSON_GetArrayItem(tag, 0);
+                cJSON* tag_value = cJSON_GetArrayItem(tag, 1);
+                
+                if (cJSON_IsString(tag_name) && cJSON_IsString(tag_value)) {
+                    const char* name = cJSON_GetStringValue(tag_name);
+                    const char* value = cJSON_GetStringValue(tag_value);
+                    
+                    if (strcmp(name, "p") == 0 && strcmp(value, relay_pubkey) == 0) {
+                        has_relay_target = 1;
+                        break;
+                    }
+                }
+            }
+        }
+    }
+    
+    if (!has_relay_target) {
+        // Admin event for different relay - not unauthorized, just not for us
+        snprintf(error_message, error_size, "admin_auth: admin event for different relay");
+        return -1;
+    }
+    
+    // Validation Layer 3: Admin Signature Check (only if targeting this relay)
+    const char* event_pubkey = cJSON_GetStringValue(pubkey_obj);
+    if (!event_pubkey) {
+        snprintf(error_message, error_size, "admin_auth: invalid pubkey format");
+        return -2;
+    }
+    
+    const char* admin_pubkey = get_config_value("admin_pubkey");
+    if (!admin_pubkey || strcmp(event_pubkey, admin_pubkey) != 0) {
+        // This is the ONLY case where we log as "Unauthorized admin event attempt"
+        // because it's targeting THIS relay but from wrong admin
+        snprintf(error_message, error_size, "admin_auth: unauthorized admin for this relay");
+        log_warning("SECURITY: Unauthorized admin event attempt for this relay");
+        return -1;
+    }
+    
+    // All validation layers passed
+    log_info("ADMIN: Admin event authorized");
+    return 0;
+}
+
+```
+
+#### 1.2 Update Event Routing Logic
+**Location**: [`main.c:3248`](src/main.c:3248)
+
+```c
+// Current problematic code:
+if (event_kind == 23455 || event_kind == 23456) {
+    // Admin event processing
+    int admin_result = process_admin_event_in_config(event, admin_error, sizeof(admin_error), wsi);
+} else {
+    // Regular event storage and broadcasting
+}
+
+// Enhanced secure code with consolidated authorization:
+if (result == 0) {
+    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+    if (kind_obj && cJSON_IsNumber(kind_obj)) {
+        int event_kind = (int)cJSON_GetNumberValue(kind_obj);
+        
+        // Check if this is an admin event
+        if (event_kind == 23455 || event_kind == 23456) {
+            // Use consolidated authorization check
+            char auth_error[512] = {0};
+            int auth_result = is_authorized_admin_event(event, auth_error, sizeof(auth_error));
+            
+            if (auth_result == 0) {
+                // Authorized admin event - process through admin API
+                char admin_error[512] = {0};
+                int admin_result = process_admin_event_in_config(event, admin_error, sizeof(admin_error), wsi);
+                
+                if (admin_result != 0) {
+                    result = -1;
+                    strncpy(error_message, admin_error, sizeof(error_message) - 1);
+                }
+                // Admin events are NOT broadcast to subscriptions
+            } else {
+                // Unauthorized admin event - treat as regular event
+                log_warning("Unauthorized admin event treated as regular event");
+                if (store_event(event) != 0) {
+                    result = -1;
+                    strncpy(error_message, "error: failed to store event", sizeof(error_message) - 1);
+                } else {
+                    broadcast_event_to_subscriptions(event);
+                }
+            }
+        } else {
+            // Regular event - normal processing
+            if (store_event(event) != 0) {
+                result = -1;
+                strncpy(error_message, "error: failed to store event", sizeof(error_message) - 1);
+            } else {
+                broadcast_event_to_subscriptions(event);
+            }
+        }
+    }
+}
+```
+
+### Phase 2: Enhanced Admin Event Processing
+
+#### 2.1 Admin Event Validation in Config System
+**Location**: [`src/config.c`](src/config.c) - [`process_admin_event_in_config()`](src/config.c:2065)
+
+Add additional validation within the admin processing function:
+
+```c
+int process_admin_event_in_config(cJSON* event, char* error_buffer, size_t error_buffer_size, struct lws* wsi) {
+    // Double-check authorization (defense in depth)
+    if (!is_authorized_admin_event(event)) {
+        snprintf(error_buffer, error_buffer_size, "unauthorized: not a valid admin event");
+        return -1;
+    }
+    
+    // Continue with existing admin event processing...
+    // ... rest of function unchanged
+}
+```
+
+#### 2.2 Logging and Monitoring
+Add comprehensive logging for admin event attempts:
+
+```c
+// In the routing logic - enhanced logging
+cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+int event_kind = kind_obj ? cJSON_GetNumberValue(kind_obj) : -1;
+const char* event_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : "unknown";
+
+if (is_authorized_admin_event(event)) {
+    char log_msg[256];
+    snprintf(log_msg, sizeof(log_msg),
+            "ADMIN EVENT: Authorized admin event (kind=%d) from pubkey=%.16s...",
+            event_kind, event_pubkey);
+    log_info(log_msg);
+} else if (event_kind == 23455 || event_kind == 23456) {
+    // This catches unauthorized admin event attempts
+    char log_msg[256];
+    snprintf(log_msg, sizeof(log_msg),
+            "SECURITY: Unauthorized admin event attempt (kind=%d) from pubkey=%.16s...",
+            event_kind, event_pubkey);
+    log_warning(log_msg);
+}
+```
+
+## Phase 3: Unified Output Flow Architecture
+
+### 3.1 Current Output Flow Analysis
+
+After analyzing both [`main.c`](src/main.c) and [`config.c`](src/config.c), the **admin event responses already flow through the standard WebSocket output pipeline**. This is the correct architecture and requires no changes.
+
+#### Standard WebSocket Output Pipeline
+
+**Regular Events** ([`main.c:2978-2996`](src/main.c:2978)):
+```c
+// Database query responses
+unsigned char* buf = malloc(LWS_PRE + msg_len);
+memcpy(buf + LWS_PRE, msg_str, msg_len);
+lws_write(wsi, buf + LWS_PRE, msg_len, LWS_WRITE_TEXT);
+free(buf);
+```
+
+**OK Responses** ([`main.c:3342-3375`](src/main.c:3342)):
+```c
+// Event processing results: ["OK", event_id, success_boolean, message]
+unsigned char *buf = malloc(LWS_PRE + response_len);
+memcpy(buf + LWS_PRE, response_str, response_len);
+lws_write(wsi, buf + LWS_PRE, response_len, LWS_WRITE_TEXT);
+free(buf);
+```
+
+#### Admin Event Output Pipeline (Already Unified)
+
+**Admin Responses** ([`config.c:2363-2414`](src/config.c:2363)):
+```c
+// Admin query responses use IDENTICAL pattern
+int send_websocket_response_data(struct lws* wsi, cJSON* response_data) {
+    unsigned char* buf = malloc(LWS_PRE + response_len);
+    memcpy(buf + LWS_PRE, response_str, response_len);
+    
+    // Same lws_write() call as regular events
+    int result = lws_write(wsi, buf + LWS_PRE, response_len, LWS_WRITE_TEXT);
+    
+    free(buf);
+    return result;
+}
+```
+
+### 3.2 Unified Output Flow Confirmation
+
+✅ **Admin responses already use the same WebSocket transmission mechanism as regular events**
+
+✅ **Both admin and regular events use identical buffer allocation patterns**
+
+✅ **Both admin and regular events use the same [`lws_write()`](src/config.c:2393) function**
+
+✅ **Both admin and regular events follow the same cleanup patterns**
+
+### 3.3 Output Flow Integration Points
+
+The admin event processing in [`config.c:2436`](src/config.c:2436) already integrates correctly with the unified output system:
+
+1. **Admin Query Processing** ([`config.c:2568-2583`](src/config.c:2568)):
+   - Auth queries return structured JSON via [`send_websocket_response_data()`](src/config.c:2571)
+   - System commands return status data via [`send_websocket_response_data()`](src/config.c:2631)
+
+2. **Response Format Consistency**:
+   - Admin responses use standard JSON format
+   - Regular events use standard Nostr event format
+   - Both transmitted through same WebSocket pipeline
+
+3. **Error Handling Consistency**:
+   - Admin errors returned via same WebSocket connection
+   - Regular event errors returned via OK messages
+   - Both use identical transmission mechanism
+
+### 3.4 Key Architectural Benefits
+
+**No Changes Required**: The output flow is already unified and correctly implemented.
+
+**Security Separation**: Admin events are processed separately but responses flow through the same secure WebSocket channel.
+
+**Performance Consistency**: Both admin and regular responses use the same optimized transmission path.
+
+**Maintenance Simplicity**: Single WebSocket output pipeline reduces complexity and potential bugs.
+
+### 3.5 Admin Event Flow Summary
+
+```
+Admin Event Input → Authorization Check → Admin Processing → Unified WebSocket Output
+Regular Event Input → Validation → Storage + Broadcast → Unified WebSocket Output
+```
+
+Both flows converge at the **Unified WebSocket Output** stage, which is already correctly implemented.
+
+## Phase 4: Integration Points for Secure Admin Event Routing
+
+### 4.1 Configuration System Integration
+
+**Required Configuration Values**:
+- `admin_pubkey` - Public key of authorized administrator
+- `relay_pubkey` - Public key of this relay instance
+
+**Integration Points**:
+1. [`get_config_value()`](src/config.c) - Used by authorization function
+2. [`get_relay_pubkey_cached()`](src/config.c) - Used for relay targeting validation
+3. Configuration loading during startup - Must ensure admin/relay pubkeys are available
+
+### 4.3 Forward Declarations Required
+
+**Location**: [`src/main.c`](src/main.c) - Add near other forward declarations (around line 230)
+
+```c
+// Forward declarations for enhanced admin event authorization
+int is_authorized_admin_event(cJSON* event, char* error_message, size_t error_size);
+```
+
+### 4.4 Error Handling Integration
+
+**Enhanced Error Response System**:
+
+```c
+// In main.c event processing - enhanced error handling for admin events
+if (auth_result != 0) {
+    // Admin authorization failed - send detailed OK response
+    cJSON* event_id = cJSON_GetObjectItem(event, "id");
+    if (event_id && cJSON_IsString(event_id)) {
+        cJSON* response = cJSON_CreateArray();
+        cJSON_AddItemToArray(response, cJSON_CreateString("OK"));
+        cJSON_AddItemToArray(response, cJSON_CreateString(cJSON_GetStringValue(event_id)));
+        cJSON_AddItemToArray(response, cJSON_CreateBool(0)); // Failed
+        cJSON_AddItemToArray(response, cJSON_CreateString(auth_error));
+        
+        // Send via standard WebSocket output pipeline
+        char *response_str = cJSON_Print(response);
+        if (response_str) {
+            size_t response_len = strlen(response_str);
+            unsigned char *buf = malloc(LWS_PRE + response_len);
+            if (buf) {
+                memcpy(buf + LWS_PRE, response_str, response_len);
+                lws_write(wsi, buf + LWS_PRE, response_len, LWS_WRITE_TEXT);
+                free(buf);
+            }
+            free(response_str);
+        }
+        cJSON_Delete(response);
+    }
+}
+```
+
+### 4.5 Logging Integration Points
+
+**Console Logging**: Uses existing [`log_warning()`](src/main.c:993), [`log_info()`](src/main.c:972) functions
+
+**Security Event Categories**:
+- Admin authorization success logged via `log_info()`
+- Admin authorization failures logged via `log_warning()`
+- Admin event processing logged via existing admin logging
+
+## Phase 5: Detailed Function Specifications
+
+### 5.1 Core Authorization Function
+
+**Function**: `is_authorized_admin_event()`
+**Location**: [`src/main.c`](src/main.c) or [`src/config.c`](src/config.c)
+**Dependencies**:
+- `get_config_value()` for admin/relay pubkeys
+- `log_warning()` and `log_info()` for logging
+- `cJSON` library for event parsing
+
+**Return Values**:
+- `0` - Event is authorized for admin processing
+- `-1` - Event is unauthorized (treat as regular event)
+- `-2` - Validation error (malformed event)
+
+**Error Handling**: Detailed error messages in provided buffer for client feedback
+
+### 5.2 Enhanced Event Routing
+
+**Location**: [`main.c:3248-3340`](src/main.c:3248)
+**Integration**: Replaces existing admin event routing logic
+**Dependencies**:
+- `is_authorized_admin_event()` for authorization
+- `process_admin_event_in_config()` for admin processing
+- `store_event()` and `broadcast_event_to_subscriptions()` for regular events
+
+**Security Features**:
+- Graceful degradation for unauthorized admin events
+- Comprehensive logging of authorization attempts
+- No broadcast of admin events to subscriptions
+- Detailed error responses for failed authorization
+
+### 5.4 Defense-in-Depth Validation
+
+**Primary Validation**: In main event routing logic
+**Secondary Validation**: In `process_admin_event_in_config()` function
+**Tertiary Validation**: In individual admin command handlers
+
+**Validation Layers**:
+1. **Kind Check** - Must be admin event kind (23455/23456)
+2. **Relay Targeting Check** - Must have 'p' tag with this relay's pubkey
+3. **Admin Signature Check** - Must be signed by authorized admin (only if targeting this relay)
+4. **Processing Check** - Additional validation in admin handlers
+
+**Security Logic**:
+- If no 'p' tag for this relay → Admin event for different relay (not unauthorized)
+- If 'p' tag for this relay + wrong admin signature → "Unauthorized admin event attempt"
+
+## Phase 6: Event Flow Documentation
+
+### 6.1 Complete Event Processing Flow
+
+```
+┌─────────────────┐
+│ WebSocket Input │
+└─────────┬───────┘
+          │
+          ▼
+┌─────────────────┐
+│ Unified         │
+│ Validation      │ ← nostr_validate_unified_request()
+└─────────┬───────┘
+          │
+          ▼
+┌─────────────────┐
+│ Kind-Based      │
+│ Routing Check   │ ← Check if kind 23455/23456
+└─────────┬───────┘
+          │
+     ┌────▼────┐
+     │ Admin?  │
+     └────┬────┘
+          │
+    ┌─────▼─────┐         ┌─────────────┐
+    │ YES       │         │ NO          │
+    │           │         │             │
+    ▼           │         ▼             │
+┌─────────────┐ │    ┌─────────────┐    │
+│ Admin       │ │    │ Regular     │    │
+│ Authorization│ │    │ Event       │    │
+│ Check       │ │    │ Processing  │    │
+└─────┬───────┘ │    └─────┬───────┘    │
+      │         │          │            │
+ ┌────▼────┐    │          ▼            │
+ │Authorized?│   │    ┌─────────────┐    │
+ └────┬────┘    │    │ store_event()│    │
+      │         │    │ +           │    │
+┌─────▼─────┐   │    │ broadcast() │    │
+│ YES   NO  │   │    └─────┬───────┘    │
+│  │     │  │   │          │            │
+│  ▼     ▼  │   │          ▼            │
+│┌─────┐┌───┴┐  │    ┌─────────────┐    │
+││Admin││Treat│  │    │ WebSocket   │    │
+││API  ││as   │  │    │ OK Response │    │
+││     ││Reg  │  │    └─────────────┘    │
+│└──┬──┘└───┬┘  │                       │
+│   │      │   │                       │
+│   ▼      │   │                       │
+│┌─────────┐│   │                       │
+││WebSocket││   │                       │
+││Response ││   │                       │
+│└─────────┘│   │                       │
+└───────────┴───┘                       │
+            │                           │
+            └───────────────────────────┘
+                        │
+                        ▼
+                ┌─────────────┐
+                │ Unified     │
+                │ WebSocket   │
+                │ Output      │
+                └─────────────┘
+```
+
+### 6.2 Security Decision Points
+
+1. **Event Kind Check** - Identifies potential admin events
+2. **Authorization Validation** - Three-layer security check
+3. **Routing Decision** - Admin API vs Regular processing
+4. **Response Generation** - Unified output pipeline
+5. **Audit Logging** - Security event tracking
+
+### 6.3 Error Handling Paths
+
+**Validation Errors**: Return detailed error messages via OK response
+**Authorization Failures**: Log security event + treat as regular event
+**Processing Errors**: Return admin-specific error responses
+**System Errors**: Fallback to standard error handling
+
+This completes the comprehensive implementation plan for the enhanced admin event API structure with unified output flow architecture.
--- a/README.md
+++ b/README.md
@@ -22,4 +22,150 @@ Do NOT modify the formatting, add emojis, or change the text. Keep the simple fo
 - [ ] NIP-50: Keywords filter
 - [ ] NIP-70: Protected Events

