v1.2.25 - Add NIP-42 AUTH support to web UI: onauth callback in subscribeMany and publish calls

v1.2.24 - Fix: run ip_ban maintenance unconditionally every 60s regardless of max_connection_seconds setting
v1.2.23 - ip_ban: retain ban_count for 24 hours after last ban expiry, then fully clean entry
2026-02-23 18:03:29 -04:00 · 2026-02-23 17:57:20 -04:00 · 2026-02-23 17:16:02 -04:00 · 2026-02-23 17:12:15 -04:00 · 2026-02-23 16:26:23 -04:00 · 2026-02-23 16:02:07 -04:00
25 changed files with 1001 additions and 224 deletions
@@ -121,7 +121,7 @@ RUN if [ "$DEBUG_BUILD" = "true" ]; then \
    -Inostr_core_lib/cjson -Inostr_core_lib/nostr_websocket \
    src/main.c src/config.c src/dm_admin.c src/request_validator.c \
    src/nip009.c src/nip011.c src/nip013.c src/nip040.c src/nip042.c \
-    src/websockets.c src/subscriptions.c src/api.c src/embedded_web_content.c \
+    src/websockets.c src/subscriptions.c src/api.c src/embedded_web_content.c src/ip_ban.c \
    -o /build/c_relay_static \
    c_utils_lib/libc_utils.a \
    nostr_core_lib/libnostr_core_x64.a \
@@ -9,7 +9,7 @@ LIBS = -lsqlite3 -lwebsockets -lz -ldl -lpthread -lm -L/usr/local/lib -lsecp256k
 BUILD_DIR = build

 # Source files
-MAIN_SRC = src/main.c src/config.c src/dm_admin.c src/request_validator.c src/nip009.c src/nip011.c src/nip013.c src/nip040.c src/nip042.c src/websockets.c src/subscriptions.c src/api.c src/embedded_web_content.c
+MAIN_SRC = src/main.c src/config.c src/dm_admin.c src/request_validator.c src/nip009.c src/nip011.c src/nip013.c src/nip040.c src/nip042.c src/websockets.c src/subscriptions.c src/api.c src/embedded_web_content.c src/ip_ban.c
 NOSTR_CORE_LIB = nostr_core_lib/libnostr_core_x64.a
 C_UTILS_LIB = c_utils_lib/libc_utils.a

@@ -288,8 +288,8 @@ AUTH RULES MANAGEMENT
        <!-- Auth Rule Input Section -->
        <div id="authRuleInputSections" style="display: block;">
            <div class="input-group">
-                <label for="authRulePubkey">Pubkey (nsec or hex):</label>
-                <input type="text" id="authRulePubkey" placeholder="nsec1... or 64-character hex pubkey">
+                <label for="authRulePubkey">Public Key (npub or hex):</label>
+                <input type="text" id="authRulePubkey" placeholder="npub1... or 64-character hex pubkey">
            </div>
            <div id="whitelistWarning" class="warning-box" style="display: none;">
                <strong>⚠️ WARNING:</strong> Adding whitelist rules changes relay behavior to whitelist-only
@@ -523,16 +523,28 @@ async function verifyAdminAccess() {
    // Show a loading indicator while verifying
    showAdminVerificationLoading();

-    // Send system_status command to verify admin access
+    // Send system_status command to verify admin access.
+    // Under heavy relay load the publish OK may time out even though the relay
+    // received the event — so we catch the error and still wait for the response.
    try {
        await sendAdminCommand(['system_command', 'system_status']);
        console.log('Admin verification command sent');
    } catch (error) {
        console.error('Failed to send admin verification command:', error);
-        // Continue with timeout - the command might have been queued
+        // Under heavy load the relay may not send OK in time but still processes
+        // the event. Continue waiting for the response subscription to fire.
+        console.log('Continuing to wait for admin response despite publish error...');
    }

-    // Set timeout for admin verification (5 seconds)
+    // Update status message after 5 seconds to indicate relay is under load
+    setTimeout(() => {
+        const statusEl = document.getElementById('admin-verify-status');
+        if (statusEl && pendingAdminVerification) {
+            statusEl.textContent = 'Relay is under heavy load — still waiting for response...';
+        }
+    }, 5000);
+
+    // Final timeout: 60 seconds — if no response by then, deny access
    adminVerificationTimeout = setTimeout(() => {
        if (pendingAdminVerification) {
            console.log('⛔ Admin verification timeout - user is not admin');
@@ -541,7 +553,7 @@ async function verifyAdminAccess() {
            hideAdminVerificationLoading();
            showAccessDeniedOverlay();
        }
-    }, 5000);
+    }, 60000);
 }

 // Show loading indicator while verifying admin access
@@ -556,7 +568,7 @@ function showAdminVerificationLoading() {
            <div class="admin-verification-content">
                <div class="spinner"></div>
                <h3>Verifying Administrator Access...</h3>
-                <p>Please wait while we verify your admin privileges.</p>
+                <p id="admin-verify-status">Waiting for response from relay...</p>
            </div>
        `;
        document.body.appendChild(loadingOverlay);
@@ -1326,6 +1338,23 @@ async function subscribeToConfiguration() {
                    console.log('No configuration events were received');
                }
            },
+            async onauth(challenge) {
+                // NIP-42 authentication: relay sent AUTH challenge, sign and respond
+                console.log('🔐 NIP-42 AUTH challenge received:', challenge);
+                try {
+                    if (!window.nostr) {
+                        console.error('NIP-42 auth required but no nostr extension available');
+                        return;
+                    }
+                    const url = relayConnectionUrl.value.trim();
+                    const authEvent = window.NostrTools.nip42.makeAuthEvent(url, challenge);
+                    const signedAuthEvent = await window.nostr.signEvent(authEvent);
+                    console.log('✅ NIP-42 AUTH event signed, responding to challenge');
+                    return signedAuthEvent;
+                } catch (authError) {
+                    console.error('NIP-42 AUTH failed:', authError.message);
+                }
+            },
            onclose(reason) {
                console.log('Subscription closed:', reason);
                // Reset subscription state to allow re-subscription
@@ -1847,11 +1876,12 @@ function handleSystemCommandResponse(responseData) {
    console.log('Command:', responseData.command);
    console.log('Status:', responseData.status);

-    // Handle admin verification via system_status response
-    if (responseData.command === 'system_status' && pendingAdminVerification) {
+    // Handle admin verification via system_status response.
+    // Also handle late responses that arrive after the timeout fired (relay was under load).
+    if (responseData.command === 'system_status' && (pendingAdminVerification || (isLoggedIn && !isAdminVerified))) {
        console.log('✅ Admin verification successful - received system_status response');
        
-        // Clear the timeout
+        // Clear the timeout if still pending
        if (adminVerificationTimeout) {
            clearTimeout(adminVerificationTimeout);
            adminVerificationTimeout = null;
@@ -1860,8 +1890,9 @@ function handleSystemCommandResponse(responseData) {
        pendingAdminVerification = false;
        isAdminVerified = true;
        
-        // Hide loading overlay
+        // Hide loading overlay and access denied overlay (in case timeout already showed it)
        hideAdminVerificationLoading();
+        hideAccessDeniedOverlay();
        
        // Show admin sections now that we're verified
        updateAdminSectionsVisibility();
@@ -3154,7 +3185,7 @@ function addBlacklistRule() {
    // Convert nsec or npub to hex if needed
    const hexPubkey = nsecToHex(inputValue);
    if (!hexPubkey) {
-        log('Invalid pubkey format. Please enter nsec1..., npub1..., or 64-character hex', 'ERROR');
+        log('Invalid public key format. Please enter npub1... or 64-character hex pubkey', 'ERROR');
        return;
    }

@@ -3206,7 +3237,7 @@ function addWhitelistRule() {
    // Convert nsec or npub to hex if needed
    const hexPubkey = nsecToHex(inputValue);
    if (!hexPubkey) {
-        log('Invalid pubkey format. Please enter nsec1..., npub1..., or 64-character hex', 'ERROR');
+        log('Invalid public key format. Please enter npub1... or 64-character hex pubkey', 'ERROR');
        return;
    }

@@ -5453,9 +5484,21 @@ async function sendAdminCommand(commandArray) {
      throw new Error('Event signing failed');
    }

-    // Publish via SimplePool with detailed error diagnostics
+    // Publish via SimplePool with NIP-42 auth support
    const url = relayConnectionUrl.value.trim();
-    const publishPromises = relayPool.publish([url], signedEvent);
+    const publishPromises = relayPool.publish([url], signedEvent, {
+        async onauth(challenge) {
+            console.log('🔐 NIP-42 AUTH challenge during publish:', challenge);
+            try {
+                const authEvent = window.NostrTools.nip42.makeAuthEvent(url, challenge);
+                const signedAuthEvent = await window.nostr.signEvent(authEvent);
+                console.log('✅ NIP-42 AUTH signed for publish');
+                return signedAuthEvent;
+            } catch (authError) {
+                console.error('NIP-42 AUTH failed during publish:', authError.message);
+            }
+        }
+    });

    // Use Promise.allSettled to capture per-relay outcomes
    const results = await Promise.allSettled(publishPromises);
@@ -77,6 +77,11 @@ case "$ARCH" in
        ;;
 esac

+# Append _debug suffix to output name for debug builds so production binary is never overwritten
+if [ "$DEBUG_BUILD" = true ]; then
+    OUTPUT_NAME="${OUTPUT_NAME}_debug"
+fi
+
 echo "Building for platform: $PLATFORM"
 echo "Output binary: $OUTPUT_NAME"
 echo ""
@@ -0,0 +1,122 @@
+#!/bin/bash
+
+# C-Relay Debug Binary Deployment Script
+# Deploys build/c_relay_static_x86_64_debug to server for CPU profiling
+#
+# Usage:
+#   ./deploy_lt_debug.sh           -- deploy debug binary and restart
+#   ./deploy_lt_debug.sh --profile -- deploy, then run perf and fetch results
+#
+# After deploying, profile with:
+#   sudo perf record -g -p $(pgrep c_relay) -- sleep 30
+#   sudo perf report --stdio --sort=symbol --no-children -n 2>/dev/null | head -80
+#
+# Restore production binary:
+#   ./deploy_lt.sh
+
+set -e
+
+LOCAL_DEBUG_BINARY="build/c_relay_static_x86_64_debug"
+REMOTE_BINARY_PATH="/usr/local/bin/c_relay/c_relay"
+REMOTE_PROD_BACKUP="/usr/local/bin/c_relay/c_relay.production"
+SERVICE_NAME="c-relay"
+REMOTE_HOST="ubuntu@laantungir.com"
+
+# Check debug binary exists
+if [ ! -f "$LOCAL_DEBUG_BINARY" ]; then
+    echo "ERROR: Debug binary not found: $LOCAL_DEBUG_BINARY"
+    echo ""
+    echo "Build it first with:"
+    echo "  ./build_static.sh --debug"
+    echo ""
+    exit 1
+fi
+
+echo "=========================================="
+echo "C-Relay Debug Deployment"
+echo "=========================================="
+echo "Binary: $LOCAL_DEBUG_BINARY ($(du -h "$LOCAL_DEBUG_BINARY" | cut -f1))"
+echo "Target: $REMOTE_HOST:$REMOTE_BINARY_PATH"
+echo ""
+echo "WARNING: Debug binary has symbols and is larger than production."
+echo "         It is safe to run but should not be left deployed long-term."
+echo ""
+
+# Backup production binary (only if not already backed up)
+echo "Backing up production binary..."
+ssh "$REMOTE_HOST" "
+    if [ ! -f '$REMOTE_PROD_BACKUP' ]; then
+        sudo cp '$REMOTE_BINARY_PATH' '$REMOTE_PROD_BACKUP'
+        echo 'Production binary backed up to $REMOTE_PROD_BACKUP'
+    else
+        echo 'Production backup already exists, skipping'
+    fi
+"
+
+# Upload debug binary
+echo "Uploading debug binary..."
+scp "$LOCAL_DEBUG_BINARY" "$REMOTE_HOST:/tmp/c_relay_debug.tmp"
+
+# Install debug binary
+echo "Installing debug binary..."
+ssh "$REMOTE_HOST" "
+    sudo mv '/tmp/c_relay_debug.tmp' '$REMOTE_BINARY_PATH'
+    sudo chown c-relay:c-relay '$REMOTE_BINARY_PATH'
+    sudo chmod +x '$REMOTE_BINARY_PATH'
+"
+
+# Restart service
+echo "Restarting c-relay service..."
+ssh "$REMOTE_HOST" "sudo systemctl daemon-reload && sudo systemctl restart '$SERVICE_NAME'"
+
+echo ""
+echo "✓ Debug binary deployed and service restarted"
+echo ""
+
+# If --profile flag, run perf automatically
+if [ "$1" = "--profile" ]; then
+    echo "=========================================="
+    echo "Running perf profile (30 seconds)..."
+    echo "=========================================="
+    echo ""
+    
+    # Wait for relay to start
+    sleep 3
+    
+    ssh "$REMOTE_HOST" "
+        PID=\$(pgrep c_relay)
+        if [ -z \"\$PID\" ]; then
+            echo 'ERROR: c_relay not running'
+            exit 1
+        fi
+        echo \"Profiling PID \$PID for 30 seconds...\"
+        sudo perf record -g -p \$PID -- sleep 30
+        echo ''
+        echo '=== TOP FUNCTIONS BY CPU ==='
+        sudo perf report --stdio --sort=symbol --no-children -n 2>/dev/null | head -60
+    "
+else
+    echo "=========================================="
+    echo "Next Steps: Profile the relay"
+    echo "=========================================="
+    echo ""
+    echo "SSH to server and run:"
+    echo "  sudo perf record -g -p \$(pgrep c_relay) -- sleep 30"
+    echo "  sudo perf report --stdio --sort=symbol --no-children -n 2>/dev/null | head -60"
+    echo ""
+    echo "Or run with --profile to do it automatically:"
+    echo "  ./deploy_lt_debug.sh --profile"
+fi
+
+echo ""
+echo "=========================================="
+echo "Restore Production Binary When Done"
+echo "=========================================="
+echo ""
+echo "Run this to restore the production binary:"
+echo "  ./deploy_lt.sh"
+echo ""
+echo "Or manually on the server:"
+echo "  sudo cp '$REMOTE_PROD_BACKUP' '$REMOTE_BINARY_PATH'"
+echo "  sudo systemctl restart $SERVICE_NAME"
+echo ""
@@ -1 +1 @@
-1950899
+2039374
@@ -499,10 +499,10 @@ int generate_monitoring_event_for_type(const char* d_tag_value, cJSON* (*query_f
    // Use the library function to create and sign the event
    cJSON* signed_event = nostr_create_and_sign_event(
        24567,                              // kind (ephemeral)
-        cJSON_GetStringValue(cJSON_GetObjectItem(monitoring_event, "content")), // content
+        cJSON_GetStringValue(cJSON_GetObjectItemCaseSensitive(monitoring_event, "content")), // content
        tags,                               // tags
        relay_privkey,                      // private key
-        (time_t)cJSON_GetNumberValue(cJSON_GetObjectItem(monitoring_event, "created_at")) // timestamp
+        (time_t)cJSON_GetNumberValue(cJSON_GetObjectItemCaseSensitive(monitoring_event, "created_at")) // timestamp
    );

    if (!signed_event) {
@@ -922,10 +922,10 @@ int send_admin_response(const char* sender_pubkey, const char* response_content,
    // Use the library function to create and sign the event
    cJSON* signed_event = nostr_create_and_sign_event(
        23457,                              // kind
-        cJSON_GetStringValue(cJSON_GetObjectItem(response_event, "content")), // content
+        cJSON_GetStringValue(cJSON_GetObjectItemCaseSensitive(response_event, "content")), // content
        tags,                               // tags
        relay_privkey,                      // private key
-        (time_t)cJSON_GetNumberValue(cJSON_GetObjectItem(response_event, "created_at")) // timestamp
+        (time_t)cJSON_GetNumberValue(cJSON_GetObjectItemCaseSensitive(response_event, "created_at")) // timestamp
    );

    if (!signed_event) {
@@ -1169,7 +1169,7 @@ int handle_sql_query_unified(cJSON* event, const char* query, char* error_messag
    }

    // Get request event ID for response correlation
-    cJSON* request_id_obj = cJSON_GetObjectItem(event, "id");
+    cJSON* request_id_obj = cJSON_GetObjectItemCaseSensitive(event, "id");
    if (!request_id_obj || !cJSON_IsString(request_id_obj)) {
        snprintf(error_message, error_size, "Missing request event ID");
        return -1;
@@ -1188,7 +1188,7 @@ int handle_sql_query_unified(cJSON* event, const char* query, char* error_messag
    }

    // Get sender pubkey for response
-    cJSON* sender_pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    cJSON* sender_pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
    if (!sender_pubkey_obj || !cJSON_IsString(sender_pubkey_obj)) {
        free(result_json);
        snprintf(error_message, error_size, "Missing sender pubkey");
@@ -1491,7 +1491,7 @@ int send_nip17_response(const char* sender_pubkey, const char* response_content,
    }

    // Fix the p tag in the gift wrap - library function may use wrong pubkey
-    cJSON* gift_wrap_tags = cJSON_GetObjectItem(gift_wraps[0], "tags");
+    cJSON* gift_wrap_tags = cJSON_GetObjectItemCaseSensitive(gift_wraps[0], "tags");
    if (gift_wrap_tags && cJSON_IsArray(gift_wrap_tags)) {
        // Find and replace the p tag with the correct user pubkey
        cJSON* tag = NULL;
@@ -1627,13 +1627,13 @@ char* generate_stats_text(void) {

    if (stats_obj) {
        // Extract basic metrics
-        cJSON* total_events = cJSON_GetObjectItem(stats_obj, "total_events");
-        cJSON* db_size = cJSON_GetObjectItem(stats_obj, "database_size_bytes");
-        cJSON* oldest_event = cJSON_GetObjectItem(stats_obj, "database_created_at");
-        cJSON* newest_event = cJSON_GetObjectItem(stats_obj, "latest_event_at");
-        cJSON* time_stats = cJSON_GetObjectItem(stats_obj, "time_stats");
-        cJSON* event_kinds = cJSON_GetObjectItem(stats_obj, "event_kinds");
-        // cJSON* top_pubkeys = cJSON_GetObjectItem(stats_obj, "top_pubkeys");
+        cJSON* total_events = cJSON_GetObjectItemCaseSensitive(stats_obj, "total_events");
+        cJSON* db_size = cJSON_GetObjectItemCaseSensitive(stats_obj, "database_size_bytes");
+        cJSON* oldest_event = cJSON_GetObjectItemCaseSensitive(stats_obj, "database_created_at");
+        cJSON* newest_event = cJSON_GetObjectItemCaseSensitive(stats_obj, "latest_event_at");
+        cJSON* time_stats = cJSON_GetObjectItemCaseSensitive(stats_obj, "time_stats");
+        cJSON* event_kinds = cJSON_GetObjectItemCaseSensitive(stats_obj, "event_kinds");
+        // cJSON* top_pubkeys = cJSON_GetObjectItemCaseSensitive(stats_obj, "top_pubkeys");

        long long total = total_events ? (long long)cJSON_GetNumberValue(total_events) : 0;
        long long db_bytes = db_size ? (long long)cJSON_GetNumberValue(db_size) : 0;
@@ -1661,9 +1661,9 @@ char* generate_stats_text(void) {
        // Extract time-based stats
        long long last_24h = 0, last_7d = 0, last_30d = 0;
        if (time_stats) {
-            cJSON* h24 = cJSON_GetObjectItem(time_stats, "last_24h");
-            cJSON* d7 = cJSON_GetObjectItem(time_stats, "last_7d");
-            cJSON* d30 = cJSON_GetObjectItem(time_stats, "last_30d");
+            cJSON* h24 = cJSON_GetObjectItemCaseSensitive(time_stats, "last_24h");
+            cJSON* d7 = cJSON_GetObjectItemCaseSensitive(time_stats, "last_7d");
+            cJSON* d30 = cJSON_GetObjectItemCaseSensitive(time_stats, "last_30d");
            last_24h = h24 ? (long long)cJSON_GetNumberValue(h24) : 0;
            last_7d = d7 ? (long long)cJSON_GetNumberValue(d7) : 0;
            last_30d = d30 ? (long long)cJSON_GetNumberValue(d30) : 0;
@@ -1695,9 +1695,9 @@ char* generate_stats_text(void) {
        if (event_kinds && cJSON_IsArray(event_kinds)) {
            cJSON* kind_item = NULL;
            cJSON_ArrayForEach(kind_item, event_kinds) {
-                cJSON* kind = cJSON_GetObjectItem(kind_item, "kind");
-                cJSON* count = cJSON_GetObjectItem(kind_item, "count");
-                cJSON* percentage = cJSON_GetObjectItem(kind_item, "percentage");
+                cJSON* kind = cJSON_GetObjectItemCaseSensitive(kind_item, "kind");
+                cJSON* count = cJSON_GetObjectItemCaseSensitive(kind_item, "count");
+                cJSON* percentage = cJSON_GetObjectItemCaseSensitive(kind_item, "percentage");

                if (kind && count && percentage) {
                    // Format event kind (right-justified, minimum 5 chars wide with underscores)
@@ -1767,9 +1767,9 @@ char* generate_stats_text(void) {
        //     int rank = 1;
        //     cJSON* pubkey_item = NULL;
        //     cJSON_ArrayForEach(pubkey_item, top_pubkeys) {
-        //         cJSON* pubkey = cJSON_GetObjectItem(pubkey_item, "pubkey");
-        //         cJSON* event_count = cJSON_GetObjectItem(pubkey_item, "event_count");
-        //         cJSON* percentage = cJSON_GetObjectItem(pubkey_item, "percentage");
+        //         cJSON* pubkey = cJSON_GetObjectItemCaseSensitive(pubkey_item, "pubkey");
+        //         cJSON* event_count = cJSON_GetObjectItemCaseSensitive(pubkey_item, "event_count");
+        //         cJSON* percentage = cJSON_GetObjectItemCaseSensitive(pubkey_item, "percentage");

        //         if (pubkey && event_count && percentage) {
        //             const char* pubkey_str = cJSON_GetStringValue(pubkey);
@@ -2457,7 +2457,7 @@ int handle_create_relay_event_command(cJSON* event, int kind, cJSON* event_data,
    }

    // Get request event ID for response correlation
-    cJSON* request_id_obj = cJSON_GetObjectItem(event, "id");
+    cJSON* request_id_obj = cJSON_GetObjectItemCaseSensitive(event, "id");
    if (!request_id_obj || !cJSON_IsString(request_id_obj)) {
        snprintf(error_message, error_size, "Missing request event ID");
        return -1;
@@ -2465,7 +2465,7 @@ int handle_create_relay_event_command(cJSON* event, int kind, cJSON* event_data,
    const char* request_id = cJSON_GetStringValue(request_id_obj);

    // Get sender pubkey for response
-    cJSON* sender_pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    cJSON* sender_pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
    if (!sender_pubkey_obj || !cJSON_IsString(sender_pubkey_obj)) {
        snprintf(error_message, error_size, "Missing sender pubkey");
        return -1;
@@ -2614,7 +2614,7 @@ cJSON* create_relay_dm_list_event(cJSON* dm_relays) {
    }

    // Extract relays array
-    cJSON* relays_array = cJSON_GetObjectItem(dm_relays, "relays");
+    cJSON* relays_array = cJSON_GetObjectItemCaseSensitive(dm_relays, "relays");
    if (relays_array && cJSON_IsArray(relays_array)) {
        cJSON* relay_item = NULL;
        cJSON_ArrayForEach(relay_item, relays_array) {
@@ -2686,14 +2686,14 @@ cJSON* create_relay_list_event(cJSON* relays) {
    }

    // Extract relays array
-    cJSON* relays_array = cJSON_GetObjectItem(relays, "relays");
+    cJSON* relays_array = cJSON_GetObjectItemCaseSensitive(relays, "relays");
    if (relays_array && cJSON_IsArray(relays_array)) {
        cJSON* relay_item = NULL;
        cJSON_ArrayForEach(relay_item, relays_array) {
            if (cJSON_IsObject(relay_item)) {
-                cJSON* url = cJSON_GetObjectItem(relay_item, "url");
-                cJSON* read = cJSON_GetObjectItem(relay_item, "read");
-                cJSON* write = cJSON_GetObjectItem(relay_item, "write");
+                cJSON* url = cJSON_GetObjectItemCaseSensitive(relay_item, "url");
+                cJSON* read = cJSON_GetObjectItemCaseSensitive(relay_item, "read");
+                cJSON* write = cJSON_GetObjectItemCaseSensitive(relay_item, "write");

                if (url && cJSON_IsString(url)) {
                    const char* relay_url = cJSON_GetStringValue(url);
@@ -2752,7 +2752,7 @@ int handle_monitoring_command(cJSON* event, const char* command, char* error_mes
    }