+## 🔧 Administrator API
+
+C-Relay uses an innovative **event-based administration system** where all configuration and management commands are sent as signed Nostr events using the admin private key generated during first startup. All admin commands use **tag-based parameters** for simplicity and compatibility.
+
+### Authentication
+
+All admin commands require signing with the admin private key displayed during first-time startup. **Save this key securely** - it cannot be recovered and is needed for all administrative operations.
+
+### Event Structure
+
+All admin commands use the same unified event structure with tag-based parameters:
+
+**Admin Command Event:**
+```json
+{
+  "id": "event_id",
+  "pubkey": "admin_public_key",
+  "created_at": 1234567890,
+  "kind": 23456,
+  "content": "<nip44 encrypted command>",
+  "tags": [
+    ["p", "relay_public_key"],
+  ],
+  "sig": "event_signature"
+}
+```
+
+**Admin Response Event:**
+```json
+["EVENT", "temp_sub_id", {
+  "id": "response_event_id",
+  "pubkey": "relay_public_key",
+  "created_at": 1234567890,
+  "kind": 23457,
+  "content": "<nip44 encrypted response>",
+  "tags": [
+    ["p", "admin_public_key"]
+  ],
+  "sig": "response_event_signature"
+}]
+```
+
+### Admin Commands
+
+All commands are sent as nip44 encrypted content. The following table lists all available commands:
+
+| Command Type | Tag Format | Description |
+|--------------|------------|-------------|
+| **Configuration Management** |
+| `config_update` | `["relay_description", "My Relay"]` | Update relay configuration parameters |
+| `config_query` | `["config_query", "list_all_keys"]` | List all available configuration keys |
+| **Auth Rules Management** |
+| `auth_add_blacklist` | `["blacklist", "pubkey", "abc123..."]` | Add pubkey to blacklist |
+| `auth_add_whitelist` | `["whitelist", "pubkey", "def456..."]` | Add pubkey to whitelist |
+| `auth_query_all` | `["auth_query", "all"]` | Query all auth rules |
+| `auth_query_type` | `["auth_query", "whitelist"]` | Query specific rule type |
+| `auth_query_pattern` | `["auth_query", "pattern", "abc123..."]` | Query specific pattern |
+| **System Commands** |
+| `system_clear_auth` | `["system_command", "clear_all_auth_rules"]` | Clear all auth rules |
+| `system_status` | `["system_command", "system_status"]` | Get system status |
+
+### Available Configuration Keys
+
+**Basic Relay Settings:**
+- `relay_description`: Relay description text
+- `relay_contact`: Contact information
+- `max_connections`: Maximum concurrent connections
+- `max_subscriptions_per_client`: Max subscriptions per client
+- `max_event_tags`: Maximum tags per event
+- `max_content_length`: Maximum event content length
+
+**Authentication & Access Control:**
+- `auth_enabled`: Enable whitelist/blacklist auth rules (`true`/`false`)
+- `nip42_auth_required`: Enable NIP-42 cryptographic authentication (`true`/`false`)
+- `nip42_auth_required_kinds`: Event kinds requiring NIP-42 auth (comma-separated)
+- `nip42_challenge_timeout`: NIP-42 challenge expiration seconds
+
+**Proof of Work & Validation:**
+- `pow_min_difficulty`: Minimum proof-of-work difficulty
+- `nip40_expiration_enabled`: Enable event expiration (`true`/`false`)
+
+### Response Format
+
+All admin commands return **signed EVENT responses** via WebSocket following standard Nostr protocol. Responses use JSON content with structured data.
+
+#### Response Examples
+
+**Success Response:**
+```json
+["EVENT", "temp_sub_id", {
+  "id": "response_event_id",
+  "pubkey": "relay_public_key",
+  "created_at": 1234567890,
+  "kind": 23457,
+  "content": "nip44 encrypted:{\"status\": \"success\", \"message\": \"Operation completed successfully\"}",
+  "tags": [
+    ["p", "admin_public_key"]
+  ],
+  "sig": "response_event_signature"
+}]
+```
+
+**Error Response:**
+```json
+["EVENT", "temp_sub_id", {
+  "id": "response_event_id",
+  "pubkey": "relay_public_key",
+  "created_at": 1234567890,
+  "kind": 23457,
+  "content": "nip44 encrypted:{\"status\": \"error\", \"message\": \"Error: invalid configuration value\"}",
+  "tags": [
+    ["p", "admin_public_key"]
+  ],
+  "sig": "response_event_signature"
+}]
+```
+
+**Auth Rules Query Response:**
+```json
+["EVENT", "temp_sub_id", {
+  "id": "response_event_id",
+  "pubkey": "relay_public_key",
+  "created_at": 1234567890,
+  "kind": 23457,
+  "content": "nip44 encrypted:{\"query_type\": \"auth_rules\", \"total_results\": 2, \"data\": [{\"rule_type\": \"blacklist\", \"pattern_type\": \"pubkey\", \"pattern_value\": \"abc123...\", \"action\": \"deny\"}]}",
+  "tags": [
+    ["p", "admin_public_key"]
+  ],
+  "sig": "response_event_signature"
+}]
+```
+
+**Configuration Query Response:**
+```json
+["EVENT", "temp_sub_id", {
+  "id": "response_event_id",
+  "pubkey": "relay_public_key",
+  "created_at": 1234567890,
+  "kind": 23457,
+  "content": "nip44 encrypted:{\"query_type\": \"config_keys\", \"config_keys\": [\"auth_enabled\", \"max_connections\"], \"descriptions\": {\"auth_enabled\": \"Enable whitelist/blacklist rules\"}}",
+  "tags": [
+    ["p", "admin_public_key"]
+  ],
+  "sig": "response_event_signature"
+}]
+```

--- a/api/index.html
+++ b/api/index.html
--- a/api/nostr-lite.js
+++ b/api/nostr-lite.js
@@ -8,7 +8,7 @@
 * Two-file architecture:
 * 1. Load nostr.bundle.js (official nostr-tools bundle)
 * 2. Load nostr-lite.js (this file - NOSTR_LOGIN_LITE library with CSS-only themes)
- * Generated on: 2025-09-16T15:52:30.145Z
+ * Generated on: 2025-09-16T22:12:00.192Z
 */

 // Verify dependencies are loaded
@@ -20,509 +20,10 @@ if (typeof window !== 'undefined') {
  
  console.log('NOSTR_LOGIN_LITE: Dependencies verified ✓');
  console.log('NOSTR_LOGIN_LITE: NostrTools available with keys:', Object.keys(window.NostrTools));
+  console.log('NOSTR_LOGIN_LITE: NIP-06 available:', !!window.NostrTools.nip06);
  console.log('NOSTR_LOGIN_LITE: NIP-46 available:', !!window.NostrTools.nip46);
 }

-// ===== NIP-46 Extension Integration =====
-// Add NIP-46 functionality to NostrTools if not already present
-if (typeof window.NostrTools !== 'undefined' && !window.NostrTools.nip46) {
-  console.log('NOSTR_LOGIN_LITE: Adding NIP-46 extension to NostrTools');
-  
-  const { nip44, generateSecretKey, getPublicKey, finalizeEvent, verifyEvent, utils } = window.NostrTools;
-
-  // NIP-05 regex for parsing
-  const NIP05_REGEX = /^(?:([\w.+-]+)@)?([\w_-]+(.[\w_-]+)+)$/;
-  const BUNKER_REGEX = /^bunker:\/\/([0-9a-f]{64})\??([?\/\w:.=&%-]*)$/;
-  const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-
-  // Event kinds
-  const NostrConnect = 24133;
-  const ClientAuth = 22242;
-  const Handlerinformation = 31990;
-
-  // Fetch implementation
-  let _fetch;
-  try {
-    _fetch = fetch;
-  } catch {
-    _fetch = null;
-  }
-
-  function useFetchImplementation(fetchImplementation) {
-    _fetch = fetchImplementation;
-  }
-
-  // Simple Pool implementation for NIP-46
-  class SimplePool {
-    constructor() {
-      this.relays = new Map();
-      this.subscriptions = new Map();
-    }
-
-    async ensureRelay(url) {
-      if (!this.relays.has(url)) {
-        console.log(`NIP-46: Connecting to relay ${url}`);
-        const ws = new WebSocket(url);
-        const relay = {
-          ws,
-          connected: false,
-          subscriptions: new Map()
-        };
-        
-        this.relays.set(url, relay);
-        
-        // Wait for connection with proper event handlers
-        await new Promise((resolve, reject) => {
-          const timeout = setTimeout(() => {
-            console.error(`NIP-46: Connection timeout for ${url}`);
-            reject(new Error(`Connection timeout to ${url}`));
-          }, 10000); // 10 second timeout
-          
-          ws.onopen = () => {
-            console.log(`NIP-46: Successfully connected to relay ${url}, WebSocket state: ${ws.readyState}`);
-            relay.connected = true;
-            clearTimeout(timeout);
-            resolve();
-          };
-          
-          ws.onerror = (error) => {
-            console.error(`NIP-46: Failed to connect to ${url}:`, error);
-            clearTimeout(timeout);
-            reject(new Error(`Failed to connect to ${url}: ${error.message || 'Connection failed'}`));
-          };
-          
-          ws.onclose = (event) => {
-            console.log(`NIP-46: Disconnected from relay ${url}:`, event.code, event.reason);
-            relay.connected = false;
-            if (this.relays.has(url)) {
-              this.relays.delete(url);
-            }
-            clearTimeout(timeout);
-            reject(new Error(`Connection closed during setup: ${event.reason || 'Unknown reason'}`));
-          };
-        });
-      } else {
-        const relay = this.relays.get(url);
-        // Verify the existing connection is still open
-        if (!relay.connected || relay.ws.readyState !== WebSocket.OPEN) {
-          console.log(`NIP-46: Reconnecting to relay ${url}`);
-          this.relays.delete(url);
-          return await this.ensureRelay(url); // Recursively reconnect
-        }
-      }
-      
-      const relay = this.relays.get(url);
-      console.log(`NIP-46: Relay ${url} ready, WebSocket state: ${relay.ws.readyState}`);
-      return relay;
-    }
-
-    subscribe(relays, filters, params = {}) {
-      const subId = Math.random().toString(36).substring(7);
-      
-      relays.forEach(async (url) => {
-        try {
-          const relay = await this.ensureRelay(url);
-          
-          relay.ws.onmessage = (event) => {
-            try {
-              const data = JSON.parse(event.data);
-              if (data[0] === 'EVENT' && data[1] === subId) {
-                params.onevent?.(data[2]);
-              } else if (data[0] === 'EOSE' && data[1] === subId) {
-                params.oneose?.();
-              }
-            } catch (err) {
-              console.warn('Failed to parse message:', err);
-            }
-          };
-
-          // Ensure filters is an array
-          const filtersArray = Array.isArray(filters) ? filters : [filters];
-          const reqMsg = JSON.stringify(['REQ', subId, ...filtersArray]);
-          relay.ws.send(reqMsg);
-          
-        } catch (err) {
-          console.warn('Failed to connect to relay:', url, err);
-        }
-      });
-
-      return {
-        close: () => {
-          relays.forEach(async (url) => {
-            const relay = this.relays.get(url);
-            if (relay?.connected) {
-              relay.ws.send(JSON.stringify(['CLOSE', subId]));
-            }
-          });
-        }
-      };
-    }
-
-    async publish(relays, event) {
-      console.log(`NIP-46: Publishing event to ${relays.length} relays:`, event);
-      
-      const promises = relays.map(async (url) => {
-        try {
-          console.log(`NIP-46: Attempting to publish to ${url}`);
-          const relay = await this.ensureRelay(url);
-          
-          return new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => {
-              console.error(`NIP-46: Publish timeout to ${url}`);
-              reject(new Error(`Publish timeout to ${url}`));
-            }, 10000); // Increased timeout to 10 seconds
-            
-            // Set up message handler for this specific event
-            const messageHandler = (msg) => {
-              try {
-                const data = JSON.parse(msg.data);
-                if (data[0] === 'OK' && data[1] === event.id) {
-                  clearTimeout(timeout);
-                  relay.ws.removeEventListener('message', messageHandler);
-                  if (data[2]) {
-                    console.log(`NIP-46: Publish success to ${url}:`, data[3]);
-                    resolve(data[3]);
-                  } else {
-                    console.error(`NIP-46: Publish rejected by ${url}:`, data[3]);
-                    reject(new Error(`Publish rejected: ${data[3]}`));
-                  }
-                }
-              } catch (err) {
-                console.error(`NIP-46: Error parsing message from ${url}:`, err);
-                clearTimeout(timeout);
-                relay.ws.removeEventListener('message', messageHandler);
-                reject(err);
-              }
-            };
-            
-            relay.ws.addEventListener('message', messageHandler);
-
-            // Double-check WebSocket state before sending
-            console.log(`NIP-46: About to publish to ${url}, WebSocket state: ${relay.ws.readyState} (0=CONNECTING, 1=OPEN, 2=CLOSING, 3=CLOSED)`);
-            if (relay.ws.readyState === WebSocket.OPEN) {
-              console.log(`NIP-46: Sending event to ${url}`);
-              relay.ws.send(JSON.stringify(['EVENT', event]));
-            } else {
-              console.error(`NIP-46: WebSocket not ready for ${url}, state: ${relay.ws.readyState}`);
-              clearTimeout(timeout);
-              relay.ws.removeEventListener('message', messageHandler);
-              reject(new Error(`WebSocket not ready for ${url}, state: ${relay.ws.readyState}`));
-            }
-          });
-        } catch (err) {
-          console.error(`NIP-46: Failed to publish to ${url}:`, err);
-          return Promise.reject(new Error(`Failed to publish to ${url}: ${err.message}`));
-        }
-      });
-
-      const results = await Promise.allSettled(promises);
-      console.log(`NIP-46: Publish results:`, results);
-      return results;
-    }
-
-    async querySync(relays, filter, params = {}) {
-      return new Promise((resolve) => {
-        const events = [];
-        this.subscribe(relays, [filter], {
-          ...params,
-          onevent: (event) => events.push(event),
-          oneose: () => resolve(events)
-        });
-      });
-    }
-  }
-
-  // Bunker URL utilities
-  function toBunkerURL(bunkerPointer) {
-    let bunkerURL = new URL(`bunker://${bunkerPointer.pubkey}`);
-    bunkerPointer.relays.forEach((relay) => {
-      bunkerURL.searchParams.append('relay', relay);
-    });
-    if (bunkerPointer.secret) {
-      bunkerURL.searchParams.set('secret', bunkerPointer.secret);
-    }
-    return bunkerURL.toString();
-  }
-
-  async function parseBunkerInput(input) {
-    let match = input.match(BUNKER_REGEX);
-    if (match) {
-      try {
-        const pubkey = match[1];
-        const qs = new URLSearchParams(match[2]);
-        return {
-          pubkey,
-          relays: qs.getAll('relay'),
-          secret: qs.get('secret')
-        };
-      } catch (_err) {
-        // Continue to NIP-05 parsing
-      }
-    }
-    return queryBunkerProfile(input);
-  }
-
-  async function queryBunkerProfile(nip05) {
-    if (!_fetch) {
-      throw new Error('Fetch implementation not available');
-    }
-
-    const match = nip05.match(NIP05_REGEX);
-    if (!match) return null;
-
-    const [_, name = '_', domain] = match;
-    try {
-      const url = `https://${domain}/.well-known/nostr.json?name=${name}`;
-      const res = await (await _fetch(url, { redirect: 'error' })).json();
-      let pubkey = res.names[name];
-      let relays = res.nip46[pubkey] || [];
-      return { pubkey, relays, secret: null };
-    } catch (_err) {
-      return null;
-    }
-  }
-
-  // BunkerSigner class
-  class BunkerSigner {
-    constructor(clientSecretKey, bp, params = {}) {
-      if (bp.relays.length === 0) {
-        throw new Error('no relays are specified for this bunker');
-      }
-
-      this.params = params;
-      this.pool = params.pool || new SimplePool();
-      this.secretKey = clientSecretKey;
-      this.conversationKey = nip44.getConversationKey(clientSecretKey, bp.pubkey);
-      this.bp = bp;
-      this.isOpen = false;
-      this.idPrefix = Math.random().toString(36).substring(7);
-      this.serial = 0;
-      this.listeners = {};
-      this.waitingForAuth = {};
-      this.ready = false;
-      this.readyPromise = this.setupSubscription(params);
-    }
-
-    async setupSubscription(params) {
-      console.log('NIP-46: Setting up subscription to relays:', this.bp.relays);
-      const listeners = this.listeners;
-      const waitingForAuth = this.waitingForAuth;
-      const convKey = this.conversationKey;
-
-      // Ensure all relays are connected first
-      await Promise.all(this.bp.relays.map(url => this.pool.ensureRelay(url)));
-      console.log('NIP-46: All relays connected, setting up subscription');
-
-      this.subCloser = this.pool.subscribe(
-        this.bp.relays,
-        [{ kinds: [NostrConnect], authors: [this.bp.pubkey], '#p': [getPublicKey(this.secretKey)] }],
-        {
-          onevent: async (event) => {
-            const o = JSON.parse(nip44.decrypt(event.content, convKey));
-            const { id, result, error } = o;
-
-            if (result === 'auth_url' && waitingForAuth[id]) {
-              delete waitingForAuth[id];
-              if (params.onauth) {
-                params.onauth(error);
-              } else {
-                console.warn(
-                  `NIP-46: remote signer ${this.bp.pubkey} tried to send an "auth_url"='${error}' but there was no onauth() callback configured.`
-                );
-              }
-              return;
-            }
-
-            let handler = listeners[id];
-            if (handler) {
-              if (error) handler.reject(error);
-              else if (result) handler.resolve(result);
-              delete listeners[id];
-            }
-          },
-          onclose: () => {
-            this.subCloser = undefined;
-          }
-        }
-      );
-      
-      this.isOpen = true;
-      this.ready = true;
-      console.log('NIP-46: BunkerSigner setup complete and ready');
-    }
-
-    async ensureReady() {
-      if (!this.ready) {
-        console.log('NIP-46: Waiting for BunkerSigner to be ready...');
-        await this.readyPromise;
-      }
-    }
-
-    async close() {
-      this.isOpen = false;
-      this.subCloser?.close();
-    }
-
-    async sendRequest(method, params) {
-      return new Promise(async (resolve, reject) => {
-        try {
-          await this.ensureReady(); // Wait for BunkerSigner to be ready
-          
-          if (!this.isOpen) {
-            throw new Error('this signer is not open anymore, create a new one');
-          }
-          if (!this.subCloser) {
-            await this.setupSubscription(this.params);
-          }
-
-          this.serial++;
-          const id = `${this.idPrefix}-${this.serial}`;
-          const encryptedContent = nip44.encrypt(JSON.stringify({ id, method, params }), this.conversationKey);
-          
-          const verifiedEvent = finalizeEvent(
-            {
-              kind: NostrConnect,
-              tags: [['p', this.bp.pubkey]],
-              content: encryptedContent,
-              created_at: Math.floor(Date.now() / 1000)
-            },
-            this.secretKey
-          );
-
-          this.listeners[id] = { resolve, reject };
-          this.waitingForAuth[id] = true;
-
-          console.log(`NIP-46: Sending ${method} request with id ${id}`);
-          const publishResults = await this.pool.publish(this.bp.relays, verifiedEvent);
-          // Check if at least one publish succeeded
-          const hasSuccess = publishResults.some(result => result.status === 'fulfilled');
-          if (!hasSuccess) {
-            throw new Error('Failed to publish to any relay');
-          }
-          console.log(`NIP-46: ${method} request sent successfully`);
-        } catch (err) {
-          console.error(`NIP-46: sendRequest ${method} failed:`, err);
-          reject(err);
-        }
-      });
-    }
-
-    async ping() {
-      let resp = await this.sendRequest('ping', []);
-      if (resp !== 'pong') {
-        throw new Error(`result is not pong: ${resp}`);
-      }
-    }
-
-    async connect() {
-      await this.sendRequest('connect', [this.bp.pubkey, this.bp.secret || '']);
-    }
-
-    async getPublicKey() {
-      if (!this.cachedPubKey) {
-        this.cachedPubKey = await this.sendRequest('get_public_key', []);
-      }
-      return this.cachedPubKey;
-    }
-
-    async signEvent(event) {
-      let resp = await this.sendRequest('sign_event', [JSON.stringify(event)]);
-      let signed = JSON.parse(resp);
-      if (verifyEvent(signed)) {
-        return signed;
-      } else {
-        throw new Error(`event returned from bunker is improperly signed: ${JSON.stringify(signed)}`);
-      }
-    }
-
-    async nip04Encrypt(thirdPartyPubkey, plaintext) {
-      return await this.sendRequest('nip04_encrypt', [thirdPartyPubkey, plaintext]);
-    }
-
-    async nip04Decrypt(thirdPartyPubkey, ciphertext) {
-      return await this.sendRequest('nip04_decrypt', [thirdPartyPubkey, ciphertext]);
-    }
-
-    async nip44Encrypt(thirdPartyPubkey, plaintext) {
-      return await this.sendRequest('nip44_encrypt', [thirdPartyPubkey, plaintext]);
-    }
-
-    async nip44Decrypt(thirdPartyPubkey, ciphertext) {
-      return await this.sendRequest('nip44_decrypt', [thirdPartyPubkey, ciphertext]);
-    }
-  }
-
-  async function createAccount(bunker, params, username, domain, email, localSecretKey = generateSecretKey()) {
-    if (email && !EMAIL_REGEX.test(email)) {
-      throw new Error('Invalid email');
-    }
-
-    let rpc = new BunkerSigner(localSecretKey, bunker.bunkerPointer, params);
-    let pubkey = await rpc.sendRequest('create_account', [username, domain, email || '']);
-    rpc.bp.pubkey = pubkey;
-    await rpc.connect();
-    return rpc;
-  }
-
-  async function fetchBunkerProviders(pool, relays) {
-    const events = await pool.querySync(relays, {
-      kinds: [Handlerinformation],
-      '#k': [NostrConnect.toString()]
-    });
-
-    events.sort((a, b) => b.created_at - a.created_at);
-
-    const validatedBunkers = await Promise.all(
-      events.map(async (event, i) => {
-        try {
-          const content = JSON.parse(event.content);
-          try {
-            if (events.findIndex((ev) => JSON.parse(ev.content).nip05 === content.nip05) !== i) {
-              return undefined;
-            }
-          } catch (err) {
-            // Continue processing
-          }
-
-          const bp = await queryBunkerProfile(content.nip05);
-          if (bp && bp.pubkey === event.pubkey && bp.relays.length) {
-            return {
-              bunkerPointer: bp,
-              nip05: content.nip05,
-              domain: content.nip05.split('@')[1],
-              name: content.name || content.display_name,
-              picture: content.picture,
-              about: content.about,
-              website: content.website,
-              local: false
-            };
-          }
-        } catch (err) {
-          return undefined;
-        }
-      })
-    );
-
-    return validatedBunkers.filter((b) => b !== undefined);
-  }
-
-  // Extend NostrTools with NIP-46 functionality
-  window.NostrTools.nip46 = {
-    BunkerSigner,
-    parseBunkerInput,
-    toBunkerURL,
-    queryBunkerProfile,
-    createAccount,
-    fetchBunkerProviders,
-    useFetchImplementation,
-    BUNKER_REGEX,
-    SimplePool
-  };
-
-  console.log('NIP-46 extension loaded successfully');
-  console.log('Available: NostrTools.nip46');
-}
-
 // ======================================
 // NOSTR_LOGIN_LITE Components
 // ======================================
@@ -854,7 +355,7 @@ class Modal {
        overflow: hidden;
      `;
    } else {
-      // Modal content: centered with margin
+      // Modal content: centered with margin, no fixed height
      modalContent.style.cssText = `
        position: relative;
        background: var(--nl-secondary-color);
@@ -864,7 +365,6 @@ class Modal {
        margin: 50px auto;
        border-radius: var(--nl-border-radius, 15px);
        border: var(--nl-border-width) solid var(--nl-primary-color);
-        max-height: 600px;
        overflow: hidden;
      `;
    }
@@ -929,8 +429,6 @@ class Modal {
    this.modalBody = document.createElement('div');
    this.modalBody.style.cssText = `
      padding: 24px;
-      overflow-y: auto;
-      max-height: 500px;
      background: transparent;
      font-family: var(--nl-font-family, 'Courier New', monospace);
    `;
@@ -1019,6 +517,16 @@ class Modal {
      });
    }

+    // Seed Phrase option - only show if explicitly enabled
+    if (this.options?.methods?.seedphrase === true) {
+      options.push({
+        type: 'seedphrase',
+        title: 'Seed Phrase',
+        description: 'Import from mnemonic seed phrase',
+        icon: '🌱'
+      });
+    }
+
    // Nostr Connect option (check both 'connect' and 'remote' for compatibility)
    if (this.options?.methods?.connect !== false && this.options?.methods?.remote !== false) {
      options.push({
@@ -1076,6 +584,27 @@ class Modal {
        button.style.background = 'var(--nl-secondary-color)';
      };

+      const iconDiv = document.createElement('div');
+      // Replace emoji icons with text-based ones
+      const iconMap = {
+        '🔌': '[EXT]',
+        '🔑': '[KEY]',
+        '🌱': '[SEED]',
+        '🌐': '[NET]',
+        '👁️': '[VIEW]',
+        '📱': '[SMS]'
+      };
+      iconDiv.textContent = iconMap[option.icon] || option.icon;
+      iconDiv.style.cssText = `
+        font-size: 16px;
+        font-weight: bold;
+        margin-right: 16px;
+        width: 50px;
+        text-align: center;
+        color: var(--nl-primary-color);
+        font-family: var(--nl-font-family, 'Courier New', monospace);
+      `;
+
      const contentDiv = document.createElement('div');
      contentDiv.style.cssText = 'flex: 1; text-align: left;';

@@ -1099,6 +628,7 @@ class Modal {
      contentDiv.appendChild(titleDiv);
      contentDiv.appendChild(descDiv);

+      button.appendChild(iconDiv);
      button.appendChild(contentDiv);
      this.modalBody.appendChild(button);
    });
@@ -1115,6 +645,9 @@ class Modal {
      case 'local':
        this._showLocalKeyScreen();
        break;
+      case 'seedphrase':
+        this._showSeedPhraseScreen();
+        break;
      case 'connect':
        this._showConnectScreen();
        break;
@@ -2159,6 +1692,287 @@ class Modal {
    this._setAuthMethod('readonly');
  }