    // Get request event ID for response correlation
-    cJSON* request_id_obj = cJSON_GetObjectItem(event, "id");
+    cJSON* request_id_obj = cJSON_GetObjectItemCaseSensitive(event, "id");
    if (!request_id_obj || !cJSON_IsString(request_id_obj)) {
        snprintf(error_message, error_size, "Missing request event ID");
        return -1;
@@ -2760,7 +2760,7 @@ int handle_monitoring_command(cJSON* event, const char* command, char* error_mes
    const char* request_id = cJSON_GetStringValue(request_id_obj);

    // Get sender pubkey for response
-    cJSON* sender_pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    cJSON* sender_pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
    if (!sender_pubkey_obj || !cJSON_IsString(sender_pubkey_obj)) {
        snprintf(error_message, error_size, "Missing sender pubkey");
        return -1;
@@ -227,13 +227,13 @@ int store_config_event_in_database(const cJSON* event) {
    }
    
    // Get event fields
-    cJSON* id_obj = cJSON_GetObjectItem(event, "id");
-    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
-    cJSON* created_at_obj = cJSON_GetObjectItem(event, "created_at");
-    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
-    cJSON* content_obj = cJSON_GetObjectItem(event, "content");
-    cJSON* sig_obj = cJSON_GetObjectItem(event, "sig");
-    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    cJSON* id_obj = cJSON_GetObjectItemCaseSensitive(event, "id");
+    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
+    cJSON* created_at_obj = cJSON_GetObjectItemCaseSensitive(event, "created_at");
+    cJSON* kind_obj = cJSON_GetObjectItemCaseSensitive(event, "kind");
+    cJSON* content_obj = cJSON_GetObjectItemCaseSensitive(event, "content");
+    cJSON* sig_obj = cJSON_GetObjectItemCaseSensitive(event, "sig");
+    cJSON* tags_obj = cJSON_GetObjectItemCaseSensitive(event, "tags");
    
    if (!id_obj || !pubkey_obj || !created_at_obj || !kind_obj || !content_obj || !sig_obj || !tags_obj) {
        return -1;
@@ -665,8 +665,8 @@ cJSON* create_default_config_event(const unsigned char* admin_privkey_bytes,
    }
    
    // Log success information
-    cJSON* id_obj = cJSON_GetObjectItem(event, "id");
-    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    cJSON* id_obj = cJSON_GetObjectItemCaseSensitive(event, "id");
+    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
    
    if (id_obj && pubkey_obj) {
        // printf("  Event ID: %s\n", cJSON_GetStringValue(id_obj));
@@ -952,6 +952,33 @@ static int validate_config_field(const char* key, const char* value, char* error
        return 0;
    }

+    // IP auth failure ban settings
+    if (strcmp(key, "auth_fail_ban_enabled") == 0) {
+        if (!is_valid_boolean(value)) {
+            snprintf(error_msg, error_size, "invalid boolean value '%s' for auth_fail_ban_enabled", value);
+            return -1;
+        }
+        return 0;
+    }
+    if (strcmp(key, "auth_fail_ban_threshold") == 0 ||
+        strcmp(key, "auth_fail_window_sec") == 0 ||
+        strcmp(key, "auth_fail_ban_duration_sec") == 0) {
+        if (!is_valid_positive_integer(value)) {
+            snprintf(error_msg, error_size, "invalid value '%s' for %s (must be positive integer)", value, key);
+            return -1;
+        }
+        return 0;
+    }
+
+    // NIP-42 auth timeout
+    if (strcmp(key, "nip42_auth_timeout_sec") == 0) {
+        if (!is_valid_positive_integer(value) && strcmp(value, "0") != 0) {
+            snprintf(error_msg, error_size, "invalid nip42_auth_timeout_sec '%s' (must be non-negative integer)", value);
+            return -1;
+        }
+        return 0;
+    }
+
    // SQLite performance tuning
    if (strcmp(key, "sqlite_mmap_size") == 0) {
        if (!is_valid_positive_integer(value) && strcmp(value, "0") != 0) {
@@ -1273,7 +1300,7 @@ static int validate_configuration_event_fields(const cJSON* event, char* error_m
    }
    
    
-    cJSON* tags = cJSON_GetObjectItem(event, "tags");
+    cJSON* tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
    if (!tags || !cJSON_IsArray(tags)) {
        snprintf(error_msg, error_size, "missing or invalid tags array");
        return -1;
@@ -1337,8 +1364,8 @@ int process_configuration_event(const cJSON* event) {
    }

    // Validate event structure
-    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
-    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    cJSON* kind_obj = cJSON_GetObjectItemCaseSensitive(event, "kind");
+    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
    
    if (!kind_obj || cJSON_GetNumberValue(kind_obj) != 33334) {
        DEBUG_ERROR("Invalid event kind for configuration");
@@ -1412,7 +1439,7 @@ extern void init_relay_info(void);
 static const char* get_config_value_from_event(const cJSON* event, const char* key) {
    if (!event || !key) return NULL;
    
-    cJSON* tags = cJSON_GetObjectItem(event, "tags");
+    cJSON* tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
    if (!tags || !cJSON_IsArray(tags)) return NULL;
    
    cJSON* tag = NULL;
@@ -1957,7 +1984,7 @@ extern int is_authorized_admin_event(cJSON* event);

 // Process admin events (updated for Kind 23456)
 int process_admin_event_in_config(cJSON* event, char* error_message, size_t error_size, struct lws* wsi) {
-    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+    cJSON* kind_obj = cJSON_GetObjectItemCaseSensitive(event, "kind");
    if (!kind_obj || !cJSON_IsNumber(kind_obj)) {
        DEBUG_ERROR("Missing or invalid kind in admin event");
        snprintf(error_message, error_size, "invalid: missing or invalid kind");
@@ -1982,7 +2009,7 @@ int process_admin_event_in_config(cJSON* event, char* error_message, size_t erro
 int process_admin_config_event(cJSON* event, char* error_message, size_t error_size) {

    // Parse tags to find query commands according to API specification
-    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    cJSON* tags_obj = cJSON_GetObjectItemCaseSensitive(event, "tags");
    if (tags_obj && cJSON_IsArray(tags_obj)) {
        cJSON* tag = NULL;
        cJSON_ArrayForEach(tag, tags_obj) {
@@ -2072,7 +2099,7 @@ int process_admin_config_event(cJSON* event, char* error_message, size_t error_s

 // Handle Kind 23456 auth rules management
 int process_admin_auth_event(cJSON* event, char* error_message, size_t error_size, struct lws* wsi) {
-    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+    cJSON* kind_obj = cJSON_GetObjectItemCaseSensitive(event, "kind");
    int kind = kind_obj ? (int)cJSON_GetNumberValue(kind_obj) : 0;

    // Extract and log additional event details for debugging
@@ -2447,7 +2474,7 @@ int wot_sync_from_admin_kind3(void) {
 const char* get_first_tag_name(cJSON* event) {
    if (!event) return NULL;
    
-    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    cJSON* tags_obj = cJSON_GetObjectItemCaseSensitive(event, "tags");
    if (!tags_obj || !cJSON_IsArray(tags_obj)) return NULL;
    
    cJSON* first_tag = cJSON_GetArrayItem(tags_obj, 0);
@@ -2465,7 +2492,7 @@ const char* get_first_tag_name(cJSON* event) {
 const char* get_tag_value(cJSON* event, const char* tag_name, int value_index) {
    if (!event || !tag_name) return NULL;
    
-    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    cJSON* tags_obj = cJSON_GetObjectItemCaseSensitive(event, "tags");
    if (!tags_obj || !cJSON_IsArray(tags_obj)) return NULL;
    
    cJSON* tag = NULL;
@@ -2575,8 +2602,8 @@ cJSON* create_admin_response_event(const char* encrypted_content, const char* re
    }
    
    // Log success information
-    cJSON* id_obj = cJSON_GetObjectItem(response_event, "id");
-    cJSON* pubkey_obj = cJSON_GetObjectItem(response_event, "pubkey");
+    cJSON* id_obj = cJSON_GetObjectItemCaseSensitive(response_event, "id");
+    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(response_event, "pubkey");
    
    if (id_obj && pubkey_obj) {
        // printf("  Event ID: %s\n", cJSON_GetStringValue(id_obj));
@@ -2689,7 +2716,7 @@ int send_admin_response_event(const cJSON* response_data, const char* recipient_
        return -1;
    }
    
-    cJSON* id_obj = cJSON_GetObjectItem(response_event, "id");
+    cJSON* id_obj = cJSON_GetObjectItemCaseSensitive(response_event, "id");
    if (id_obj) {
        // printf("  Event ID: %s\n", cJSON_GetStringValue(id_obj));
    }
@@ -2783,7 +2810,7 @@ int handle_kind_23456_unified(cJSON* event, char* error_message, size_t error_si
    }

    // Verify the event sender is the authorized admin
-    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
    if (!pubkey_obj || !cJSON_IsString(pubkey_obj)) {
        DEBUG_ERROR("invalid: missing sender pubkey in event");
        snprintf(error_message, error_size, "invalid: missing sender pubkey in event");
@@ -2808,7 +2835,7 @@ int handle_kind_23456_unified(cJSON* event, char* error_message, size_t error_si
    }

    // Check if content is encrypted (NIP-44)
-    cJSON* content_obj = cJSON_GetObjectItem(event, "content");
+    cJSON* content_obj = cJSON_GetObjectItemCaseSensitive(event, "content");
    if (!content_obj || !cJSON_IsString(content_obj)) {
        DEBUG_ERROR("invalid: missing or invalid content");
        snprintf(error_message, error_size, "invalid: missing or invalid content");
@@ -2830,7 +2857,7 @@ int handle_kind_23456_unified(cJSON* event, char* error_message, size_t error_si
        }
        
        // Get sender's pubkey from the event for NIP-44 decryption
-        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        if (!pubkey_obj || !cJSON_IsString(pubkey_obj)) {
            DEBUG_ERROR("invalid: missing sender pubkey in event");
            free(relay_privkey);
@@ -2961,7 +2988,7 @@ int handle_kind_23456_unified(cJSON* event, char* error_message, size_t error_si
        }

        // Add existing tags
-        cJSON* existing_tags = cJSON_GetObjectItem(event, "tags");
+        cJSON* existing_tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
        if (existing_tags && cJSON_IsArray(existing_tags)) {
            cJSON* tag = NULL;
            cJSON_ArrayForEach(tag, existing_tags) {
@@ -3149,7 +3176,7 @@ int handle_auth_query_unified(cJSON* event, const char* query_type, char* error_
    cJSON* response = build_query_response(mapped_query_type, results_array, rule_count);
    if (response) {
        // Get admin pubkey from event for response
-        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
        
        if (!admin_pubkey) {
@@ -3264,7 +3291,7 @@ int handle_config_query_unified(cJSON* event, const char* query_type, char* erro
    cJSON* response = build_query_response(mapped_query_type, results_array, config_count);
    if (response) {
        // Get admin pubkey from event for response
-        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
        
        if (!admin_pubkey) {
@@ -3360,7 +3387,7 @@ int handle_config_set_unified(cJSON* event, const char* config_key, const char*
    
    
    // Get admin pubkey from event for response
-    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
    const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
    
    if (!admin_pubkey) {
@@ -3424,7 +3451,7 @@ int handle_system_command_unified(cJSON* event, const char* command, char* error
        
        
        // Get admin pubkey from event for response
-        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
        
        if (!admin_pubkey) {
@@ -3501,7 +3528,7 @@ int handle_system_command_unified(cJSON* event, const char* command, char* error
        
        
        // Get admin pubkey from event for response
-        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
        
        if (!admin_pubkey) {
@@ -3562,7 +3589,7 @@ int handle_system_command_unified(cJSON* event, const char* command, char* error
        printf("Cache status: Not used (direct database queries)\n");

        // Get admin pubkey from event for response
-        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;

        if (!admin_pubkey) {
@@ -3594,7 +3621,7 @@ int handle_system_command_unified(cJSON* event, const char* command, char* error
        printf("Sending acknowledgment and initiating shutdown...\n");