+  _showSeedPhraseScreen() {
+    this.modalBody.innerHTML = '';
+
+    const title = document.createElement('h3');
+    title.textContent = 'Import from Seed Phrase';
+    title.style.cssText = 'margin: 0 0 16px 0; font-size: 18px; font-weight: 600;';
+
+    const description = document.createElement('p');
+    description.textContent = 'Enter your 12 or 24-word mnemonic seed phrase to derive Nostr accounts:';
+    description.style.cssText = 'margin-bottom: 12px; color: #6b7280; font-size: 14px;';
+
+    const textarea = document.createElement('textarea');
+    // Remove default placeholder text as requested
+    textarea.placeholder = '';
+    textarea.style.cssText = `
+      width: 100%;
+      height: 100px;
+      padding: 12px;
+      border: 1px solid #d1d5db;
+      border-radius: 6px;
+      margin-bottom: 12px;
+      resize: none;
+      font-family: monospace;
+      font-size: 14px;
+      box-sizing: border-box;
+    `;
+
+    // Add real-time mnemonic validation
+    const formatHint = document.createElement('div');
+    formatHint.style.cssText = 'margin-bottom: 16px; font-size: 12px; color: #6b7280; min-height: 16px;';
+    
+    textarea.oninput = () => {
+      const value = textarea.value.trim();
+      if (!value) {
+        formatHint.textContent = '';
+        return;
+      }
+      
+      const isValid = this._validateMnemonic(value);
+      if (isValid) {
+        const wordCount = value.split(/\s+/).length;
+        formatHint.textContent = `✅ Valid ${wordCount}-word mnemonic detected`;
+        formatHint.style.color = '#059669';
+      } else {
+        formatHint.textContent = '❌ Invalid mnemonic - must be 12 or 24 valid BIP-39 words';
+        formatHint.style.color = '#dc2626';
+      }
+    };
+
+    // Generate new seed phrase button
+    const generateButton = document.createElement('button');
+    generateButton.textContent = 'Generate New Seed Phrase';
+    generateButton.onclick = () => this._generateNewSeedPhrase(textarea, formatHint);
+    generateButton.style.cssText = this._getButtonStyle() + 'margin-bottom: 12px;';
+
+    const importButton = document.createElement('button');
+    importButton.textContent = 'Import Accounts';
+    importButton.onclick = () => this._importFromSeedPhrase(textarea.value);
+    importButton.style.cssText = this._getButtonStyle();
+
+    const backButton = document.createElement('button');
+    backButton.textContent = 'Back';
+    backButton.onclick = () => this._renderLoginOptions();
+    backButton.style.cssText = this._getButtonStyle('secondary') + 'margin-top: 12px;';
+
+    this.modalBody.appendChild(title);
+    this.modalBody.appendChild(description);
+    this.modalBody.appendChild(textarea);
+    this.modalBody.appendChild(formatHint);
+    this.modalBody.appendChild(generateButton);
+    this.modalBody.appendChild(importButton);
+    this.modalBody.appendChild(backButton);
+  }
+
+  _generateNewSeedPhrase(textarea, formatHint) {
+    try {
+      // Check if NIP-06 is available
+      if (!window.NostrTools?.nip06) {
+        throw new Error('NIP-06 not available in bundle');
+      }
+
+      // Generate a random 12-word mnemonic using NostrTools
+      const mnemonic = window.NostrTools.nip06.generateSeedWords();
+      
+      // Set the generated mnemonic in the textarea
+      textarea.value = mnemonic;
+      
+      // Trigger validation to show it's valid
+      const wordCount = mnemonic.split(/\s+/).length;
+      formatHint.textContent = `✅ Generated valid ${wordCount}-word mnemonic`;
+      formatHint.style.color = '#059669';
+      
+      console.log('Generated new seed phrase:', wordCount, 'words');
+      
+    } catch (error) {
+      console.error('Failed to generate seed phrase:', error);
+      formatHint.textContent = '❌ Failed to generate seed phrase - NIP-06 not available';
+      formatHint.style.color = '#dc2626';
+    }
+  }
+
+  _validateMnemonic(mnemonic) {
+    try {
+      // Check if NIP-06 is available
+      if (!window.NostrTools?.nip06) {
+        console.error('NIP-06 not available in bundle');
+        return false;
+      }
+
+      const words = mnemonic.trim().split(/\s+/);
+      
+      // Must be 12 or 24 words
+      if (words.length !== 12 && words.length !== 24) {
+        return false;
+      }
+
+      // Try to validate using NostrTools nip06 - this will throw if invalid
+      window.NostrTools.nip06.privateKeyFromSeedWords(mnemonic, '', 0);
+      return true;
+    } catch (error) {
+      console.log('Mnemonic validation failed:', error.message);
+      return false;
+    }
+  }
+
+  _importFromSeedPhrase(mnemonic) {
+    try {
+      const trimmed = mnemonic.trim();
+      if (!trimmed) {
+        throw new Error('Please enter a mnemonic seed phrase');
+      }
+
+      // Validate the mnemonic
+      if (!this._validateMnemonic(trimmed)) {
+        throw new Error('Invalid mnemonic. Please enter a valid 12 or 24-word BIP-39 seed phrase');
+      }
+
+      // Generate accounts 0-5 using NIP-06
+      const accounts = [];
+      for (let i = 0; i < 6; i++) {
+        try {
+          const privateKey = window.NostrTools.nip06.privateKeyFromSeedWords(trimmed, '', i);
+          const publicKey = window.NostrTools.getPublicKey(privateKey);
+          const nsec = window.NostrTools.nip19.nsecEncode(privateKey);
+          const npub = window.NostrTools.nip19.npubEncode(publicKey);
+
+          accounts.push({
+            index: i,
+            privateKey,
+            publicKey,
+            nsec,
+            npub
+          });
+        } catch (error) {
+          console.error(`Failed to derive account ${i}:`, error);
+        }
+      }
+
+      if (accounts.length === 0) {
+        throw new Error('Failed to derive any accounts from seed phrase');
+      }
+
+      console.log(`Successfully derived ${accounts.length} accounts from seed phrase`);
+      this._showAccountSelection(accounts);
+
+    } catch (error) {
+      console.error('Seed phrase import failed:', error);
+      this._showError('Seed phrase import failed: ' + error.message);
+    }
+  }
+
+  _showAccountSelection(accounts) {
+    this.modalBody.innerHTML = '';
+
+    const title = document.createElement('h3');
+    title.textContent = 'Select Account';
+    title.style.cssText = 'margin: 0 0 16px 0; font-size: 18px; font-weight: 600;';
+
+    const description = document.createElement('p');
+    description.textContent = `Select which account to use (${accounts.length} accounts derived from seed phrase):`;
+    description.style.cssText = 'margin-bottom: 20px; color: #6b7280; font-size: 14px;';
+
+    this.modalBody.appendChild(title);
+    this.modalBody.appendChild(description);
+
+    // Create table for account selection
+    const table = document.createElement('table');
+    table.style.cssText = `
+      width: 100%;
+      border-collapse: collapse;
+      margin-bottom: 20px;
+      font-family: var(--nl-font-family, 'Courier New', monospace);
+      font-size: 12px;
+    `;
+
+    // Table header
+    const thead = document.createElement('thead');
+    thead.innerHTML = `
+      <tr style="background: #f3f4f6;">
+        <th style="padding: 8px; text-align: center; border: 1px solid #d1d5db; font-weight: bold;">#</th>
+        <th style="padding: 8px; text-align: left; border: 1px solid #d1d5db; font-weight: bold;">Public Key (npub)</th>
+        <th style="padding: 8px; text-align: center; border: 1px solid #d1d5db; font-weight: bold;">Action</th>
+      </tr>
+    `;
+    table.appendChild(thead);
+
+    // Table body
+    const tbody = document.createElement('tbody');
+    accounts.forEach(account => {
+      const row = document.createElement('tr');
+      row.style.cssText = 'border: 1px solid #d1d5db;';
+      
+      const indexCell = document.createElement('td');
+      indexCell.textContent = account.index;
+      indexCell.style.cssText = 'padding: 8px; text-align: center; border: 1px solid #d1d5db; font-weight: bold;';
+
+      const pubkeyCell = document.createElement('td');
+      pubkeyCell.style.cssText = 'padding: 8px; border: 1px solid #d1d5db; font-family: monospace; word-break: break-all;';
+      
+      // Show truncated npub for readability
+      const truncatedNpub = `${account.npub.slice(0, 12)}...${account.npub.slice(-8)}`;
+      pubkeyCell.innerHTML = `
+        <code style="background: #f3f4f6; padding: 2px 4px; border-radius: 2px;">${truncatedNpub}</code><br>
+        <small style="color: #6b7280;">Full: ${account.npub}</small>
+      `;
+
+      const actionCell = document.createElement('td');
+      actionCell.style.cssText = 'padding: 8px; text-align: center; border: 1px solid #d1d5db;';
+      
+      const selectButton = document.createElement('button');
+      selectButton.textContent = 'Use';
+      selectButton.onclick = () => this._selectAccount(account);
+      selectButton.style.cssText = `
+        padding: 4px 12px;
+        font-size: 11px;
+        background: var(--nl-secondary-color);
+        color: var(--nl-primary-color);
+        border: 1px solid var(--nl-primary-color);
+        border-radius: 4px;
+        cursor: pointer;
+        font-family: var(--nl-font-family, 'Courier New', monospace);
+      `;
+      selectButton.onmouseover = () => {
+        selectButton.style.borderColor = 'var(--nl-accent-color)';
+      };
+      selectButton.onmouseout = () => {
+        selectButton.style.borderColor = 'var(--nl-primary-color)';
+      };
+
+      actionCell.appendChild(selectButton);
+      
+      row.appendChild(indexCell);
+      row.appendChild(pubkeyCell);
+      row.appendChild(actionCell);
+      tbody.appendChild(row);
+    });
+    table.appendChild(tbody);
+
+    this.modalBody.appendChild(table);
+
+    // Back button
+    const backButton = document.createElement('button');
+    backButton.textContent = 'Back to Seed Phrase';
+    backButton.onclick = () => this._showSeedPhraseScreen();
+    backButton.style.cssText = this._getButtonStyle('secondary');
+
+    this.modalBody.appendChild(backButton);
+  }
+
+  _selectAccount(account) {
+    console.log('Selected account:', account.index, account.npub);
+    
+    // Use the same auth method as local keys, but with seedphrase identifier
+    this._setAuthMethod('local', {
+      secret: account.nsec,
+      pubkey: account.publicKey,
+      source: 'seedphrase',
+      accountIndex: account.index
+    });
+  }
+
  _showOtpScreen() {
    // Placeholder for OTP functionality
    this._showError('OTP/DM not yet implemented - coming soon!');
@@ -2503,13 +2317,13 @@ class FloatingTab {
    // Determine which relays to use
    const relays = this.options.getUserRelay.length > 0
      ? this.options.getUserRelay
-      : (this.modal?.options?.relays || ['wss://relay.damus.io', 'wss://nos.lol']);
+      : ['wss://relay.damus.io', 'wss://nos.lol'];

    console.log('FloatingTab: Fetching profile from relays:', relays);

    try {
      // Create a SimplePool instance for querying
-      const pool = new window.NostrTools.nip46.SimplePool();
+      const pool = new window.NostrTools.SimplePool();
      
      // Query for kind 0 (user metadata) events
      const events = await pool.querySync(relays, {
@@ -2532,9 +2346,27 @@ class FloatingTab {
        const profile = JSON.parse(latestEvent.content);
        console.log('FloatingTab: Parsed profile:', profile);
        
-        // Return relevant profile fields
+        // Find the best name from any key containing "name" (case-insensitive)
+        let bestName = null;
+        const nameKeys = Object.keys(profile).filter(key =>
+          key.toLowerCase().includes('name') &&
+          typeof profile[key] === 'string' &&
+          profile[key].trim().length > 0
+        );
+        
+        if (nameKeys.length > 0) {
+          // Find the shortest name value
+          bestName = nameKeys
+            .map(key => profile[key].trim())
+            .reduce((shortest, current) =>
+              current.length < shortest.length ? current : shortest
+            );
+          console.log('FloatingTab: Found name keys:', nameKeys, 'selected:', bestName);
+        }
+        
+        // Return relevant profile fields with the best name
        return {
-          name: profile.name || null,
+          name: bestName,
          display_name: profile.display_name || null,
          about: profile.about || null,
          picture: profile.picture || null,
@@ -2695,10 +2527,10 @@ class NostrLite {
    
    this.options = {
      theme: 'default',
-      relays: ['wss://relay.damus.io', 'wss://nos.lol'],
      methods: {
        extension: true,
        local: true,
+        seedphrase: false,
        readonly: true,
        connect: false,
        otp: false
@@ -3127,8 +2959,8 @@ class WindowNostr {
  }

  async getRelays() {
-    // Return configured relays from nostr-lite options
-    return this.nostrLite.options?.relays || ['wss://relay.damus.io'];
+    // Return default relays since we removed the relays configuration
+    return ['wss://relay.damus.io', 'wss://nos.lol'];
  }

  get nip04() {
--- a/api/nostr.bundle.js
+++ b/api/nostr.bundle.js
--- a/docs/admin_api_plan.md
+++ b/docs/admin_api_plan.md
@@ -0,0 +1,537 @@
+# C-Relay Administrator API Implementation Plan
+
+## Problem Analysis
+
+### Current Issues Identified:
+
+1. **Schema Mismatch**: Storage system (config.c) vs Validation system (request_validator.c) use different column names and values
+2. **Missing API Endpoint**: No way to clear auth_rules table for testing
+3. **Configuration Gap**: Auth rules enforcement may not be properly enabled
+4. **Documentation Gap**: Admin API commands not documented
+
+### Root Cause: Auth Rules Schema Inconsistency
+
+**Current Schema (sql_schema.h lines 140-150):**
+```sql
+CREATE TABLE auth_rules (
+    rule_type TEXT CHECK (rule_type IN ('whitelist', 'blacklist')),
+    pattern_type TEXT CHECK (pattern_type IN ('pubkey', 'hash')),  
+    pattern_value TEXT,
+    action TEXT CHECK (action IN ('allow', 'deny')),
+    active INTEGER DEFAULT 1
+);
+```
+
+**Storage Implementation (config.c):**
+- Stores: `rule_type='blacklist'`, `pattern_type='pubkey'`, `pattern_value='hex'`, `action='allow'`
+
+**Validation Implementation (request_validator.c):**
+- Queries: `rule_type='pubkey_blacklist'`, `rule_target='hex'`, `operation='event'`, `enabled=1`
+
+**MISMATCH**: Validator looks for non-existent columns and wrong rule_type values!
+
+## Proposed Solution Architecture
+
+### Phase 1: API Documentation & Standardization
+
+#### Admin API Commands (via WebSocket with admin private key)
+
+**Kind 23455: Configuration Management (Ephemeral)**
+- Update relay settings, limits, authentication policies
+- **Standard Mode**: Commands in tags `["config_key", "config_value"]`
+- **Encrypted Mode**: Commands NIP-44 encrypted in content `{"encrypted_tags": "..."}`
+- Content: Descriptive text or encrypted payload
+- Security: Optional NIP-44 encryption for sensitive operations
+
+**Kind 23456: Auth Rules & System Management (Ephemeral)**
+- Auth rules: Add/remove/query whitelist/blacklist rules
+- System commands: clear rules, status, cache management
+- **Standard Mode**: Commands in tags
+  - Rule format: `["rule_type", "pattern_type", "pattern_value"]`
+  - Query format: `["auth_query", "filter"]`
+  - System format: `["system_command", "command_name"]`
+- **Encrypted Mode**: Commands NIP-44 encrypted in content `{"encrypted_tags": "..."}`
+- Content: Action description + optional encrypted payload
+- Security: Optional NIP-44 encryption for sensitive operations
+
+#### Configuration Query Commands (using Kind 23455)
+
+1. **List All Configuration Keys (Standard)**:
+   ```json
+   {
+     "kind": 23455,
+     "content": "Discovery query",
+     "tags": [["config_query", "list_all_keys"]]
+   }
+   ```
+
+2. **List All Configuration Keys (Encrypted)**:
+   ```json
+   {
+     "kind": 23455,
+     "content": "{\"query\":\"list_config_keys\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
+     "tags": []
+   }
+   ```
+   *Encrypted payload contains:* `[["config_query", "list_all_keys"]]`
+
+3. **Get Current Configuration (Standard)**:
+   ```json
+   {
+     "kind": 23455,
+     "content": "Config query",
+     "tags": [["config_query", "get_current_config"]]
+   }
+   ```
+
+4. **Get Current Configuration (Encrypted)**:
+   ```json
+   {
+     "kind": 23455,
+     "content": "{\"query\":\"get_config\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
+     "tags": []
+   }
+   ```
+   *Encrypted payload contains:* `[["config_query", "get_current_config"]]`
+
+#### System Management Commands (using Kind 23456)
+
+1. **Clear All Auth Rules (Standard)**:
+   ```json
+   {
+     "kind": 23456,
+     "content": "{\"action\":\"clear_all\"}",
+     "tags": [["system_command", "clear_all_auth_rules"]]
+   }
+   ```
+
+2. **Clear All Auth Rules (Encrypted)**:
+   ```json
+   {
+     "kind": 23456,
+     "content": "{\"action\":\"clear_all\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
+     "tags": []
+   }
+   ```
+   *Encrypted payload contains:* `[["system_command", "clear_all_auth_rules"]]`
+
+3. **Query All Auth Rules (Standard)**:
+   ```json
+   {
+     "kind": 23456,
+     "content": "{\"query\":\"list_auth_rules\"}",
+     "tags": [["auth_query", "all"]]
+   }
+   ```
+
+4. **Query All Auth Rules (Encrypted)**:
+   ```json
+   {
+     "kind": 23456,
+     "content": "{\"query\":\"list_auth_rules\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
+     "tags": []
+   }
+   ```
+   *Encrypted payload contains:* `[["auth_query", "all"]]`
+
+5. **Add Blacklist Rule (Standard)**:
+   ```json
+   {
+     "kind": 23456,
+     "content": "{\"action\":\"add\"}",
+     "tags": [["blacklist", "pubkey", "deadbeef1234abcd..."]]
+   }
+   ```
+
+6. **Add Blacklist Rule (Encrypted)**:
+   ```json
+   {
+     "kind": 23456,
+     "content": "{\"action\":\"add\",\"encrypted_tags\":\"nip44_encrypted_payload\"}",
+     "tags": []
+   }
+   ```
+   *Encrypted payload contains:* `[["blacklist", "pubkey", "deadbeef1234abcd..."]]`
+
+### Phase 2: Auth Rules Schema Alignment
+
+#### Option A: Fix Validator to Match Schema (RECOMMENDED)
+
+**Update request_validator.c:**
+```sql
+-- OLD (broken):
+WHERE rule_type = 'pubkey_blacklist' AND rule_target = ? AND operation = ? AND enabled = 1
+
+-- NEW (correct):
+WHERE rule_type = 'blacklist' AND pattern_type = 'pubkey' AND pattern_value = ? AND active = 1
+```
+
+**Benefits:**
+- Matches actual database schema
+- Simpler rule_type values ('blacklist' vs 'pubkey_blacklist')  
+- Uses existing columns (pattern_value vs rule_target)
+- Consistent with storage implementation
+
+#### Option B: Update Schema to Match Validator (NOT RECOMMENDED)
+
+Would require changing schema, migration scripts, and storage logic.
+
+### Phase 3: Implementation Priority
+
+#### High Priority (Critical for blacklist functionality):
+1. Fix request_validator.c schema mismatch
+2. Ensure auth_required configuration is enabled
+3. Update tests to use ephemeral event kinds (23455/23456)
+4. Test blacklist enforcement
+
+#### Medium Priority (Enhanced Admin Features):
+1. **Implement NIP-44 Encryption Support**:
+   - Detect empty tags array for Kind 23455/23456 events
+   - Parse `encrypted_tags` field from content JSON
+   - Decrypt using admin privkey and relay pubkey
+   - Process decrypted tags as normal commands
+2. Add clear_all_auth_rules system command
+3. Add auth rule query functionality (both standard and encrypted modes)
+4. Add configuration discovery (list available config keys)
+5. Enhanced error reporting in admin API
+6. Conflict resolution (same pubkey in whitelist + blacklist)
+
+#### Security Priority (NIP-44 Implementation):
+1. **Encryption Detection Logic**: Check for empty tags + encrypted_tags field
+2. **Key Pair Management**: Use admin private key + relay public key for NIP-44
+3. **Backward Compatibility**: Support both standard and encrypted modes
+4. **Error Handling**: Graceful fallback if decryption fails
+5. **Performance**: Cache decrypted results to avoid repeated decryption
+
+#### Low Priority (Documentation & Polish):
+1. Complete README.md API documentation
+2. Example usage scripts
+3. Admin client tools
+
+### Phase 4: Expected API Structure
+
+#### README.md Documentation Format:
+
+```markdown
+# C-Relay Administrator API
+
+## Authentication
+All admin commands require signing with the admin private key generated during first startup.
+
+## Configuration Management (Kind 23455 - Ephemeral)
+Update relay configuration parameters or query available settings.
+
+**Configuration Update Event:**
+```json
+{
+  "kind": 23455,
+  "content": "Configuration update",
+  "tags": [
+    ["config_key1", "config_value1"],
+    ["config_key2", "config_value2"]
+  ]
+}
+```
+
+**List Available Config Keys:**
+```json
+{
+  "kind": 23455,
+  "content": "{\"query\":\"list_config_keys\",\"description\":\"Get editable config keys\"}",
+  "tags": [
+    ["config_query", "list_all_keys"]
+  ]
+}
+```
+
+**Get Current Configuration:**
+```json
+{
+  "kind": 23455,
+  "content": "{\"query\":\"get_config\",\"description\":\"Get current config values\"}",
+  "tags": [
+    ["config_query", "get_current_config"]
+  ]
+}
+```
+
+## Auth Rules Management (Kind 23456 - Ephemeral)
+Manage whitelist and blacklist rules.
+
+**Add Rule Event:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"action\":\"add\",\"description\":\"Block malicious user\"}",
+  "tags": [
+    ["blacklist", "pubkey", "deadbeef1234..."]
+  ]
+}
+```
+
+**Remove Rule Event:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"action\":\"remove\",\"description\":\"Unblock user\"}",
+  "tags": [
+    ["blacklist", "pubkey", "deadbeef1234..."]
+  ]
+}
+```
+
+**Query All Auth Rules:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"query\":\"list_auth_rules\",\"description\":\"Get all rules\"}",
+  "tags": [
+    ["auth_query", "all"]
+  ]
+}
+```
+
+**Query Whitelist Rules Only:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"query\":\"list_auth_rules\",\"description\":\"Get whitelist\"}",
+  "tags": [
+    ["auth_query", "whitelist"]
+  ]
+}
+```
+
+**Check Specific Pattern:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"query\":\"check_pattern\",\"description\":\"Check if pattern exists\"}",
+  "tags": [
+    ["auth_query", "pattern", "deadbeef1234..."]
+  ]
+}
+```
+
+## System Management (Kind 23456 - Ephemeral)
+System administration commands using the same kind as auth rules.
+
+**Clear All Auth Rules:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"action\":\"clear_all\",\"description\":\"Clear all auth rules\"}",
+  "tags": [
+    ["system_command", "clear_all_auth_rules"]
+  ]
+}
+```
+
+**System Status:**
+```json
+{
+  "kind": 23456,
+  "content": "{\"action\":\"system_status\",\"description\":\"Get system status\"}",
+  "tags": [
+    ["system_command", "system_status"]
+  ]
+}
+```
+
+## Response Format
+All admin commands return JSON responses via WebSocket:
+
+**Success Response:**
+```json
+["OK", "event_id", true, "success_message"]
+```
+
+**Error Response:**  
+```json
+["OK", "event_id", false, "error_message"]
+```
+
+## Configuration Keys
+- `relay_description`: Relay description text
+- `relay_contact`: Contact information  
+- `auth_enabled`: Enable authentication system
+- `max_connections`: Maximum concurrent connections
+- `pow_min_difficulty`: Minimum proof-of-work difficulty
+- ... (full list of config keys)
+
+## Examples
+
+### Enable Authentication & Add Blacklist
+```bash
+# 1. Enable auth system
+nak event -k 23455 --content "Enable authentication" \
+  -t "auth_enabled=true" \
+  --sec $ADMIN_PRIVKEY | nak event ws://localhost:8888
+
+# 2. Add user to blacklist
+nak event -k 23456 --content '{"action":"add","description":"Spam user"}' \
+  -t "blacklist=pubkey;$SPAM_USER_PUBKEY" \
+  --sec $ADMIN_PRIVKEY | nak event ws://localhost:8888
+
+# 3. Query all auth rules
+nak event -k 23456 --content '{"query":"list_auth_rules","description":"Get all rules"}' \
+  -t "auth_query=all" \
+  --sec $ADMIN_PRIVKEY | nak event ws://localhost:8888
+
+# 4. Clear all rules for testing
+nak event -k 23456 --content '{"action":"clear_all","description":"Clear all rules"}' \
+  -t "system_command=clear_all_auth_rules" \
+  --sec $ADMIN_PRIVKEY | nak event ws://localhost:8888
+```
+
+## Expected Response Formats
+
+### Configuration Query Response
+```json
+["EVENT", "subscription_id", {
+  "kind": 23455,
+  "content": "{\"config_keys\": [\"auth_enabled\", \"max_connections\"], \"descriptions\": {\"auth_enabled\": \"Enable whitelist/blacklist rules\"}}",
+  "tags": [["response_type", "config_keys_list"]]
+}]
+```
+
+### Current Config Response
+```json
+["EVENT", "subscription_id", {
+  "kind": 23455,
+  "content": "{\"current_config\": {\"auth_enabled\": \"true\", \"max_connections\": \"1000\"}}",
+  "tags": [["response_type", "current_config"]]
+}]
+```
+
+### Auth Rules Query Response
+```json
+["EVENT", "subscription_id", {
+  "kind": 23456,
+  "content": "{\"auth_rules\": [{\"rule_type\": \"blacklist\", \"pattern_type\": \"pubkey\", \"pattern_value\": \"deadbeef...\"}, {\"rule_type\": \"whitelist\", \"pattern_type\": \"pubkey\", \"pattern_value\": \"cafebabe...\"}]}",
+  "tags": [["response_type", "auth_rules_list"], ["query_type", "all"]]
+}]
+```
+
+### Pattern Check Response
+```json
+["EVENT", "subscription_id", {
+  "kind": 23456,
+  "content": "{\"pattern_exists\": true, \"rule_type\": \"blacklist\", \"pattern_value\": \"deadbeef...\"}",
+  "tags": [["response_type", "pattern_check"], ["pattern", "deadbeef..."]]
+}]
+```
+
+## Implementation Steps
+
+1. **Document API** (this file) ✅
+2. **Update to ephemeral event kinds** ✅
+3. **Fix request_validator.c** schema mismatch
+4. **Update tests** to use Kind 23455/23456
+5. **Add auth rule query functionality**
+6. **Add configuration discovery feature**
+7. **Test blacklist functionality**
+8. **Add remaining system commands**
+
+## Testing Plan
+
+1. Fix schema mismatch and test basic blacklist
+2. Add clear_auth_rules and test table cleanup
+3. Test whitelist/blacklist conflict scenarios  
+4. Test all admin API commands end-to-end
+5. Update integration tests
+
+This plan addresses the immediate blacklist issue while establishing a comprehensive admin API framework for future expansion.
+
+## NIP-44 Encryption Implementation Details
+
+### Server-Side Detection Logic
+```c
+// In admin event processing function
+bool is_encrypted_command(struct nostr_event *event) {
+    // Check if Kind 23455 or 23456 with empty tags
+    if ((event->kind == 23455 || event->kind == 23456) &&
+        event->tags_count == 0) {
+        return true;
+    }
+    return false;
+}
+
+cJSON *decrypt_admin_tags(struct nostr_event *event) {
+    cJSON *content_json = cJSON_Parse(event->content);
+    if (!content_json) return NULL;
+    
+    cJSON *encrypted_tags = cJSON_GetObjectItem(content_json, "encrypted_tags");
+    if (!encrypted_tags) {
+        cJSON_Delete(content_json);
+        return NULL;
+    }
+    
+    // Decrypt using NIP-44 with admin pubkey and relay privkey
+    char *decrypted = nip44_decrypt(
+        cJSON_GetStringValue(encrypted_tags),
+        admin_pubkey,           // Shared secret with admin
+        relay_private_key       // Our private key
+    );
+    
+    cJSON *decrypted_tags = cJSON_Parse(decrypted);
+    free(decrypted);
+    cJSON_Delete(content_json);
+    
+    return decrypted_tags; // Returns tag array: [["key1", "val1"], ["key2", "val2"]]
+}
+```
+
+### Admin Event Processing Flow
+1. **Receive Event**: Kind 23455/23456 with admin signature
+2. **Check Mode**: Empty tags = encrypted, populated tags = standard
+3. **Decrypt if Needed**: Extract and decrypt `encrypted_tags` from content
+4. **Process Commands**: Use decrypted/standard tags for command processing
+5. **Execute**: Same logic for both modes after tag extraction
+6. **Respond**: Standard response format (optionally encrypt response)
+
+### Security Benefits
+- **Command Privacy**: Admin operations invisible in event tags
+- **Replay Protection**: NIP-44 includes timestamp/randomness
+- **Key Management**: Uses existing admin/relay key pair
+- **Backward Compatible**: Standard mode still works
+- **Performance**: Only decrypt when needed (empty tags detection)
+
+### NIP-44 Library Integration
+The relay will need to integrate a NIP-44 encryption/decryption library:
+
+```c
+// Required NIP-44 functions
+char* nip44_encrypt(const char* plaintext, const char* sender_privkey, const char* recipient_pubkey);
+char* nip44_decrypt(const char* ciphertext, const char* recipient_privkey, const char* sender_pubkey);
+```
+
+### Implementation Priority (Updated)
+
+#### Phase 1: Core Infrastructure (Complete)
+- [x] Event-based admin authentication system
+- [x] Kind 23455/23456 (Configuration/Auth Rules) processing
+- [x] Basic configuration parameter updates
+- [x] Auth rule add/remove/clear functionality
+- [x] Updated to ephemeral event kinds
+- [x] Designed NIP-44 encryption support
+
+#### Phase 2: NIP-44 Encryption Support (Next Priority)
+- [ ] **Add NIP-44 library dependency** to project
+- [ ] **Implement encryption detection logic** (`is_encrypted_command()`)
+- [ ] **Add decrypt_admin_tags() function** with NIP-44 support
+- [ ] **Update admin command processing** to handle both modes
+- [ ] **Test encrypted admin commands** end-to-end
+
+#### Phase 3: Enhanced Features
+- [ ] **Auth rule query functionality** (both standard and encrypted modes)
+- [ ] **Configuration discovery API** (list available config keys)
+- [ ] **Enhanced error messages** with encryption status
+- [ ] **Performance optimization** (caching, async decrypt)
+
+#### Phase 4: Schema Fixes (Critical)
+- [ ] **Fix request_validator.c** schema mismatch
+- [ ] **Enable blacklist enforcement** with encrypted commands
+- [ ] **Update tests** to use both standard and encrypted modes
+
+This enhanced admin API provides enterprise-grade security while maintaining ease of use for basic operations.
--- a/make_and_restart_relay.sh
+++ b/make_and_restart_relay.sh
@@ -198,25 +198,54 @@ fi

 echo "Build successful. Proceeding with relay restart..."