        // Get admin pubkey from event for response
-        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;

        if (!admin_pubkey) {
@@ -3618,7 +3645,7 @@ int handle_system_command_unified(cJSON* event, const char* command, char* error
    }
    else if (strcmp(command, "wot_status") == 0) {
        // Get admin pubkey from event
-        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
        
        if (!admin_pubkey) {
@@ -3676,7 +3703,7 @@ int handle_system_command_unified(cJSON* event, const char* command, char* error
    }
    else if (strcmp(command, "wot_sync") == 0) {
        // Get admin pubkey from event
-        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
        
        if (!admin_pubkey) {
@@ -3738,7 +3765,7 @@ int handle_system_command_unified(cJSON* event, const char* command, char* error
 int handle_auth_rule_modification_unified(cJSON* event, char* error_message, size_t error_size, struct lws* wsi) {
    // Suppress unused parameter warning
    (void)wsi;
-    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    cJSON* tags_obj = cJSON_GetObjectItemCaseSensitive(event, "tags");
    if (!tags_obj || !cJSON_IsArray(tags_obj)) {
        snprintf(error_message, error_size, "invalid: auth rule event must have tags");
        return -1;
@@ -3821,7 +3848,7 @@ int handle_auth_rule_modification_unified(cJSON* event, char* error_message, siz
        printf("Processed %d auth rule modifications\n", rules_processed);
        
        // Get admin pubkey from event for response
-        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
        
        if (!admin_pubkey) {
@@ -3951,7 +3978,7 @@ int handle_stats_query_unified(cJSON* event, char* error_message, size_t error_s


    // Get admin pubkey from event for response
-    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
    const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;

    if (!admin_pubkey) {
@@ -4019,7 +4046,7 @@ int handle_config_update_unified(cJSON* event, char* error_message, size_t error
    
    // Extract config objects array from synthetic tags created by NIP-44 decryption
    // The decryption process creates synthetic tags like: ["config_update", [config_objects]]
-    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    cJSON* tags_obj = cJSON_GetObjectItemCaseSensitive(event, "tags");
    if (!tags_obj || !cJSON_IsArray(tags_obj)) {
        snprintf(error_message, error_size, "invalid: config update event must have tags");
        return -1;
@@ -4100,10 +4127,10 @@ int handle_config_update_unified(cJSON* event, char* error_message, size_t error
        }
        
        // Extract required fields from config object
-        cJSON* key_obj = cJSON_GetObjectItem(config_obj, "key");
-        cJSON* value_obj = cJSON_GetObjectItem(config_obj, "value");
-        cJSON* data_type_obj = cJSON_GetObjectItem(config_obj, "data_type");
-        cJSON* category_obj = cJSON_GetObjectItem(config_obj, "category");
+        cJSON* key_obj = cJSON_GetObjectItemCaseSensitive(config_obj, "key");
+        cJSON* value_obj = cJSON_GetObjectItemCaseSensitive(config_obj, "value");
+        cJSON* data_type_obj = cJSON_GetObjectItemCaseSensitive(config_obj, "data_type");
+        cJSON* category_obj = cJSON_GetObjectItemCaseSensitive(config_obj, "category");
        
        if (!key_obj || !cJSON_IsString(key_obj) ||
            !value_obj || !cJSON_IsString(value_obj)) {
@@ -4300,7 +4327,7 @@ int handle_config_update_unified(cJSON* event, char* error_message, size_t error
        cJSON_AddItemToObject(error_response, "data", processed_configs);
        
        // Get admin pubkey from event for error response
-        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
        
        if (admin_pubkey) {
@@ -4328,7 +4355,7 @@ int handle_config_update_unified(cJSON* event, char* error_message, size_t error
        cJSON_AddItemToObject(error_response, "data", processed_configs);
        
        // Get admin pubkey from event for error response
-        cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
        
        if (admin_pubkey) {
@@ -4357,7 +4384,7 @@ int handle_config_update_unified(cJSON* event, char* error_message, size_t error
    
    
    // Get admin pubkey from event for response
-    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
    const char* admin_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;
    
    if (!admin_pubkey) {
@@ -4763,7 +4790,7 @@ int populate_config_table_from_event(const cJSON* event) {
    
    DEBUG_INFO("Populating config table from configuration event...");
    
-    cJSON* tags = cJSON_GetObjectItem(event, "tags");
+    cJSON* tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
    if (!tags || !cJSON_IsArray(tags)) {
        DEBUG_ERROR("Configuration event missing tags array");
        return -1;
@@ -4912,13 +4939,13 @@ int process_startup_config_event(const cJSON* event) {
    
    
    // Validate event structure first
-    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+    cJSON* kind_obj = cJSON_GetObjectItemCaseSensitive(event, "kind");
    if (!kind_obj || cJSON_GetNumberValue(kind_obj) != 33334) {
        DEBUG_ERROR("Invalid event kind for startup configuration");
        return -1;
    }
    
-    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
+    cJSON* tags_obj = cJSON_GetObjectItemCaseSensitive(event, "tags");
    if (!tags_obj || !cJSON_IsArray(tags_obj)) {
        DEBUG_ERROR("Startup configuration event missing tags");
        return -1;
@@ -5114,7 +5141,7 @@ int req_filter_requests_config_events(const cJSON* filter) {
        return 0;
    }
    
-    cJSON* kinds = cJSON_GetObjectItem(filter, "kinds");
+    cJSON* kinds = cJSON_GetObjectItemCaseSensitive(filter, "kinds");
    if (!kinds || !cJSON_IsArray(kinds)) {
        return 0;
    }
@@ -83,6 +83,18 @@ static const struct {
    // IP-based rate limiting or access control (which would require firewall protection anyway)
    {"trust_proxy_headers", "true"},

+    // IP Auth Failure Ban Settings
+    // Ban IPs that repeatedly fail NIP-42 authentication
+    {"auth_fail_ban_enabled", "true"},
+    {"auth_fail_ban_threshold", "3"},      // failures before ban
+    {"auth_fail_window_sec", "60"},        // window to count failures in
+    {"auth_fail_ban_duration_sec", "300"}, // initial ban duration (doubles each time, max 24h)
+
+    // NIP-42 Authentication Timeout
+    // Seconds after connection before unauthenticated clients are disconnected (0 = disabled)
+    // Prevents unauthenticated connections from accumulating under heavy load
+    {"nip42_auth_timeout_sec", "10"},
+
    // SQLite Performance Tuning
    // mmap_size: bytes of database file to memory-map (0 = disabled, 268435456 = 256MB recommended)
    // Eliminates pread64 syscall overhead for database reads — significant CPU savings under load
@@ -141,7 +141,7 @@ int process_dm_admin_command(cJSON* command_array, cJSON* event, char* error_mes
    cJSON_AddItemToArray(synthetic_tags, command_tag);

    // Add existing event tags
-    cJSON* existing_tags = cJSON_GetObjectItem(event, "tags");
+    cJSON* existing_tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
    if (existing_tags && cJSON_IsArray(existing_tags)) {
        cJSON* tag = NULL;
        cJSON_ArrayForEach(tag, existing_tags) {
@@ -304,7 +304,7 @@ cJSON* process_nip17_admin_message(cJSON* gift_wrap_event, char* error_message,
    // Only create a generic response for other command types that don't handle their own responses
    if (result == 0) {
        // Extract content to check if it's a plain text command
-        cJSON* content_obj = cJSON_GetObjectItem(inner_dm, "content");
+        cJSON* content_obj = cJSON_GetObjectItemCaseSensitive(inner_dm, "content");
        if (content_obj && cJSON_IsString(content_obj)) {
            const char* dm_content = cJSON_GetStringValue(content_obj);
            
@@ -347,7 +347,7 @@ cJSON* process_nip17_admin_message(cJSON* gift_wrap_event, char* error_message,
        return NULL;

        // Get sender pubkey for response from the decrypted DM event
-        cJSON* sender_pubkey_obj = cJSON_GetObjectItem(inner_dm, "pubkey");
+        cJSON* sender_pubkey_obj = cJSON_GetObjectItemCaseSensitive(inner_dm, "pubkey");
        if (sender_pubkey_obj && cJSON_IsString(sender_pubkey_obj)) {
            const char* sender_pubkey = cJSON_GetStringValue(sender_pubkey_obj);

@@ -439,13 +439,13 @@ int is_nip17_gift_wrap_for_relay(cJSON* event) {
    }

    // Check kind
-    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+    cJSON* kind_obj = cJSON_GetObjectItemCaseSensitive(event, "kind");
    if (!kind_obj || !cJSON_IsNumber(kind_obj) || (int)cJSON_GetNumberValue(kind_obj) != 1059) {
        return 0;
    }

    // Check tags for "p" tag with relay pubkey
-    cJSON* tags = cJSON_GetObjectItem(event, "tags");
+    cJSON* tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
    if (!tags || !cJSON_IsArray(tags)) {
        return 0;
    }
@@ -484,7 +484,7 @@ int process_nip17_admin_command(cJSON* dm_event, char* error_message, size_t err
    DEBUG_INFO("DM_ADMIN: Processing NIP-17 admin command from decrypted DM");

    // Extract content from DM
-    cJSON* content_obj = cJSON_GetObjectItem(dm_event, "content");
+    cJSON* content_obj = cJSON_GetObjectItemCaseSensitive(dm_event, "content");
    if (!content_obj || !cJSON_IsString(content_obj)) {
        DEBUG_INFO("DM_ADMIN: DM missing content field");
        strncpy(error_message, "NIP-17: DM missing content", error_size - 1);
@@ -495,7 +495,7 @@ int process_nip17_admin_command(cJSON* dm_event, char* error_message, size_t err
    DEBUG_INFO("DM_ADMIN: Extracted DM content: %.100s%s", dm_content, strlen(dm_content) > 100 ? "..." : "");

    // Check if sender is admin before processing any commands
-    cJSON* sender_pubkey_obj = cJSON_GetObjectItem(dm_event, "pubkey");
+    cJSON* sender_pubkey_obj = cJSON_GetObjectItemCaseSensitive(dm_event, "pubkey");
    if (!sender_pubkey_obj || !cJSON_IsString(sender_pubkey_obj)) {
        DEBUG_INFO("DM_ADMIN: DM missing sender pubkey - treating as user DM");
        return 0; // Not an error, just treat as user DM
@@ -804,7 +804,7 @@ int process_nip17_admin_command(cJSON* dm_event, char* error_message, size_t err
        if (cJSON_IsString(first_item) && strcmp(cJSON_GetStringValue(first_item), "stats") == 0) {
            DEBUG_INFO("DM_ADMIN: Processing JSON stats command");
            // Get sender pubkey for response
-            cJSON* sender_pubkey_obj = cJSON_GetObjectItem(dm_event, "pubkey");
+            cJSON* sender_pubkey_obj = cJSON_GetObjectItemCaseSensitive(dm_event, "pubkey");
            if (!sender_pubkey_obj || !cJSON_IsString(sender_pubkey_obj)) {
                cJSON_Delete(command_array);
                DEBUG_INFO("DM_ADMIN: DM missing sender pubkey for stats command");
@@ -846,13 +846,13 @@ int process_nip17_admin_command(cJSON* dm_event, char* error_message, size_t err
    cJSON_AddStringToObject(synthetic_event, "content", dm_content);

    // Copy pubkey from DM
-    cJSON* pubkey_obj = cJSON_GetObjectItem(dm_event, "pubkey");
+    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(dm_event, "pubkey");
    if (pubkey_obj && cJSON_IsString(pubkey_obj)) {
        cJSON_AddStringToObject(synthetic_event, "pubkey", cJSON_GetStringValue(pubkey_obj));
    }