-# Kill existing relay if running
+# Kill existing relay if running - start aggressive immediately
 echo "Stopping any existing relay servers..."
-pkill -f "c_relay_" 2>/dev/null
-sleep 2  # Give time for shutdown

-# Check if port is still bound
-if lsof -i :8888 >/dev/null 2>&1; then
-    echo "Port 8888 still in use, force killing..."
-    fuser -k 8888/tcp 2>/dev/null || echo "No process on port 8888"
+# Get all relay processes and kill them immediately with -9
+RELAY_PIDS=$(pgrep -f "c_relay_" || echo "")
+if [ -n "$RELAY_PIDS" ]; then
+    echo "Force killing relay processes immediately: $RELAY_PIDS"
+    kill -9 $RELAY_PIDS 2>/dev/null
+else
+    echo "No existing relay processes found"
 fi

-# Get any remaining processes
-REMAINING_PIDS=$(pgrep -f "c_relay_" || echo "")
-if [ -n "$REMAINING_PIDS" ]; then
-    echo "Force killing remaining processes: $REMAINING_PIDS"
-    kill -9 $REMAINING_PIDS 2>/dev/null
+# Ensure port 8888 is completely free with retry loop
+echo "Ensuring port 8888 is available..."
+for attempt in {1..15}; do
+    if ! lsof -i :8888 >/dev/null 2>&1; then
+        echo "Port 8888 is now free"
+        break
+    fi
+    
+    echo "Attempt $attempt: Port 8888 still in use, force killing..."
+    # Kill anything using port 8888
+    fuser -k 8888/tcp 2>/dev/null || true
+    
+    # Double-check for any remaining relay processes
+    REMAINING_PIDS=$(pgrep -f "c_relay_" || echo "")
+    if [ -n "$REMAINING_PIDS" ]; then
+        echo "Killing remaining relay processes: $REMAINING_PIDS"
+        kill -9 $REMAINING_PIDS 2>/dev/null || true
+    fi
+    
+    sleep 2
+    
+    if [ $attempt -eq 15 ]; then
+        echo "ERROR: Could not free port 8888 after 15 attempts"
+        echo "Current processes using port:"
+        lsof -i :8888 2>/dev/null || echo "No process details available"
+        echo "You may need to manually kill processes or reboot"
+        exit 1
+    fi
+done
+
+# Final safety check - ensure no relay processes remain
+FINAL_PIDS=$(pgrep -f "c_relay_" || echo "")
+if [ -n "$FINAL_PIDS" ]; then
+    echo "Final cleanup: killing processes $FINAL_PIDS"
+    kill -9 $FINAL_PIDS 2>/dev/null || true
    sleep 1
-else
-    echo "No existing relay found"
 fi

 # Clean up PID file
--- a/relay.pid
+++ b/relay.pid
@@ -1 +1 @@
-134045
+652192
--- a/src/config.c
+++ b/src/config.c
--- a/src/config.h
+++ b/src/config.h
@@ -4,6 +4,10 @@
 #include <sqlite3.h>
 #include <cjson/cJSON.h>
 #include <time.h>
+#include <pthread.h>
+
+// Forward declaration for WebSocket support
+struct lws;

 // Configuration constants
 #define CONFIG_VALUE_MAX_LENGTH 1024
@@ -23,14 +27,71 @@
 // Database path for event-based config
 extern char g_database_path[512];

-// Configuration manager structure
+// Unified configuration cache structure (consolidates all caching systems)
 typedef struct {
-    sqlite3* db;
-    char relay_pubkey[65];
+    // Critical keys (frequently accessed)
    char admin_pubkey[65];
-    time_t last_config_check;
-    char config_file_path[512];  // Temporary for compatibility
-} config_manager_t;
+    char relay_pubkey[65];
+    
+    // Auth config (from request_validator)
+    int auth_required;
+    long max_file_size;
+    int admin_enabled;
+    int nip42_mode;
+    int nip42_challenge_timeout;
+    int nip42_time_tolerance;
+    
+    // Static buffer for config values (replaces static buffers in get_config_value functions)
+    char temp_buffer[CONFIG_VALUE_MAX_LENGTH];
+    
+    // NIP-11 relay information (migrated from g_relay_info in main.c)
+    struct {
+        char name[RELAY_NAME_MAX_LENGTH];
+        char description[RELAY_DESCRIPTION_MAX_LENGTH];
+        char banner[RELAY_URL_MAX_LENGTH];
+        char icon[RELAY_URL_MAX_LENGTH];
+        char pubkey[RELAY_PUBKEY_MAX_LENGTH];
+        char contact[RELAY_CONTACT_MAX_LENGTH];
+        char software[RELAY_URL_MAX_LENGTH];
+        char version[64];
+        char privacy_policy[RELAY_URL_MAX_LENGTH];
+        char terms_of_service[RELAY_URL_MAX_LENGTH];
+        cJSON* supported_nips;
+        cJSON* limitation;
+        cJSON* retention;
+        cJSON* relay_countries;
+        cJSON* language_tags;
+        cJSON* tags;
+        char posting_policy[RELAY_URL_MAX_LENGTH];
+        cJSON* fees;
+        char payments_url[RELAY_URL_MAX_LENGTH];
+    } relay_info;
+    
+    // NIP-13 PoW configuration (migrated from g_pow_config in main.c)
+    struct {
+        int enabled;
+        int min_pow_difficulty;
+        int validation_flags;
+        int require_nonce_tag;
+        int reject_lower_targets;
+        int strict_format;
+        int anti_spam_mode;
+    } pow_config;
+    
+    // NIP-40 Expiration configuration (migrated from g_expiration_config in main.c)
+    struct {
+        int enabled;
+        int strict_mode;
+        int filter_responses;
+        int delete_expired;
+        long grace_period;
+    } expiration_config;
+    
+    // Cache management
+    time_t cache_expires;
+    int cache_valid;
+    pthread_mutex_t cache_lock;
+} unified_config_cache_t;

 // Command line options structure for first-time startup
 typedef struct {
@@ -39,8 +100,8 @@ typedef struct {
    char relay_privkey_override[65];  // Empty string = not set, 64-char hex = override
 } cli_options_t;

-// Global configuration manager
-extern config_manager_t g_config_manager;
+// Global unified configuration cache
+extern unified_config_cache_t g_unified_cache;

 // Core configuration functions (temporary compatibility)
 int init_configuration_system(const char* config_dir_override, const char* config_file_override);
@@ -100,11 +161,22 @@ int set_config_value_in_table(const char* key, const char* value, const char* da
                              const char* description, const char* category, int requires_restart);
 int update_config_in_table(const char* key, const char* value);
 int populate_default_config_values(void);
+int add_pubkeys_to_config_table(void);

-// Admin event processing functions
-int process_admin_event_in_config(cJSON* event, char* error_message, size_t error_size);
+// Admin event processing functions (updated with WebSocket support)
+int process_admin_event_in_config(cJSON* event, char* error_message, size_t error_size, struct lws* wsi);
 int process_admin_config_event(cJSON* event, char* error_message, size_t error_size);
-int process_admin_auth_event(cJSON* event, char* error_message, size_t error_size);
+int process_admin_auth_event(cJSON* event, char* error_message, size_t error_size, struct lws* wsi);
+
+// Unified Kind 23456 handler functions
+int handle_kind_23456_unified(cJSON* event, char* error_message, size_t error_size, struct lws* wsi);
+int handle_auth_query_unified(cJSON* event, const char* query_type, char* error_message, size_t error_size, struct lws* wsi);
+int handle_system_command_unified(cJSON* event, const char* command, char* error_message, size_t error_size, struct lws* wsi);
+int handle_auth_rule_modification_unified(cJSON* event, char* error_message, size_t error_size, struct lws* wsi);
+
+// Admin response functions
+int send_admin_response_event(const cJSON* response_data, const char* recipient_pubkey, struct lws* wsi);
+cJSON* build_query_response(const char* query_type, cJSON* results_array, int total_count);

 // Auth rules management functions
 int add_auth_rule_from_config(const char* rule_type, const char* pattern_type,
@@ -112,7 +184,10 @@ int add_auth_rule_from_config(const char* rule_type, const char* pattern_type,
 int remove_auth_rule_from_config(const char* rule_type, const char* pattern_type,
                                const char* pattern_value);

-// Configuration cache management
+// Unified configuration cache management
+void force_config_cache_refresh(void);
+const char* get_admin_pubkey_cached(void);
+const char* get_relay_pubkey_cached(void);
 void invalidate_config_cache(void);
 int reload_config_from_table(void);

@@ -129,4 +204,10 @@ int populate_config_table_from_event(const cJSON* event);
 int process_startup_config_event(const cJSON* event);
 int process_startup_config_event_with_fallback(const cJSON* event);

+// Dynamic event generation functions for WebSocket configuration fetching
+cJSON* generate_config_event_from_table(void);
+int req_filter_requests_config_events(const cJSON* filter);
+cJSON* generate_synthetic_config_event_for_subscription(const char* sub_id, const cJSON* filters);
+char* generate_config_event_json(void);
+
 #endif /* CONFIG_H */
--- a/src/main.c
+++ b/src/main.c
--- a/src/request_validator.c
+++ b/src/request_validator.c
@@ -132,24 +132,11 @@ typedef struct {
  int time_tolerance_seconds;
 } nip42_challenge_manager_t;

-// Cached configuration structure
-typedef struct {
-  int auth_required;           // Whether authentication is required
-  long max_file_size;          // Maximum file size in bytes
-  int admin_enabled;           // Whether admin interface is enabled
-  char admin_pubkey[65];       // Admin public key
-  int nip42_mode;              // NIP-42 authentication mode
-  int nip42_challenge_timeout; // NIP-42 challenge timeout in seconds
-  int nip42_time_tolerance;    // NIP-42 time tolerance in seconds
-  time_t cache_expires;        // When cache expires
-  int cache_valid;             // Whether cache is valid
-} auth_config_cache_t;
-
 //=============================================================================
 // GLOBAL STATE
 //=============================================================================

-static auth_config_cache_t g_auth_cache = {0};
+// No longer using local auth cache - using unified cache from config.c
 static nip42_challenge_manager_t g_challenge_manager = {0};
 static int g_validator_initialized = 0;

@@ -222,15 +209,15 @@ int ginxsom_request_validator_init(const char *db_path, const char *app_name) {
    return result;
  }

-  // Initialize NIP-42 challenge manager
+  // Initialize NIP-42 challenge manager using unified config
  memset(&g_challenge_manager, 0, sizeof(g_challenge_manager));
-  g_challenge_manager.timeout_seconds =
-      g_auth_cache.nip42_challenge_timeout > 0
-          ? g_auth_cache.nip42_challenge_timeout
-          : 600;
-  g_challenge_manager.time_tolerance_seconds =
-      g_auth_cache.nip42_time_tolerance > 0 ? g_auth_cache.nip42_time_tolerance
-                                            : 300;
+  
+  const char* nip42_timeout = get_config_value("nip42_challenge_timeout");
+  g_challenge_manager.timeout_seconds = nip42_timeout ? atoi(nip42_timeout) : 600;
+  
+  const char* nip42_tolerance = get_config_value("nip42_time_tolerance");
+  g_challenge_manager.time_tolerance_seconds = nip42_tolerance ? atoi(nip42_tolerance) : 300;
+  
  g_challenge_manager.last_cleanup = time(NULL);

  g_validator_initialized = 1;
@@ -243,12 +230,15 @@ int ginxsom_request_validator_init(const char *db_path, const char *app_name) {
 * Check if authentication rules are enabled
 */
 int nostr_auth_rules_enabled(void) {
-  // Reload config if cache expired
-  if (!g_auth_cache.cache_valid || time(NULL) > g_auth_cache.cache_expires) {
-    reload_auth_config();
+  // Use unified cache from config.c
+  const char* auth_enabled = get_config_value("auth_enabled");
+  if (auth_enabled && strcmp(auth_enabled, "true") == 0) {
+    return 1;
  }
-
-  return g_auth_cache.auth_required;
+  
+  // Also check legacy key
+  const char* auth_rules_enabled = get_config_value("auth_rules_enabled");
+  return (auth_rules_enabled && strcmp(auth_rules_enabled, "true") == 0) ? 1 : 0;
 }

 ///////////////////////////////////////////////////////////////////////////////////////
@@ -306,14 +296,12 @@ int nostr_validate_unified_request(const char* json_string, size_t json_length)

  int event_kind = (int)cJSON_GetNumberValue(kind);
  
-  // 5. Reload config if needed
-  if (!g_auth_cache.cache_valid || time(NULL) > g_auth_cache.cache_expires) {
-    reload_auth_config();
-  }
+  // 5. Check configuration using unified cache
+  int auth_required = nostr_auth_rules_enabled();
  
  char config_msg[256];
  sprintf(config_msg, "VALIDATOR_DEBUG: STEP 5 PASSED - Event kind: %d, auth_required: %d\n",
-          event_kind, g_auth_cache.auth_required);
+          event_kind, auth_required);
  validator_debug_log(config_msg);

  /////////////////////////////////////////////////////////////////////
@@ -352,7 +340,9 @@ int nostr_validate_unified_request(const char* json_string, size_t json_length)
  if (event_kind == 22242) {
    validator_debug_log("VALIDATOR_DEBUG: STEP 8 - Processing NIP-42 challenge response\n");
    
-    if (g_auth_cache.nip42_mode == 0) {
+    // Check NIP-42 mode using unified cache
+    const char* nip42_enabled = get_config_value("nip42_auth_enabled");
+    if (nip42_enabled && strcmp(nip42_enabled, "false") == 0) {
      validator_debug_log("VALIDATOR_DEBUG: STEP 8 FAILED - NIP-42 is disabled\n");
      cJSON_Delete(event);
      return NOSTR_ERROR_NIP42_DISABLED;
@@ -370,7 +360,7 @@ int nostr_validate_unified_request(const char* json_string, size_t json_length)
  /////////////////////////////////////////////////////////////////////