    // Copy tags from DM
-    cJSON* tags = cJSON_GetObjectItem(dm_event, "tags");
+    cJSON* tags = cJSON_GetObjectItemCaseSensitive(dm_event, "tags");
    if (tags) {
        cJSON_AddItemToObject(synthetic_event, "tags", cJSON_Duplicate(tags, 1));
    }
@@ -0,0 +1,291 @@
+#define _GNU_SOURCE
+#include "ip_ban.h"
+#include "debug.h"
+#include "config.h"
+#include <string.h>
+#include <stdlib.h>
+#include <pthread.h>
+
+// ============================================================
+// IP Auth Failure Ban System
+//
+// Fixed-size open-addressing hash table. No malloc after init.
+// Thread-safe via a single mutex (low contention — only called
+// at connection open/close, not in the hot event path).
+// ============================================================
+
+#define IP_BAN_EMPTY    0   // slot is unused
+#define IP_BAN_ACTIVE   1   // slot has an entry
+
+typedef struct {
+    int state;                  // IP_BAN_EMPTY or IP_BAN_ACTIVE
+    char ip[46];                // IPv4 or IPv6 string
+    int failure_count;          // total failures in current window
+    time_t first_failure;       // start of current failure window
+    time_t banned_until;        // 0 = not banned; >0 = banned until this time
+    int ban_count;              // how many times this IP has been banned (for backoff)
+} ip_ban_entry_t;
+
+static ip_ban_entry_t g_ban_table[IP_BAN_TABLE_SIZE];
+static pthread_mutex_t g_ban_mutex = PTHREAD_MUTEX_INITIALIZER;
+static int g_initialized = 0;
+
+// Simple FNV-1a hash for IP strings
+static unsigned int ip_hash(const char* ip) {
+    unsigned int hash = 2166136261u;
+    while (*ip) {
+        hash ^= (unsigned char)*ip++;
+        hash *= 16777619u;
+    }
+    return hash % IP_BAN_TABLE_SIZE;
+}
+
+// Find slot for IP (open addressing with linear probing)
+// Returns index of existing entry or first empty slot, -1 if table full
+static int find_slot(const char* ip) {
+    unsigned int start = ip_hash(ip);
+    for (unsigned int i = 0; i < IP_BAN_TABLE_SIZE; i++) {
+        unsigned int idx = (start + i) % IP_BAN_TABLE_SIZE;
+        if (g_ban_table[idx].state == IP_BAN_EMPTY) {
+            return (int)idx;  // empty slot — can insert here
+        }
+        if (strcmp(g_ban_table[idx].ip, ip) == 0) {
+            return (int)idx;  // found existing entry
+        }
+    }
+    return -1;  // table full (shouldn't happen with 4096 slots)
+}
+
+void ip_ban_init(void) {
+    pthread_mutex_lock(&g_ban_mutex);
+    memset(g_ban_table, 0, sizeof(g_ban_table));
+    g_initialized = 1;
+    pthread_mutex_unlock(&g_ban_mutex);
+    DEBUG_LOG("IP ban table initialized (%d slots)", IP_BAN_TABLE_SIZE);
+}
+
+int ip_ban_is_banned(const char* ip) {
+    if (!ip || !g_initialized) return 0;
+
+    // Check if feature is enabled
+    if (!get_config_bool("auth_fail_ban_enabled", 1)) return 0;
+
+    pthread_mutex_lock(&g_ban_mutex);
+
+    int idx = find_slot(ip);
+    if (idx < 0 || g_ban_table[idx].state == IP_BAN_EMPTY) {
+        pthread_mutex_unlock(&g_ban_mutex);
+        return 0;  // no entry — not banned
+    }
+
+    ip_ban_entry_t* entry = &g_ban_table[idx];
+    time_t now = time(NULL);
+
+    if (entry->banned_until > 0 && now < entry->banned_until) {
+        pthread_mutex_unlock(&g_ban_mutex);
+        DEBUG_TRACE("IP %s is banned for %ld more seconds", ip, entry->banned_until - now);
+        return 1;  // still banned
+    }
+
+    // Ban expired — clear it but keep the entry for failure tracking
+    if (entry->banned_until > 0 && now >= entry->banned_until) {
+        entry->banned_until = 0;
+        entry->failure_count = 0;
+        entry->first_failure = 0;
+    }
+
+    pthread_mutex_unlock(&g_ban_mutex);
+    return 0;
+}
+
+void ip_ban_record_failure(const char* ip) {
+    if (!ip || !g_initialized) return;
+    if (!get_config_bool("auth_fail_ban_enabled", 1)) return;
+
+    int threshold = get_config_int("auth_fail_ban_threshold", 3);
+    int window_sec = get_config_int("auth_fail_window_sec", 60);
+    int ban_duration = get_config_int("auth_fail_ban_duration_sec", 300);
+
+    pthread_mutex_lock(&g_ban_mutex);
+
+    int idx = find_slot(ip);
+    if (idx < 0) {
+        // Table full — can't track this IP, just log and return
+        DEBUG_WARN("IP ban table full, cannot track %s", ip);
+        pthread_mutex_unlock(&g_ban_mutex);
+        return;
+    }
+
+    ip_ban_entry_t* entry = &g_ban_table[idx];
+    time_t now = time(NULL);
+
+    if (entry->state == IP_BAN_EMPTY) {
+        // New entry
+        entry->state = IP_BAN_ACTIVE;
+        strncpy(entry->ip, ip, sizeof(entry->ip) - 1);
+        entry->ip[sizeof(entry->ip) - 1] = '\0';
+        entry->failure_count = 0;
+        entry->first_failure = now;
+        entry->banned_until = 0;
+        entry->ban_count = 0;
+    }
+
+    // Reset window if it's expired
+    if (entry->first_failure > 0 && (now - entry->first_failure) > window_sec) {
+        entry->failure_count = 0;
+        entry->first_failure = now;
+    }
+
+    entry->failure_count++;
+
+    DEBUG_TRACE("IP %s auth failure count: %d/%d", ip, entry->failure_count, threshold);
+
+    if (entry->failure_count >= threshold) {
+        // Apply exponential backoff: ban_duration * 2^ban_count, capped at 24 hours
+        int duration = ban_duration;
+        for (int i = 0; i < entry->ban_count && duration < 86400; i++) {
+            duration *= 2;
+        }
+        if (duration > 86400) duration = 86400;
+
+        entry->banned_until = now + duration;
+        entry->ban_count++;
+        entry->failure_count = 0;  // reset counter after ban
+        entry->first_failure = 0;
+
+        DEBUG_WARN("IP %s banned for %d seconds (ban #%d) after %d auth failures",
+                   ip, duration, entry->ban_count, threshold);
+    }
+
+    pthread_mutex_unlock(&g_ban_mutex);
+}
+
+void ip_ban_record_success(const char* ip) {
+    if (!ip || !g_initialized) return;
+
+    pthread_mutex_lock(&g_ban_mutex);
+
+    int idx = find_slot(ip);
+    if (idx >= 0 && g_ban_table[idx].state == IP_BAN_ACTIVE) {
+        // Clear failure count on successful auth — reward good behavior
+        g_ban_table[idx].failure_count = 0;
+        g_ban_table[idx].first_failure = 0;
+        // Note: we keep ban_count so backoff persists across sessions
+        DEBUG_TRACE("IP %s authenticated successfully — failure count cleared", ip);
+    }
+
+    pthread_mutex_unlock(&g_ban_mutex);
+}
+
+void ip_ban_cleanup(void) {
+    if (!g_initialized) return;
+
+    pthread_mutex_lock(&g_ban_mutex);
+
+    time_t now = time(NULL);
+    int window_sec = get_config_int("auth_fail_window_sec", 60);
+    int cleaned = 0;
+
+    for (int i = 0; i < IP_BAN_TABLE_SIZE; i++) {
+        if (g_ban_table[i].state != IP_BAN_ACTIVE) continue;
+
+        ip_ban_entry_t* entry = &g_ban_table[i];
+
+        // Clear entries where ban has expired AND failure window has expired AND no recent activity
+        int ban_expired = (entry->banned_until == 0 || now >= entry->banned_until);
+        int window_expired = (entry->first_failure == 0 || (now - entry->first_failure) > window_sec * 10);
+
+        if (ban_expired && window_expired && entry->failure_count == 0) {
+            // Retain ban_count for 24 hours after the last ban expired.
+            // This ensures exponential backoff persists if the IP returns within 24 hours.
+            // After 24 hours of inactivity, fully clean the entry.
+            int retain_sec = 86400; // 24 hours
+            int last_ban_expired_long_ago = (entry->banned_until == 0 ||
+                                             (now - entry->banned_until) > retain_sec);
+
+            if (last_ban_expired_long_ago) {
+                // Fully clean — IP has been gone for 24+ hours, start fresh if it returns
+                memset(entry, 0, sizeof(ip_ban_entry_t));
+                cleaned++;
+            } else {
+                // Keep entry alive but reset transient fields — preserve ban_count
+                entry->failure_count = 0;
+                entry->first_failure = 0;
+                // banned_until and ban_count preserved intentionally
+            }
+        }
+    }
+
+    if (cleaned > 0) {
+        DEBUG_TRACE("IP ban cleanup: freed %d stale entries", cleaned);
+    }
+
+    pthread_mutex_unlock(&g_ban_mutex);
+}
+
+int ip_ban_get_banned_count(void) {
+    if (!g_initialized) return 0;
+
+    pthread_mutex_lock(&g_ban_mutex);
+    time_t now = time(NULL);
+    int count = 0;
+    for (int i = 0; i < IP_BAN_TABLE_SIZE; i++) {
+        if (g_ban_table[i].state == IP_BAN_ACTIVE &&
+            g_ban_table[i].banned_until > now) {
+            count++;
+        }
+    }
+    pthread_mutex_unlock(&g_ban_mutex);
+    return count;
+}
+
+int ip_ban_get_tracked_count(void) {
+    if (!g_initialized) return 0;
+
+    pthread_mutex_lock(&g_ban_mutex);
+    int count = 0;
+    for (int i = 0; i < IP_BAN_TABLE_SIZE; i++) {
+        if (g_ban_table[i].state == IP_BAN_ACTIVE) count++;
+    }
+    pthread_mutex_unlock(&g_ban_mutex);
+    return count;
+}
+
+// Emit a periodic log summary of banned IPs.
+// Call from the connection age checker (runs every ~30s).
+// Only logs when there are active bans or when the interval has elapsed.
+void ip_ban_log_stats(void) {
+    if (!g_initialized) return;
+
+    static time_t last_log = 0;
+    time_t now = time(NULL);
+
+    // Log every 5 minutes
+    if (now - last_log < 300) return;
+    last_log = now;
+
+    pthread_mutex_lock(&g_ban_mutex);
+
+    int banned_count = 0;
+    int tracked_count = 0;
+
+    for (int i = 0; i < IP_BAN_TABLE_SIZE; i++) {
+        if (g_ban_table[i].state != IP_BAN_ACTIVE) continue;
+        tracked_count++;
+        if (g_ban_table[i].banned_until > now) {
+            banned_count++;
+            DEBUG_WARN("IP BAN: %s banned for %ld more seconds (ban #%d, failures: %d)",
+                       g_ban_table[i].ip,
+                       g_ban_table[i].banned_until - now,
+                       g_ban_table[i].ban_count,
+                       g_ban_table[i].failure_count);
+        }
+    }
+
+    pthread_mutex_unlock(&g_ban_mutex);
+
+    if (banned_count > 0 || tracked_count > 0) {
+        DEBUG_WARN("IP BAN SUMMARY: %d IPs currently banned, %d IPs tracked",
+                   banned_count, tracked_count);
+    }
+}
@@ -0,0 +1,48 @@
+#ifndef IP_BAN_H
+#define IP_BAN_H
+
+// IP Auth Failure Ban System
+//
+// Tracks auth failures per IP address and temporarily bans IPs that repeatedly
+// fail NIP-42 authentication. Uses an in-memory fixed-size hash table — no
+// database writes, no root required, no persistent state.
+//
+// Config keys (all read from the config table at runtime):
+//   auth_fail_ban_enabled      bool  default: true   (0 = disabled)
+//   auth_fail_ban_threshold    int   default: 3       (failures before ban)
+//   auth_fail_window_sec       int   default: 60      (window to count failures)
+//   auth_fail_ban_duration_sec int   default: 300     (initial ban duration, doubles each time)
+
+#include <time.h>
+
+// Maximum number of IPs tracked simultaneously (fixed-size, no malloc)
+#define IP_BAN_TABLE_SIZE 4096
+
+// Initialize the IP ban table (call once at startup)
+void ip_ban_init(void);
+
+// Check if an IP is currently banned.
+// Returns 1 if banned (connection should be rejected), 0 if allowed.
+int ip_ban_is_banned(const char* ip);
+
+// Record an auth failure for an IP.
+// Called when a connection is closed due to auth timeout.
+// May trigger a ban if the threshold is exceeded.
+void ip_ban_record_failure(const char* ip);
+
+// Record a successful auth for an IP.
+// Clears any failure count for this IP (reward good behavior).
+void ip_ban_record_success(const char* ip);
+
+// Periodic cleanup: expire old entries (call from the connection age checker).
+void ip_ban_cleanup(void);
+
+// Get stats for logging/monitoring
+int ip_ban_get_banned_count(void);
+int ip_ban_get_tracked_count(void);
+
+// Emit a periodic WARN-level log summary of banned IPs (every 5 minutes).
+// Call from the connection age checker timer.
+void ip_ban_log_stats(void);
+
+#endif // IP_BAN_H
@@ -162,6 +162,9 @@ int handle_nip11_http_request(struct lws* wsi, const char* accept_header);
 // Forward declaration for WebSocket relay server
 int start_websocket_relay(int port_override, int strict_port);

+// Forward declaration for IP ban system
+void ip_ban_init(void);
+

 // Forward declarations for NIP-13 PoW handling (now in nip013.c)
 void init_pow_config();
@@ -739,13 +742,13 @@ int store_event(cJSON* event) {
    }
    
    // Extract event fields
-    cJSON* id = cJSON_GetObjectItem(event, "id");
-    cJSON* pubkey = cJSON_GetObjectItem(event, "pubkey");
-    cJSON* created_at = cJSON_GetObjectItem(event, "created_at");
-    cJSON* kind = cJSON_GetObjectItem(event, "kind");
-    cJSON* content = cJSON_GetObjectItem(event, "content");
-    cJSON* sig = cJSON_GetObjectItem(event, "sig");
-    cJSON* tags = cJSON_GetObjectItem(event, "tags");
+    cJSON* id = cJSON_GetObjectItemCaseSensitive(event, "id");
+    cJSON* pubkey = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
+    cJSON* created_at = cJSON_GetObjectItemCaseSensitive(event, "created_at");
+    cJSON* kind = cJSON_GetObjectItemCaseSensitive(event, "kind");
+    cJSON* content = cJSON_GetObjectItemCaseSensitive(event, "content");
+    cJSON* sig = cJSON_GetObjectItemCaseSensitive(event, "sig");
+    cJSON* tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
    
    if (!id || !pubkey || !created_at || !kind || !content || !sig) {
        DEBUG_ERROR("Invalid event - missing required fields");
@@ -863,8 +866,8 @@ int store_event(cJSON* event) {
    store_event_tags(cJSON_GetStringValue(id), tags);

    // Check if this is a kind 3 event from the admin — trigger WoT sync
-    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
-    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+    cJSON* kind_obj = cJSON_GetObjectItemCaseSensitive(event, "kind");
+    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
    if (kind_obj && pubkey_obj && cJSON_GetNumberValue(kind_obj) == 3) {
        int wot_level = get_config_int("wot_enabled", 0);
        if (wot_level > 0) {
@@ -881,6 +884,22 @@ int store_event(cJSON* event) {
    return 0;
 }

+// Fast duplicate check: returns 1 if event ID already exists in DB, 0 if not.
+// Uses the primary key index — single B-tree lookup, ~10μs.
+// Call this BEFORE signature verification to skip expensive crypto on duplicates.
+int event_id_exists_in_db(const char* event_id) {
+    if (!g_db || !event_id || strlen(event_id) != 64) return 0;
+
+    sqlite3_stmt* stmt;
+    const char* sql = "SELECT 1 FROM events WHERE id=? LIMIT 1";
+    if (sqlite3_prepare_v2(g_db, sql, -1, &stmt, NULL) != SQLITE_OK) return 0;
+
+    sqlite3_bind_text(stmt, 1, event_id, 64, SQLITE_STATIC);
+    int exists = (sqlite3_step(stmt) == SQLITE_ROW) ? 1 : 0;
+    sqlite3_finalize(stmt);
+    return exists;
+}
+
 // Populate event_tags from existing events (run once at startup)
 int populate_event_tags_from_existing(void) {
    if (!g_db) return -1;
@@ -1005,7 +1024,7 @@ static int is_only_kind_99999_request(cJSON* filters) {
            return 0;
        }
        
-        cJSON* kinds = cJSON_GetObjectItem(filter, "kinds");
+        cJSON* kinds = cJSON_GetObjectItemCaseSensitive(filter, "kinds");
        if (!kinds || !cJSON_IsArray(kinds)) {
            // Filter has no kinds or kinds is not an array - not a pure 99999 request
            return 0;
@@ -1256,7 +1275,7 @@ int handle_req_message(const char* sub_id, cJSON* filters, struct lws *wsi, stru
        // after retrieving events to ensure compatibility with all SQLite versions
        
        // Handle kinds filter
-        cJSON* kinds = cJSON_GetObjectItem(filter, "kinds");
+        cJSON* kinds = cJSON_GetObjectItemCaseSensitive(filter, "kinds");
        if (kinds && cJSON_IsArray(kinds)) {
            int kind_count = cJSON_GetArraySize(kinds);
            if (kind_count > 0) {
@@ -1284,7 +1303,7 @@ int handle_req_message(const char* sub_id, cJSON* filters, struct lws *wsi, stru
        }
        
        // Handle authors filter
-        cJSON* authors = cJSON_GetObjectItem(filter, "authors");
+        cJSON* authors = cJSON_GetObjectItemCaseSensitive(filter, "authors");
        if (authors && cJSON_IsArray(authors)) {
            int author_count = 0;
            // Count valid authors
@@ -1324,7 +1343,7 @@ int handle_req_message(const char* sub_id, cJSON* filters, struct lws *wsi, stru
        }

        // Handle ids filter
-        cJSON* ids = cJSON_GetObjectItem(filter, "ids");
+        cJSON* ids = cJSON_GetObjectItemCaseSensitive(filter, "ids");
        if (ids && cJSON_IsArray(ids)) {
            int id_count = 0;
            // Count valid ids
@@ -1414,7 +1433,7 @@ int handle_req_message(const char* sub_id, cJSON* filters, struct lws *wsi, stru
        }

        // Handle search filter (NIP-50)
-        cJSON* search = cJSON_GetObjectItem(filter, "search");
+        cJSON* search = cJSON_GetObjectItemCaseSensitive(filter, "search");
        if (search && cJSON_IsString(search)) {
            const char* search_term = cJSON_GetStringValue(search);
            if (search_term && strlen(search_term) > 0) {
@@ -1442,7 +1461,7 @@ int handle_req_message(const char* sub_id, cJSON* filters, struct lws *wsi, stru
        }

        // Handle since filter
-        cJSON* since = cJSON_GetObjectItem(filter, "since");
+        cJSON* since = cJSON_GetObjectItemCaseSensitive(filter, "since");
        if (since && cJSON_IsNumber(since)) {
            snprintf(sql_ptr, remaining, " AND created_at >= %ld", (long)cJSON_GetNumberValue(since));
            sql_ptr += strlen(sql_ptr);
@@ -1450,7 +1469,7 @@ int handle_req_message(const char* sub_id, cJSON* filters, struct lws *wsi, stru
        }
        
        // Handle until filter
-        cJSON* until = cJSON_GetObjectItem(filter, "until");
+        cJSON* until = cJSON_GetObjectItemCaseSensitive(filter, "until");
        if (until && cJSON_IsNumber(until)) {
            snprintf(sql_ptr, remaining, " AND created_at <= %ld", (long)cJSON_GetNumberValue(until));
            sql_ptr += strlen(sql_ptr);
@@ -1463,7 +1482,7 @@ int handle_req_message(const char* sub_id, cJSON* filters, struct lws *wsi, stru
        remaining = sizeof(sql) - strlen(sql);
        
        // Handle limit filter
-        cJSON* limit = cJSON_GetObjectItem(filter, "limit");
+        cJSON* limit = cJSON_GetObjectItemCaseSensitive(filter, "limit");
        if (limit && cJSON_IsNumber(limit)) {
            int limit_val = (int)cJSON_GetNumberValue(limit);
            if (limit_val > 0 && limit_val <= 5000) {
@@ -1552,21 +1571,24 @@ int handle_req_message(const char* sub_id, cJSON* filters, struct lws *wsi, stru
                }
            }
            
-            // Build EVENT message using string concatenation (much faster than cJSON operations)
+            // Build EVENT message using zero-copy path: allocate with LWS_PRE prefix,
+            // write directly, transfer ownership to queue — no memcpy.
            // Format: ["EVENT","<sub_id>",<event_json>]
            size_t sub_id_len = strlen(sub_id);
            size_t event_json_len = strlen(event_json_str);
-            size_t msg_len = 10 + sub_id_len + 3 + event_json_len + 1; // ["EVENT",""] + sub_id + "," + event_json + ]
-            
-            char* msg_str = malloc(msg_len + 1);
-            if (msg_str) {
-                snprintf(msg_str, msg_len + 1, "[\"EVENT\",\"%s\",%s]", sub_id, event_json_str);
-                
-                // Use proper message queue system instead of direct lws_write
-                if (queue_message(wsi, pss, msg_str, strlen(msg_str), LWS_WRITE_TEXT) != 0) {
+            size_t msg_len = 10 + sub_id_len + 3 + event_json_len + 1;
+
+            unsigned char* buf = malloc(LWS_PRE + msg_len + 1);
+            if (buf) {
+                char* msg_ptr = (char*)(buf + LWS_PRE);
+                snprintf(msg_ptr, msg_len + 1, "[\"EVENT\",\"%s\",%s]", sub_id, event_json_str);
+                size_t actual_len = strlen(msg_ptr);
+
+                // queue_message_take_ownership takes buf ownership — no memcpy, no free needed here
+                if (queue_message_take_ownership(wsi, pss, buf, actual_len, LWS_WRITE_TEXT) != 0) {
                    DEBUG_ERROR("Failed to queue EVENT message for sub=%s", sub_id);
+                    // buf already freed by queue_message_take_ownership on failure
                }
-                free(msg_str);
            }

            cJSON_Delete(event);
@@ -1606,7 +1628,7 @@ int is_authorized_admin_event(cJSON* event, char* error_buffer, size_t error_buf


    // Step 1: Verify event kind is admin type
-    cJSON *kind_json = cJSON_GetObjectItem(event, "kind");
+    cJSON *kind_json = cJSON_GetObjectItemCaseSensitive(event, "kind");
    if (!kind_json || !cJSON_IsNumber(kind_json)) {
        snprintf(error_buffer, error_buffer_size, "Missing or invalid event kind");
        return -1;
@@ -1619,7 +1641,7 @@ int is_authorized_admin_event(cJSON* event, char* error_buffer, size_t error_buf
    }

    // Step 2: Check if event targets this relay (look for 'p' tag with our relay pubkey)
-    cJSON *tags = cJSON_GetObjectItem(event, "tags");
+    cJSON *tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
    if (!tags || !cJSON_IsArray(tags)) {
        // No tags array - treat as regular event for different relay
        snprintf(error_buffer, error_buffer_size, "Admin event not targeting this relay (no tags)");
@@ -1654,7 +1676,7 @@ int is_authorized_admin_event(cJSON* event, char* error_buffer, size_t error_buf
    }

    // Step 3: Verify admin signature authorization
-    cJSON *pubkey_json = cJSON_GetObjectItem(event, "pubkey");
+    cJSON *pubkey_json = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
    if (!pubkey_json || !cJSON_IsString(pubkey_json)) {
        DEBUG_WARN("Unauthorized admin event attempt: missing or invalid pubkey");
        snprintf(error_buffer, error_buffer_size, "Unauthorized admin event attempt: missing pubkey");
@@ -2146,6 +2168,9 @@ int main(int argc, char* argv[]) {
    // Cleanup orphaned subscriptions from previous runs
    cleanup_all_subscriptions_on_startup();
    
+    // Initialize IP ban table before starting the relay
+    ip_ban_init();
+
    // Start WebSocket Nostr relay server (port from CLI override or configuration)
    int result = start_websocket_relay(cli_options.port_override, cli_options.strict_port);  // Use CLI port override if specified, otherwise config
    
@@ -13,8 +13,8 @@
 // Using CRELAY_ prefix to avoid conflicts with nostr_core_lib VERSION macros
 #define CRELAY_VERSION_MAJOR 1
 #define CRELAY_VERSION_MINOR 2
-#define CRELAY_VERSION_PATCH 7
-#define CRELAY_VERSION "v1.2.7"
+#define CRELAY_VERSION_PATCH 25
+#define CRELAY_VERSION "v1.2.25"

 // Relay metadata (authoritative source for NIP-11 information)
 #define RELAY_NAME "C-Relay"
@@ -33,12 +33,12 @@ int handle_deletion_request(cJSON* event, char* error_message, size_t error_size
    }
    