  // 9. Check if authentication rules are enabled
-  if (!g_auth_cache.auth_required) {
+  if (!auth_required) {
    validator_debug_log("VALIDATOR_DEBUG: STEP 9 - Authentication disabled, skipping database auth rules\n");
  } else {
    // 10. Check database authentication rules (only if auth enabled)
@@ -404,17 +394,23 @@ int nostr_validate_unified_request(const char* json_string, size_t json_length)
  /////////////////////////////////////////////////////////////////////

  // 11. NIP-13 Proof of Work validation
-  if (g_pow_config.enabled && g_pow_config.min_pow_difficulty > 0) {
+  pthread_mutex_lock(&g_unified_cache.cache_lock);
+  int pow_enabled = g_unified_cache.pow_config.enabled;
+  int pow_min_difficulty = g_unified_cache.pow_config.min_pow_difficulty;
+  int pow_validation_flags = g_unified_cache.pow_config.validation_flags;
+  pthread_mutex_unlock(&g_unified_cache.cache_lock);
+  
+  if (pow_enabled && pow_min_difficulty > 0) {
    validator_debug_log("VALIDATOR_DEBUG: STEP 11 - Validating NIP-13 Proof of Work\n");
    
    nostr_pow_result_t pow_result;
-    int pow_validation_result = nostr_validate_pow(event, g_pow_config.min_pow_difficulty,
-                                                   g_pow_config.validation_flags, &pow_result);
+    int pow_validation_result = nostr_validate_pow(event, pow_min_difficulty,
+                                                   pow_validation_flags, &pow_result);
    
    if (pow_validation_result != NOSTR_SUCCESS) {
      char pow_msg[256];
      sprintf(pow_msg, "VALIDATOR_DEBUG: STEP 11 FAILED - PoW validation failed (error=%d, difficulty=%d/%d)\n",
-              pow_validation_result, pow_result.actual_difficulty, g_pow_config.min_pow_difficulty);
+              pow_validation_result, pow_result.actual_difficulty, pow_min_difficulty);
      validator_debug_log(pow_msg);
      cJSON_Delete(event);
      return pow_validation_result;
@@ -553,7 +549,6 @@ void nostr_request_validator_clear_violation(void) {
 */
 void ginxsom_request_validator_cleanup(void) {
  g_validator_initialized = 0;
-  memset(&g_auth_cache, 0, sizeof(g_auth_cache));
  nostr_request_validator_clear_violation();
 }

@@ -573,145 +568,22 @@ void nostr_request_result_free_file_data(nostr_request_result_t *result) {
 // HELPER FUNCTIONS
 //=============================================================================

-/**
- * Get cache timeout from environment variable or default
- */
-static int get_cache_timeout(void) {
-  char *no_cache = getenv("GINX_NO_CACHE");
-  char *cache_timeout = getenv("GINX_CACHE_TIMEOUT");
-
-  if (no_cache && strcmp(no_cache, "1") == 0) {
-    return 0; // No caching
-  }
-
-  if (cache_timeout) {
-    int timeout = atoi(cache_timeout);
-    return (timeout >= 0) ? timeout : 300; // Use provided value or default
-  }
-
-  return 300; // Default 5 minutes
-}

 /**
- * Force cache refresh - invalidates current cache
+ * Force cache refresh - use unified cache system
 */
 void nostr_request_validator_force_cache_refresh(void) {
-  g_auth_cache.cache_valid = 0;
-  g_auth_cache.cache_expires = 0;
-  validator_debug_log("VALIDATOR: Cache forcibly invalidated\n");
+  // Use unified cache refresh from config.c
+  force_config_cache_refresh();
+  validator_debug_log("VALIDATOR: Cache forcibly invalidated via unified cache\n");
 }

 /**
- * Reload authentication configuration from unified config table
+ * This function is no longer needed - configuration is handled by unified cache
 */
 static int reload_auth_config(void) {
-  sqlite3 *db = NULL;
-  sqlite3_stmt *stmt = NULL;
-  int rc;
-
-  // Clear cache
-  memset(&g_auth_cache, 0, sizeof(g_auth_cache));
-
-  // Open database using global database path
-  if (strlen(g_database_path) == 0) {
-    validator_debug_log("VALIDATOR: No database path available\n");
-    // Use defaults
-    g_auth_cache.auth_required = 0;
-    g_auth_cache.max_file_size = 104857600; // 100MB
-    g_auth_cache.admin_enabled = 0;
-    g_auth_cache.nip42_mode = 1; // Optional
-    int cache_timeout = get_cache_timeout();
-    g_auth_cache.cache_expires = time(NULL) + cache_timeout;
-    g_auth_cache.cache_valid = 1;
-    return NOSTR_SUCCESS;
-  }
-  
-  rc = sqlite3_open_v2(g_database_path, &db, SQLITE_OPEN_READONLY, NULL);
-  if (rc != SQLITE_OK) {
-    validator_debug_log("VALIDATOR: Could not open database\n");
-    // Use defaults
-    g_auth_cache.auth_required = 0;
-    g_auth_cache.max_file_size = 104857600; // 100MB
-    g_auth_cache.admin_enabled = 0;
-    g_auth_cache.nip42_mode = 1; // Optional
-    int cache_timeout = get_cache_timeout();
-    g_auth_cache.cache_expires = time(NULL) + cache_timeout;
-    g_auth_cache.cache_valid = 1;
-    return NOSTR_SUCCESS;
-  }
-
-  // Load configuration values from unified config table
-  const char *config_sql =
-      "SELECT key, value FROM config WHERE key IN ('require_auth', "
-      "'auth_rules_enabled', 'max_file_size', 'admin_enabled', 'admin_pubkey', "
-      "'nip42_require_auth', 'nip42_challenge_timeout', "
-      "'nip42_time_tolerance')";
-  rc = sqlite3_prepare_v2(db, config_sql, -1, &stmt, NULL);
-
-  if (rc == SQLITE_OK) {
-    while (sqlite3_step(stmt) == SQLITE_ROW) {
-      const char *key = (const char *)sqlite3_column_text(stmt, 0);
-      const char *value = (const char *)sqlite3_column_text(stmt, 1);
-
-      if (!key || !value)
-        continue;
-
-      if (strcmp(key, "require_auth") == 0) {
-        g_auth_cache.auth_required = (strcmp(value, "true") == 0) ? 1 : 0;
-      } else if (strcmp(key, "auth_rules_enabled") == 0) {
-        // Override auth_required with auth_rules_enabled if present (higher
-        // priority)
-        g_auth_cache.auth_required = (strcmp(value, "true") == 0) ? 1 : 0;
-      } else if (strcmp(key, "max_file_size") == 0) {
-        g_auth_cache.max_file_size = atol(value);
-      } else if (strcmp(key, "admin_enabled") == 0) {
-        g_auth_cache.admin_enabled = (strcmp(value, "true") == 0) ? 1 : 0;
-      } else if (strcmp(key, "admin_pubkey") == 0) {
-        strncpy(g_auth_cache.admin_pubkey, value,
-                sizeof(g_auth_cache.admin_pubkey) - 1);
-      } else if (strcmp(key, "nip42_require_auth") == 0) {
-        if (strcmp(value, "false") == 0) {
-          g_auth_cache.nip42_mode = 0; // Disabled
-        } else if (strcmp(value, "required") == 0) {
-          g_auth_cache.nip42_mode = 2; // Required
-        } else if (strcmp(value, "true") == 0) {
-          g_auth_cache.nip42_mode = 1; // Optional/Enabled
-        } else {
-          g_auth_cache.nip42_mode = 1; // Default to Optional/Enabled
-        }
-      } else if (strcmp(key, "nip42_challenge_timeout") == 0) {
-        g_auth_cache.nip42_challenge_timeout = atoi(value);
-      } else if (strcmp(key, "nip42_time_tolerance") == 0) {
-        g_auth_cache.nip42_time_tolerance = atoi(value);
-      }
-    }
-    sqlite3_finalize(stmt);
-  }
-
-  sqlite3_close(db);
-
-  // Set cache expiration with environment variable support
-  int cache_timeout = get_cache_timeout();
-  g_auth_cache.cache_expires = time(NULL) + cache_timeout;
-  g_auth_cache.cache_valid = 1;
-
-  // Set defaults for missing values
-  if (g_auth_cache.max_file_size == 0) {
-    g_auth_cache.max_file_size = 104857600; // 100MB
-  }
-
-  // Debug logging
-  fprintf(stderr,
-          "VALIDATOR: Configuration loaded from unified config table - "
-          "auth_required: %d, max_file_size: %ld, nip42_mode: %d, "
-          "cache_timeout: %d\n",
-          g_auth_cache.auth_required, g_auth_cache.max_file_size,
-          g_auth_cache.nip42_mode, cache_timeout);
-  fprintf(stderr,
-          "VALIDATOR: NIP-42 mode details - nip42_mode=%d (0=disabled, "
-          "1=optional/enabled, 2=required)\n",
-          g_auth_cache.nip42_mode);
-
+  // Configuration is now handled by the unified cache in config.c
+  validator_debug_log("VALIDATOR: Using unified cache system for configuration\n");
  return NOSTR_SUCCESS;
 }

@@ -757,28 +629,26 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,

  // Step 1: Check pubkey blacklist (highest priority)
  const char *blacklist_sql =
-      "SELECT rule_type, description FROM auth_rules WHERE rule_type = "
-      "'pubkey_blacklist' AND rule_target = ? AND operation = ? AND enabled = "
-      "1 ORDER BY priority LIMIT 1";
+      "SELECT rule_type, action FROM auth_rules WHERE rule_type = "
+      "'blacklist' AND pattern_type = 'pubkey' AND pattern_value = ? LIMIT 1";
  rc = sqlite3_prepare_v2(db, blacklist_sql, -1, &stmt, NULL);
  if (rc == SQLITE_OK) {
    sqlite3_bind_text(stmt, 1, pubkey, -1, SQLITE_STATIC);
-    sqlite3_bind_text(stmt, 2, operation ? operation : "", -1, SQLITE_STATIC);

    if (sqlite3_step(stmt) == SQLITE_ROW) {
-      const char *description = (const char *)sqlite3_column_text(stmt, 1);
+      const char *action = (const char *)sqlite3_column_text(stmt, 1);
      validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 1 FAILED - "
                          "Pubkey blacklisted\n");
      char blacklist_msg[256];
      sprintf(blacklist_msg,
-              "VALIDATOR_DEBUG: RULES ENGINE - Blacklist rule matched: %s\n",
-              description ? description : "Unknown");
+              "VALIDATOR_DEBUG: RULES ENGINE - Blacklist rule matched: action=%s\n",
+              action ? action : "deny");
      validator_debug_log(blacklist_msg);

      // Set specific violation details for status code mapping
      strcpy(g_last_rule_violation.violation_type, "pubkey_blacklist");
-      sprintf(g_last_rule_violation.reason, "%s: Public key blacklisted",
-              description ? description : "TEST_PUBKEY_BLACKLIST");
+      sprintf(g_last_rule_violation.reason, "Public key blacklisted: %s",
+              action ? action : "PUBKEY_BLACKLIST");

      sqlite3_finalize(stmt);
      sqlite3_close(db);
@@ -792,29 +662,27 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,
  // Step 2: Check hash blacklist
  if (resource_hash) {
    const char *hash_blacklist_sql =
-        "SELECT rule_type, description FROM auth_rules WHERE rule_type = "
-        "'hash_blacklist' AND rule_target = ? AND operation = ? AND enabled = "
-        "1 ORDER BY priority LIMIT 1";
+        "SELECT rule_type, action FROM auth_rules WHERE rule_type = "
+        "'blacklist' AND pattern_type = 'hash' AND pattern_value = ? LIMIT 1";
    rc = sqlite3_prepare_v2(db, hash_blacklist_sql, -1, &stmt, NULL);
    if (rc == SQLITE_OK) {
      sqlite3_bind_text(stmt, 1, resource_hash, -1, SQLITE_STATIC);
-      sqlite3_bind_text(stmt, 2, operation ? operation : "", -1, SQLITE_STATIC);

      if (sqlite3_step(stmt) == SQLITE_ROW) {
-        const char *description = (const char *)sqlite3_column_text(stmt, 1);
+        const char *action = (const char *)sqlite3_column_text(stmt, 1);
        validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 2 FAILED - "
                            "Hash blacklisted\n");
        char hash_blacklist_msg[256];
        sprintf(
            hash_blacklist_msg,
-            "VALIDATOR_DEBUG: RULES ENGINE - Hash blacklist rule matched: %s\n",
-            description ? description : "Unknown");
+            "VALIDATOR_DEBUG: RULES ENGINE - Hash blacklist rule matched: action=%s\n",
+            action ? action : "deny");
        validator_debug_log(hash_blacklist_msg);

        // Set specific violation details for status code mapping
        strcpy(g_last_rule_violation.violation_type, "hash_blacklist");
-        sprintf(g_last_rule_violation.reason, "%s: File hash blacklisted",
-                description ? description : "TEST_HASH_BLACKLIST");
+        sprintf(g_last_rule_violation.reason, "File hash blacklisted: %s",
+                action ? action : "HASH_BLACKLIST");

        sqlite3_finalize(stmt);
        sqlite3_close(db);
@@ -831,22 +699,20 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,

  // Step 3: Check pubkey whitelist
  const char *whitelist_sql =
-      "SELECT rule_type, description FROM auth_rules WHERE rule_type = "
-      "'pubkey_whitelist' AND rule_target = ? AND operation = ? AND enabled = "
-      "1 ORDER BY priority LIMIT 1";
+      "SELECT rule_type, action FROM auth_rules WHERE rule_type = "
+      "'whitelist' AND pattern_type = 'pubkey' AND pattern_value = ? LIMIT 1";
  rc = sqlite3_prepare_v2(db, whitelist_sql, -1, &stmt, NULL);
  if (rc == SQLITE_OK) {
    sqlite3_bind_text(stmt, 1, pubkey, -1, SQLITE_STATIC);
-    sqlite3_bind_text(stmt, 2, operation ? operation : "", -1, SQLITE_STATIC);

    if (sqlite3_step(stmt) == SQLITE_ROW) {
-      const char *description = (const char *)sqlite3_column_text(stmt, 1);
+      const char *action = (const char *)sqlite3_column_text(stmt, 1);
      validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 3 PASSED - "
                          "Pubkey whitelisted\n");
      char whitelist_msg[256];
      sprintf(whitelist_msg,
-              "VALIDATOR_DEBUG: RULES ENGINE - Whitelist rule matched: %s\n",
-              description ? description : "Unknown");
+              "VALIDATOR_DEBUG: RULES ENGINE - Whitelist rule matched: action=%s\n",
+              action ? action : "allow");
      validator_debug_log(whitelist_msg);
      sqlite3_finalize(stmt);
      sqlite3_close(db);
@@ -859,12 +725,10 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,