    // Extract event details
-    cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
-    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
-    cJSON* created_at_obj = cJSON_GetObjectItem(event, "created_at");
-    cJSON* tags_obj = cJSON_GetObjectItem(event, "tags");
-    cJSON* content_obj = cJSON_GetObjectItem(event, "content");
-    cJSON* event_id_obj = cJSON_GetObjectItem(event, "id");
+    cJSON* kind_obj = cJSON_GetObjectItemCaseSensitive(event, "kind");
+    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
+    cJSON* created_at_obj = cJSON_GetObjectItemCaseSensitive(event, "created_at");
+    cJSON* tags_obj = cJSON_GetObjectItemCaseSensitive(event, "tags");
+    cJSON* content_obj = cJSON_GetObjectItemCaseSensitive(event, "content");
+    cJSON* event_id_obj = cJSON_GetObjectItemCaseSensitive(event, "id");
    
    if (!kind_obj || !pubkey_obj || !created_at_obj || !tags_obj || !event_id_obj) {
        snprintf(error_message, error_size, "invalid: incomplete deletion request");
@@ -118,6 +118,8 @@ cJSON* generate_relay_info_json() {
    int default_limit = get_config_int("default_limit", 500);
    int min_pow_difficulty = get_config_int("pow_min_difficulty", 0);
    int admin_enabled = get_config_bool("admin_enabled", 0);
+    int wot_enabled = get_config_int("wot_enabled", 0);
+    int auth_enabled = get_config_bool("auth_enabled", 0);

    // Add basic relay information
    if (relay_name && strlen(relay_name) > 0) {
@@ -209,6 +211,9 @@ cJSON* generate_relay_info_json() {
    }

    // Add server limitations
+    // restricted_writes is true when WoT or auth is enabled (only trusted pubkeys can write)
+    int restricted_writes = (wot_enabled > 0 || auth_enabled) ? 1 : 0;
+
    cJSON* limitation = cJSON_CreateObject();
    if (limitation) {
        cJSON_AddNumberToObject(limitation, "max_message_length", max_message_length);
@@ -218,15 +223,31 @@ cJSON* generate_relay_info_json() {
        cJSON_AddNumberToObject(limitation, "max_event_tags", max_event_tags);
        cJSON_AddNumberToObject(limitation, "max_content_length", max_content_length);
        cJSON_AddNumberToObject(limitation, "min_pow_difficulty", min_pow_difficulty);
-        cJSON_AddBoolToObject(limitation, "auth_required", admin_enabled ? cJSON_True : cJSON_False);
+        cJSON_AddBoolToObject(limitation, "auth_required", auth_enabled ? cJSON_True : cJSON_False);
        cJSON_AddBoolToObject(limitation, "payment_required", cJSON_False);
-        cJSON_AddBoolToObject(limitation, "restricted_writes", cJSON_False);
+        cJSON_AddBoolToObject(limitation, "restricted_writes", restricted_writes ? cJSON_True : cJSON_False);
        cJSON_AddNumberToObject(limitation, "created_at_lower_limit", 0);
        cJSON_AddNumberToObject(limitation, "created_at_upper_limit", 2147483647);
        cJSON_AddNumberToObject(limitation, "default_limit", default_limit);
        cJSON_AddItemToObject(info, "limitation", limitation);
    }

+    // Add Web of Trust information when enabled
+    // This informs clients that the relay operates on a trust network
+    if (wot_enabled > 0) {
+        cJSON* wot_info = cJSON_CreateObject();
+        if (wot_info) {
+            cJSON_AddNumberToObject(wot_info, "level", wot_enabled);
+            const char* level_desc = (wot_enabled == 1)
+                ? "write-only: only followed pubkeys can publish events"
+                : "full: only followed pubkeys can publish and subscribe";
+            cJSON_AddStringToObject(wot_info, "description", level_desc);
+            cJSON_AddStringToObject(wot_info, "policy",
+                "Events from pubkeys not in the relay operator's Web of Trust are rejected.");
+            cJSON_AddItemToObject(info, "web_of_trust", wot_info);
+        }
+    }
+
    // Add retention policies (empty array for now)
    cJSON* retention = cJSON_CreateArray();
    if (retention) {
@@ -55,7 +55,7 @@ int validate_event_pow(cJSON* event, char* error_message, size_t error_size) {
    // If min_pow_difficulty is 0, only validate events that have nonce tags
    // This allows events without PoW when difficulty requirement is 0
    if (min_pow_difficulty == 0) {
-        cJSON* tags = cJSON_GetObjectItem(event, "tags");
+        cJSON* tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
        int has_nonce_tag = 0;

        if (tags && cJSON_IsArray(tags)) {
@@ -114,7 +114,7 @@ int is_event_expired(cJSON* event, time_t current_time) {
        return 0; // Invalid event, not expired
    }

-    cJSON* tags = cJSON_GetObjectItem(event, "tags");
+    cJSON* tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
    long expiration_ts = extract_expiration_timestamp(tags);

    if (expiration_ts == 0) {
@@ -140,7 +140,7 @@ int validate_event_expiration(cJSON* event, char* error_message, size_t error_si
    time_t current_time = time(NULL);
    if (is_event_expired(event, current_time)) {
        if (g_expiration_config.strict_mode) {
-            cJSON* tags = cJSON_GetObjectItem(event, "tags");
+            cJSON* tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
            long expiration_ts = extract_expiration_timestamp(tags);

            snprintf(error_message, error_size,
@@ -99,7 +99,7 @@ void handle_nip42_auth_signed_event(struct lws* wsi, struct per_session_data* ps
    char authenticated_pubkey[65] = {0};
    if (result == 0) {
        // Extract pubkey from the auth event
-        cJSON* pubkey_json = cJSON_GetObjectItem(auth_event, "pubkey");
+        cJSON* pubkey_json = cJSON_GetObjectItemCaseSensitive(auth_event, "pubkey");
        if (pubkey_json && cJSON_IsString(pubkey_json)) {
            const char* pubkey_str = cJSON_GetStringValue(pubkey_json);
            if (pubkey_str && strlen(pubkey_str) == 64) {
@@ -126,6 +126,9 @@ void handle_nip42_auth_signed_event(struct lws* wsi, struct per_session_data* ps
        pss->challenge_expires = 0;
        pss->auth_challenge_sent = 0;
        pthread_mutex_unlock(&pss->session_lock);
+
+        // Cancel the auth timeout — client has authenticated, keep connection open
+        lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
        
        send_notice_message(wsi, pss, "NIP-42 authentication successful");
    } else {
@@ -252,13 +252,13 @@ int nostr_validate_unified_request(const char* json_string, size_t json_length)
  }

  // 4. Validate basic event structure
-  cJSON *id = cJSON_GetObjectItem(event, "id");
-  cJSON *pubkey = cJSON_GetObjectItem(event, "pubkey");
-  cJSON *created_at = cJSON_GetObjectItem(event, "created_at");
-  cJSON *kind = cJSON_GetObjectItem(event, "kind");
-  cJSON *tags = cJSON_GetObjectItem(event, "tags");
-  cJSON *content = cJSON_GetObjectItem(event, "content");
-  cJSON *sig = cJSON_GetObjectItem(event, "sig");
+  cJSON *id = cJSON_GetObjectItemCaseSensitive(event, "id");
+  cJSON *pubkey = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
+  cJSON *created_at = cJSON_GetObjectItemCaseSensitive(event, "created_at");
+  cJSON *kind = cJSON_GetObjectItemCaseSensitive(event, "kind");
+  cJSON *tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
+  cJSON *content = cJSON_GetObjectItemCaseSensitive(event, "content");
+  cJSON *sig = cJSON_GetObjectItemCaseSensitive(event, "sig");

  if (!id || !cJSON_IsString(id) ||
      !pubkey || !cJSON_IsString(pubkey) ||
@@ -380,7 +380,7 @@ int nostr_validate_unified_request(const char* json_string, size_t json_length)
  // Always check expiration tags if present (following NIP-40 specification)

  cJSON *expiration_tag = NULL;
-  cJSON *tags_array = cJSON_GetObjectItem(event, "tags");
+  cJSON *tags_array = cJSON_GetObjectItemCaseSensitive(event, "tags");

  if (tags_array && cJSON_IsArray(tags_array)) {
    cJSON *tag = NULL;
@@ -818,7 +818,7 @@ int nostr_nip42_verify_auth_event(cJSON *event, const char *challenge_id,
  }
  
  // Check if event has the required tags for NIP-42
-  cJSON *tags = cJSON_GetObjectItem(event, "tags");
+  cJSON *tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
  if (!tags || !cJSON_IsArray(tags)) {
    return NOSTR_ERROR_NIP42_AUTH_EVENT_INVALID;
  }
@@ -896,7 +896,7 @@ int nostr_nip42_verify_auth_event(cJSON *event, const char *challenge_id,
  }
  
  // Check created_at timestamp for reasonable bounds
-  cJSON *created_at_json = cJSON_GetObjectItem(event, "created_at");
+  cJSON *created_at_json = cJSON_GetObjectItemCaseSensitive(event, "created_at");
  if (created_at_json && cJSON_IsNumber(created_at_json)) {
    time_t created_at = (time_t)cJSON_GetNumberValue(created_at_json);
    if (abs((int)(now - created_at)) > time_tolerance_seconds) {
@@ -192,32 +192,32 @@ subscription_filter_t* create_subscription_filter(cJSON* filter_json) {
    }
    
    // Copy filter criteria
-    cJSON* kinds = cJSON_GetObjectItem(filter_json, "kinds");
+    cJSON* kinds = cJSON_GetObjectItemCaseSensitive(filter_json, "kinds");
    if (kinds && cJSON_IsArray(kinds)) {
        filter->kinds = cJSON_Duplicate(kinds, 1);
    }
    
-    cJSON* authors = cJSON_GetObjectItem(filter_json, "authors");
+    cJSON* authors = cJSON_GetObjectItemCaseSensitive(filter_json, "authors");
    if (authors && cJSON_IsArray(authors)) {
        filter->authors = cJSON_Duplicate(authors, 1);
    }
    
-    cJSON* ids = cJSON_GetObjectItem(filter_json, "ids");
+    cJSON* ids = cJSON_GetObjectItemCaseSensitive(filter_json, "ids");
    if (ids && cJSON_IsArray(ids)) {
        filter->ids = cJSON_Duplicate(ids, 1);
    }
    
-    cJSON* since = cJSON_GetObjectItem(filter_json, "since");
+    cJSON* since = cJSON_GetObjectItemCaseSensitive(filter_json, "since");
    if (since && cJSON_IsNumber(since)) {
        filter->since = (long)cJSON_GetNumberValue(since);
    }
    
-    cJSON* until = cJSON_GetObjectItem(filter_json, "until");
+    cJSON* until = cJSON_GetObjectItemCaseSensitive(filter_json, "until");
    if (until && cJSON_IsNumber(until)) {
        filter->until = (long)cJSON_GetNumberValue(until);
    }
    
-    cJSON* limit = cJSON_GetObjectItem(filter_json, "limit");
+    cJSON* limit = cJSON_GetObjectItemCaseSensitive(filter_json, "limit");
    if (limit && cJSON_IsNumber(limit)) {
        filter->limit = (int)cJSON_GetNumberValue(limit);
    }
@@ -532,9 +532,9 @@ int event_matches_filter(cJSON* event, subscription_filter_t* filter) {
    }

    // Debug: Log event details being tested
-    cJSON* event_kind_obj = cJSON_GetObjectItem(event, "kind");
-    cJSON* event_id_obj = cJSON_GetObjectItem(event, "id");
-    cJSON* event_created_at_obj = cJSON_GetObjectItem(event, "created_at");
+    cJSON* event_kind_obj = cJSON_GetObjectItemCaseSensitive(event, "kind");
+    cJSON* event_id_obj = cJSON_GetObjectItemCaseSensitive(event, "id");
+    cJSON* event_created_at_obj = cJSON_GetObjectItemCaseSensitive(event, "created_at");

    DEBUG_TRACE("FILTER_MATCH: Testing event kind=%d id=%.8s created_at=%ld",
        event_kind_obj ? (int)cJSON_GetNumberValue(event_kind_obj) : -1,
@@ -545,7 +545,7 @@ int event_matches_filter(cJSON* event, subscription_filter_t* filter) {
    if (filter->kinds && cJSON_IsArray(filter->kinds)) {
        DEBUG_TRACE("FILTER_MATCH: Checking kinds filter with %d kinds", cJSON_GetArraySize(filter->kinds));

-        cJSON* event_kind = cJSON_GetObjectItem(event, "kind");
+        cJSON* event_kind = cJSON_GetObjectItemCaseSensitive(event, "kind");
        if (!event_kind || !cJSON_IsNumber(event_kind)) {
            DEBUG_WARN("FILTER_MATCH: Event has no valid kind field");
            return 0;
@@ -577,7 +577,7 @@ int event_matches_filter(cJSON* event, subscription_filter_t* filter) {
    