  // Step 4: Check if any whitelist rules exist - if yes, deny by default
  const char *whitelist_exists_sql =
-      "SELECT COUNT(*) FROM auth_rules WHERE rule_type = 'pubkey_whitelist' "
-      "AND operation = ? AND enabled = 1 LIMIT 1";
+      "SELECT COUNT(*) FROM auth_rules WHERE rule_type = 'whitelist' "
+      "AND pattern_type = 'pubkey' LIMIT 1";
  rc = sqlite3_prepare_v2(db, whitelist_exists_sql, -1, &stmt, NULL);
  if (rc == SQLITE_OK) {
-    sqlite3_bind_text(stmt, 1, operation ? operation : "", -1, SQLITE_STATIC);
-
    if (sqlite3_step(stmt) == SQLITE_ROW) {
      int whitelist_count = sqlite3_column_int(stmt, 0);
      if (whitelist_count > 0) {
--- a/tests/nip42_test.log
+++ b/tests/nip42_test.log
@@ -1,93 +0,0 @@
-=== NIP-42 Authentication Test Started ===
-2025-09-13 08:48:02 - Starting NIP-42 authentication tests
-[34m[1m[INFO][0m === Starting NIP-42 Authentication Tests ===
-[34m[1m[INFO][0m Checking dependencies...
-[32m[1m[SUCCESS][0m Dependencies check complete
-[34m[1m[INFO][0m Test 1: Checking NIP-42 support in relay info
-[32m[1m[SUCCESS][0m NIP-42 is advertised in supported NIPs
-2025-09-13 08:48:02 - Supported NIPs: 1,9,11,13,15,20,40,42
-[34m[1m[INFO][0m Test 2: Testing AUTH challenge generation
-[34m[1m[INFO][0m Found admin private key, configuring NIP-42 authentication...
-[33m[1m[WARNING][0m Failed to create configuration event - proceeding with manual test
-[34m[1m[INFO][0m Test 3: Testing complete NIP-42 authentication flow
-[34m[1m[INFO][0m Generated test keypair: test_pubkey
-[34m[1m[INFO][0m Attempting to publish event without authentication...
-[34m[1m[INFO][0m Publishing test event to relay...
-2025-09-13 08:48:03 - Event publish result: connecting to ws://localhost:8888... ok.
-{"kind":1,"id":"c42a8cbdd1cc6ea3e7fd060919c57386aef0c35da272ba2fa34b45f80934cfca","pubkey":"d0111448b3bd0da6aa699b92163f684291bb43bc213aa54a2ee726c2acde76e8","created_at":1757767683,"tags":[],"content":"NIP-42 test event - should require auth","sig":"d2a2c7efc00e06d8d8582fa05b2ec8cb96979525770dff9ef36a91df6d53807c86115581de2d6058d7d64eebe3b7d7404cc03dbb2ad1e91d140283703c2dec53"}
-publishing to ws://localhost:8888... success.
-[32m[1m[SUCCESS][0m Relay requested authentication as expected
-[34m[1m[INFO][0m Test 4: Testing WebSocket AUTH message handling
-[34m[1m[INFO][0m Testing WebSocket connection and AUTH message...
-[34m[1m[INFO][0m Sending test message via WebSocket...
-2025-09-13 08:48:03 - WebSocket response: 
-[34m[1m[INFO][0m No AUTH challenge in WebSocket response
-[34m[1m[INFO][0m Test 5: Testing NIP-42 configuration options
-[34m[1m[INFO][0m Retrieving current relay configuration...
-[32m[1m[SUCCESS][0m Retrieved configuration events from relay
-[32m[1m[SUCCESS][0m Found NIP-42 configuration:
-2025-09-13 08:48:04 -   nip42_auth_required_events=false
-2025-09-13 08:48:04 -   nip42_auth_required_subscriptions=false
-2025-09-13 08:48:04 -   nip42_auth_required_kinds=4,14
-2025-09-13 08:48:04 -   nip42_challenge_expiration=600
-[34m[1m[INFO][0m Test 6: Testing NIP-42 performance and stability
-[34m[1m[INFO][0m Testing multiple authentication attempts...
-2025-09-13 08:48:05 - Attempt 1: .271641300s - connecting to ws://localhost:8888... ok.
-{"kind":1,"id":"916049dbd6835443e8fd553bd12a37ef03060a01fedb099b414ea2cc18b597eb","pubkey":"b383f405d81860ec9b0eebf88612093ab18dc6abd322639b19ac79969599c8c4","created_at":1757767685,"tags":[],"content":"Performance test event 1","sig":"b04e0b38bbb49e0aa3c8a69530071bb08d917c4ba12eae38045a487c43e83f6dc1389ac4640453b0492d9c991df37f71e25ef501fd48c4c11c878e6cb3fa7a84"}
-publishing to ws://localhost:8888... success.
-2025-09-13 08:48:05 - Attempt 2: .259343520s - connecting to ws://localhost:8888... ok.
-{"kind":1,"id":"e4495a56ec6f1ba2759eabbf0128aec615c53acf3e4720be7726dcd7163da703","pubkey":"b383f405d81860ec9b0eebf88612093ab18dc6abd322639b19ac79969599c8c4","created_at":1757767685,"tags":[],"content":"Performance test event 2","sig":"d1efe3f576eeded4e292ec22f2fea12296fa17ed2f87a8cd2dde0444b594ef55f7d74b680aeca11295a16397df5ccc53a938533947aece27efb965e6c643b62c"}
-publishing to ws://localhost:8888... success.
-2025-09-13 08:48:06 - Attempt 3: .221167032s - connecting to ws://localhost:8888... ok.
-{"kind":1,"id":"55035b4c95a2c93a169236c7f5f5bd627838ec13522c88cf82d8b55516560cd9","pubkey":"b383f405d81860ec9b0eebf88612093ab18dc6abd322639b19ac79969599c8c4","created_at":1757767686,"tags":[],"content":"Performance test event 3","sig":"4bd581580a5a2416e6a9af44c055333635832dbf21793517f16100f1366c73437659545a8a712dcc4623a801b9deccd372b36b658309e7102a4300c3f481facb"}
-publishing to ws://localhost:8888... success.
-2025-09-13 08:48:06 - Attempt 4: .260219496s - connecting to ws://localhost:8888... ok.
-{"kind":1,"id":"58dee587a1a0f085ff44441b3074f5ff42715088ee24e694107100df3c63ff2b","pubkey":"b383f405d81860ec9b0eebf88612093ab18dc6abd322639b19ac79969599c8c4","created_at":1757767686,"tags":[],"content":"Performance test event 4","sig":"b6174b0c56138466d3bb228ef2ced1d917f7253b76c624235fa3b661c9fa109c78ae557c4ddaf0e6232aa597608916f0dfba1c192f8b90ffb819c36ac1e4e516"}
-publishing to ws://localhost:8888... success.
-2025-09-13 08:48:07 - Attempt 5: .260125188s - connecting to ws://localhost:8888... ok.
-{"kind":1,"id":"b8069c80f98fff3780eaeb605baf1a5818c9ab05185c1776a28469d2b0b32c6a","pubkey":"b383f405d81860ec9b0eebf88612093ab18dc6abd322639b19ac79969599c8c4","created_at":1757767687,"tags":[],"content":"Performance test event 5","sig":"5130d3a0c778728747b12aae77f2516db5b055d8ec43f413a4b117fcadb6025a49b6f602307bbe758bd97557e326e8735631fd03dc45c9296509e94aa305adf2"}
-publishing to ws://localhost:8888... success.
-[32m[1m[SUCCESS][0m Performance test completed: 5/5 successful responses
-[34m[1m[INFO][0m Test 7: Testing kind-specific NIP-42 authentication requirements
-[34m[1m[INFO][0m Generated test keypair for kind-specific tests: test_pubkey
-[34m[1m[INFO][0m Testing kind 1 event (regular note) - should work without authentication...
-2025-09-13 08:48:08 - Kind 1 event result: connecting to ws://localhost:8888... ok.
-{"kind":1,"id":"f2ac02a5290db3797c0b7b38435920d5db593d333e582454d8ed32da4c141b74","pubkey":"da031504ff61656d1829f723c52f526d7591400fb9e2aecb7b4ef5aeeea66fc7","created_at":1757767688,"tags":[],"content":"Regular note - should not require auth","sig":"8e4272d9cb258fc4b140eb8e8c2e802c3e8b62e34c17c9e545d83c68dfb86ffd2cdd4a8153660b663a46906459aa67719257ac263f21d1f8a6185806e055dcfd"}
-publishing to ws://localhost:8888... success.
-[32m[1m[SUCCESS][0m Kind 1 event accepted without authentication (correct behavior)
-[34m[1m[INFO][0m Testing kind 4 event (direct message) - should require authentication...
-2025-09-13 08:48:18 - Kind 4 event result: connecting to ws://localhost:8888... ok.
-{"kind":4,"id":"935af23e2bf7efd324d86a0c82631e5ebe492edf21920ed0f548faa73a18ac1d","pubkey":"da031504ff61656d1829f723c52f526d7591400fb9e2aecb7b4ef5aeeea66fc7","created_at":1757767688,"tags":[["p,test_pubkey"]],"content":"This is a direct message - should require auth","sig":"b2b86ee394b41505ddbd787c22f4223665770d84a21dd03e74bf4e8fa879ff82dd6b1f7d6921d93f8d89787102c3dc3012e6270d66ca5b5d4b87f1a545481e76"}
-publishing to ws://localhost:8888... 
-[32m[1m[SUCCESS][0m Kind 4 event requested authentication (correct behavior for DMs)
-[34m[1m[INFO][0m Testing kind 14 event (chat message) - should require authentication...
-2025-09-13 08:48:28 - Kind 14 event result: connecting to ws://localhost:8888... ok.
-{"kind":14,"id":"aeb1ac58dd465c90ce5a70c7b16e3cc32fae86c221bb2e86ca29934333604669","pubkey":"da031504ff61656d1829f723c52f526d7591400fb9e2aecb7b4ef5aeeea66fc7","created_at":1757767698,"tags":[["p,test_pubkey"]],"content":"Chat message - should require auth","sig":"24e23737e6684e4ef01c08d72304e6f235ce75875b94b37460065f9ead986438435585818ba104e7f78f14345406b5d03605c925042e9c06fed8c99369cd8694"}
-publishing to ws://localhost:8888... 
-[32m[1m[SUCCESS][0m Kind 14 event requested authentication (correct behavior for DMs)
-[34m[1m[INFO][0m Testing other event kinds - should work without authentication...
-2025-09-13 08:48:29 - Kind 0 event result: connecting to ws://localhost:8888... ok.
-{"kind":0,"id":"3b2cc834dd874ebbe07c2da9e41c07b3f0c61a57b4d6b7299c2243dbad29f2ca","pubkey":"da031504ff61656d1829f723c52f526d7591400fb9e2aecb7b4ef5aeeea66fc7","created_at":1757767709,"tags":[],"content":"Test event kind 0 - should not require auth","sig":"4f2016fde84d72cf5a5aa4c0ec5de677ef06c7971ca2dd756b02a94c47604fae1c67254703a2df3d17b13fee2d9c45661b76086f29ac93820a4c062fc52dea74"}
-publishing to ws://localhost:8888... success.
-[32m[1m[SUCCESS][0m Kind 0 event accepted without authentication (correct)
-2025-09-13 08:48:29 - Kind 3 event result: connecting to ws://localhost:8888... ok.
-{"kind":3,"id":"6e1ea0b1cbf342feea030fa39226c316e730c5d333fa8333495748afd386ec80","pubkey":"da031504ff61656d1829f723c52f526d7591400fb9e2aecb7b4ef5aeeea66fc7","created_at":1757767709,"tags":[],"content":"Test event kind 3 - should not require auth","sig":"e5f66c5f022497f8888f003a8bfbb5e807a2520d314c80889548efa267f9d6de28d5ee7b0588cc8660f2963ab44e530c8a74d71a227148e5a6843fcef4de2197"}
-publishing to ws://localhost:8888... success.
-[32m[1m[SUCCESS][0m Kind 3 event accepted without authentication (correct)
-2025-09-13 08:48:30 - Kind 7 event result: connecting to ws://localhost:8888... ok.
-{"kind":7,"id":"a64466b9899cad257313e2dced357fd3f87f40bd7e13e29372689aae7c718919","pubkey":"da031504ff61656d1829f723c52f526d7591400fb9e2aecb7b4ef5aeeea66fc7","created_at":1757767710,"tags":[],"content":"Test event kind 7 - should not require auth","sig":"78d18bcb0c2b11b4e2b74bcdfb140564b4563945e983014a279977356e50b57f3c5a262fa55de26dbd4c8d8b9f5beafbe21af869be64079f54a712284f03d9ac"}
-publishing to ws://localhost:8888... success.
-[32m[1m[SUCCESS][0m Kind 7 event accepted without authentication (correct)
-[34m[1m[INFO][0m Kind-specific authentication test completed
-[34m[1m[INFO][0m === NIP-42 Test Results Summary ===
-[32m[1m[SUCCESS][0m Dependencies: PASS
-[32m[1m[SUCCESS][0m NIP-42 Support: PASS
-[32m[1m[SUCCESS][0m Auth Challenge: PASS
-[32m[1m[SUCCESS][0m Auth Flow: PASS
-[32m[1m[SUCCESS][0m WebSocket AUTH: PASS
-[32m[1m[SUCCESS][0m Configuration: PASS
-[32m[1m[SUCCESS][0m Performance: PASS
-[32m[1m[SUCCESS][0m Kind-Specific Auth: PASS
-[32m[1m[SUCCESS][0m All NIP-42 tests completed successfully!
-[32m[1m[SUCCESS][0m NIP-42 authentication implementation is working correctly
-[34m[1m[INFO][0m === NIP-42 Authentication Tests Complete ===
--- a/tests/white_black_list_test.sh
+++ b/tests/white_black_list_test.sh
Author	SHA1	Message	Date
Your Name	c1c05991cf	v0.3.14 - I think the admin api is finally working	2025-09-27 14:08:45 -04:00
Your Name	ab378e14d1	v0.3.13 - Working on admin system	2025-09-27 13:32:21 -04:00
Your Name	c0f9bf9ef5	v0.3.12 - Working through auth still	2025-09-25 17:33:38 -04:00
Your Name	bc6a7b3f20	Working on API	2025-09-25 16:35:16 -04:00
Your Name	036b0823b9	v0.3.11 - Working on admin api	2025-09-25 11:25:50 -04:00
Your Name	be99595bde	v0.3.10 - .	2025-09-24 10:49:48 -04:00
Your Name	01836a4b4c	v0.3.9 - API work	2025-09-21 15:53:03 -04:00
Your Name	9f3b3dd773	v0.3.8 - safety push	2025-09-18 10:18:15 -04:00