    // Check authors filter
    if (filter->authors && cJSON_IsArray(filter->authors)) {
-        cJSON* event_pubkey = cJSON_GetObjectItem(event, "pubkey");
+        cJSON* event_pubkey = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
        if (!event_pubkey || !cJSON_IsString(event_pubkey)) {
            return 0;
        }
@@ -604,7 +604,7 @@ int event_matches_filter(cJSON* event, subscription_filter_t* filter) {
    
    // Check IDs filter
    if (filter->ids && cJSON_IsArray(filter->ids)) {
-        cJSON* event_id = cJSON_GetObjectItem(event, "id");
+        cJSON* event_id = cJSON_GetObjectItemCaseSensitive(event, "id");
        if (!event_id || !cJSON_IsString(event_id)) {
            return 0;
        }
@@ -631,7 +631,7 @@ int event_matches_filter(cJSON* event, subscription_filter_t* filter) {
    
    // Check since filter
    if (filter->since > 0) {
-        cJSON* event_created_at = cJSON_GetObjectItem(event, "created_at");
+        cJSON* event_created_at = cJSON_GetObjectItemCaseSensitive(event, "created_at");
        if (!event_created_at || !cJSON_IsNumber(event_created_at)) {
            DEBUG_WARN("FILTER_MATCH: Event has no valid created_at field");
            return 0;
@@ -650,7 +650,7 @@ int event_matches_filter(cJSON* event, subscription_filter_t* filter) {
    
    // Check until filter
    if (filter->until > 0) {
-        cJSON* event_created_at = cJSON_GetObjectItem(event, "created_at");
+        cJSON* event_created_at = cJSON_GetObjectItemCaseSensitive(event, "created_at");
        if (!event_created_at || !cJSON_IsNumber(event_created_at)) {
            return 0;
        }
@@ -663,7 +663,7 @@ int event_matches_filter(cJSON* event, subscription_filter_t* filter) {
    
    // Check tag filters (e.g., #e, #p tags)
    if (filter->tag_filters && cJSON_IsObject(filter->tag_filters)) {
-        cJSON* event_tags = cJSON_GetObjectItem(event, "tags");
+        cJSON* event_tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
        if (!event_tags || !cJSON_IsArray(event_tags)) {
            return 0; // Event has no tags but filter requires tags
        }
@@ -777,9 +777,9 @@ int broadcast_event_to_subscriptions(cJSON* event) {
    int broadcasts = 0;

    // Log event details
-    cJSON* event_kind = cJSON_GetObjectItem(event, "kind");
-    cJSON* event_id = cJSON_GetObjectItem(event, "id");
-    cJSON* event_created_at = cJSON_GetObjectItem(event, "created_at");
+    cJSON* event_kind = cJSON_GetObjectItemCaseSensitive(event, "kind");
+    cJSON* event_id = cJSON_GetObjectItemCaseSensitive(event, "id");
+    cJSON* event_created_at = cJSON_GetObjectItemCaseSensitive(event, "created_at");

    DEBUG_TRACE("BROADCAST: Event kind=%d id=%.8s created_at=%ld",
        event_kind ? (int)cJSON_GetNumberValue(event_kind) : -1,
@@ -876,12 +876,11 @@ int broadcast_event_to_subscriptions(cJSON* event) {
        // Serialize event once per subscription using pre-serialized event_json if available,
        // otherwise fall back to cJSON serialization.
        // Format: ["EVENT","<sub_id>",<event_json>]
-        cJSON* event_id_obj = cJSON_GetObjectItem(event, "id");
        const char* event_json_str = NULL;
        char* event_json_allocated = NULL;

        // Try to get pre-serialized event_json field first (fast path)
-        cJSON* event_json_field = cJSON_GetObjectItem(event, "event_json");
+        cJSON* event_json_field = cJSON_GetObjectItemCaseSensitive(event, "event_json");
        if (event_json_field && cJSON_IsString(event_json_field)) {
            event_json_str = cJSON_GetStringValue(event_json_field);
        } else {
@@ -895,16 +894,19 @@ int broadcast_event_to_subscriptions(cJSON* event) {
            size_t event_json_len = strlen(event_json_str);
            // ["EVENT","<sub_id>",<event_json>]
            size_t msg_len = 10 + sub_id_len + 3 + event_json_len + 1;
-            char* msg_str = malloc(msg_len + 1);
-            if (msg_str) {
-                snprintf(msg_str, msg_len + 1, "[\"EVENT\",\"%s\",%s]", current_temp->id, event_json_str);
-                size_t actual_len = strlen(msg_str);
+
+            // Zero-copy: allocate with LWS_PRE prefix, write directly, transfer ownership to queue
+            unsigned char* buf = malloc(LWS_PRE + msg_len + 1);
+            if (buf) {
+                char* msg_ptr = (char*)(buf + LWS_PRE);
+                snprintf(msg_ptr, msg_len + 1, "[\"EVENT\",\"%s\",%s]", current_temp->id, event_json_str);
+                size_t actual_len = strlen(msg_ptr);

                DEBUG_TRACE("WS_FRAME_SEND: type=EVENT sub=%s len=%zu", current_temp->id, actual_len);

-                // Queue message for proper libwebsockets pattern
                struct per_session_data* pss = (struct per_session_data*)lws_wsi_user(current_temp->wsi);
-                if (queue_message(current_temp->wsi, pss, msg_str, actual_len, LWS_WRITE_TEXT) == 0) {
+                // queue_message_take_ownership takes buf ownership — no memcpy, no free needed here
+                if (queue_message_take_ownership(current_temp->wsi, pss, buf, actual_len, LWS_WRITE_TEXT) == 0) {
                    broadcasts++;

                    // Update events sent counter for this subscription
@@ -922,8 +924,8 @@ int broadcast_event_to_subscriptions(cJSON* event) {
                    pthread_mutex_unlock(&g_subscription_manager.subscriptions_lock);
                } else {
                    DEBUG_ERROR("Failed to queue EVENT message for sub=%s", current_temp->id);
+                    // buf already freed by queue_message_take_ownership on failure
                }
-                free(msg_str);
            }
        }
        if (event_json_allocated) {
@@ -1473,7 +1475,7 @@ int validate_filter_values(cJSON* filter_json, char* error_message, size_t error
    int has_kind_99999 = 0;  // Track if we encounter kind 99999 (NDK ping)

    // Validate kinds array
-    cJSON* kinds = cJSON_GetObjectItem(filter_json, "kinds");
+    cJSON* kinds = cJSON_GetObjectItemCaseSensitive(filter_json, "kinds");
    if (kinds) {
        if (!cJSON_IsArray(kinds)) {
            snprintf(error_message, error_size, "kinds must be an array");
@@ -1516,7 +1518,7 @@ int validate_filter_values(cJSON* filter_json, char* error_message, size_t error
    }

    // Validate authors array
-    cJSON* authors = cJSON_GetObjectItem(filter_json, "authors");
+    cJSON* authors = cJSON_GetObjectItemCaseSensitive(filter_json, "authors");
    if (authors) {
        if (!cJSON_IsArray(authors)) {
            snprintf(error_message, error_size, "authors must be an array");
@@ -1556,7 +1558,7 @@ int validate_filter_values(cJSON* filter_json, char* error_message, size_t error
    }

    // Validate ids array
-    cJSON* ids = cJSON_GetObjectItem(filter_json, "ids");
+    cJSON* ids = cJSON_GetObjectItemCaseSensitive(filter_json, "ids");
    if (ids) {
        if (!cJSON_IsArray(ids)) {
            snprintf(error_message, error_size, "ids must be an array");
@@ -1598,7 +1600,7 @@ int validate_filter_values(cJSON* filter_json, char* error_message, size_t error
    // Validate since/until timestamps
    long since_val = 0, until_val = 0;

-    cJSON* since = cJSON_GetObjectItem(filter_json, "since");
+    cJSON* since = cJSON_GetObjectItemCaseSensitive(filter_json, "since");
    if (since) {
        if (!cJSON_IsNumber(since)) {
            snprintf(error_message, error_size, "since must be a number");
@@ -1607,7 +1609,7 @@ int validate_filter_values(cJSON* filter_json, char* error_message, size_t error
        since_val = (long)cJSON_GetNumberValue(since);
    }

-    cJSON* until = cJSON_GetObjectItem(filter_json, "until");
+    cJSON* until = cJSON_GetObjectItemCaseSensitive(filter_json, "until");
    if (until) {
        if (!cJSON_IsNumber(until)) {
            snprintf(error_message, error_size, "until must be a number");
@@ -1621,7 +1623,7 @@ int validate_filter_values(cJSON* filter_json, char* error_message, size_t error
    }

    // Validate limit
-    cJSON* limit = cJSON_GetObjectItem(filter_json, "limit");
+    cJSON* limit = cJSON_GetObjectItemCaseSensitive(filter_json, "limit");
    if (limit) {
        if (!cJSON_IsNumber(limit)) {
            snprintf(error_message, error_size, "limit must be a number");
@@ -1635,7 +1637,7 @@ int validate_filter_values(cJSON* filter_json, char* error_message, size_t error
    }

    // Validate search term
-    cJSON* search = cJSON_GetObjectItem(filter_json, "search");
+    cJSON* search = cJSON_GetObjectItemCaseSensitive(filter_json, "search");
    if (search) {
        if (!cJSON_IsString(search)) {
            snprintf(error_message, error_size, "search must be a string");
@@ -30,6 +30,7 @@
 #include "embedded_web_content.h"  // Embedded web content
 #include "api.h"  // API for embedded files
 #include "dm_admin.h"  // DM admin functions including NIP-17
+#include "ip_ban.h"  // IP auth failure ban system

 // Forward declarations for logging functions

@@ -64,6 +65,7 @@ int remove_subscription_from_manager(const char* sub_id, struct lws* wsi);
 // Forward declarations for event handling
 int handle_event_message(cJSON* event, char* error_message, size_t error_size);
 int nostr_validate_unified_request(const char* json_string, size_t json_length);
+int event_id_exists_in_db(const char* event_id);

 // Forward declarations for admin event processing
 int process_admin_event_in_config(cJSON* event, char* error_message, size_t error_size, struct lws* wsi);
@@ -194,6 +196,66 @@ int queue_message(struct lws* wsi, struct per_session_data* pss, const char* mes
    return 0;
 }

+/**
+ * Zero-copy variant of queue_message. The caller allocates a buffer of
+ * (LWS_PRE + length) bytes, writes the message at (buf + LWS_PRE), then
+ * passes ownership to the queue. The queue will free buf when done.
+ * No memcpy is performed — eliminates one copy per queued message.
+ *
+ * @param wsi WebSocket instance
+ * @param pss Per-session data containing message queue
+ * @param buf Pre-allocated buffer of size (LWS_PRE + length); ownership transferred
+ * @param length Length of message (NOT including LWS_PRE)
+ * @param type LWS_WRITE_* type
+ * @return 0 on success, -1 on error (buf is freed on error)
+ */
+int queue_message_take_ownership(struct lws* wsi, struct per_session_data* pss, unsigned char* buf, size_t length, enum lws_write_protocol type) {
+    if (!wsi || !pss || !buf || length == 0) {
+        DEBUG_ERROR("queue_message_take_ownership: invalid parameters");
+        free(buf);
+        return -1;
+    }
+
+    // Drop message if queue is full
+    if (pss->message_queue_count >= MAX_MESSAGE_QUEUE_SIZE) {
+        DEBUG_WARN("queue_message_take_ownership: queue full (%d), dropping message",
+                   pss->message_queue_count);
+        free(buf);
+        return -1;
+    }
+
+    struct message_queue_node* node = malloc(sizeof(struct message_queue_node));
+    if (!node) {
+        DEBUG_ERROR("queue_message_take_ownership: failed to allocate queue node");
+        free(buf);
+        return -1;
+    }
+
+    node->data = buf;       // buf already has LWS_PRE prefix — no copy needed
+    node->length = length;
+    node->type = type;
+    node->next = NULL;
+
+    pthread_mutex_lock(&pss->session_lock);
+    if (!pss->message_queue_head) {
+        pss->message_queue_head = node;
+        pss->message_queue_tail = node;
+    } else {
+        pss->message_queue_tail->next = node;
+        pss->message_queue_tail = node;
+    }
+    pss->message_queue_count++;
+    pthread_mutex_unlock(&pss->session_lock);
+
+    if (!pss->writeable_requested) {
+        pss->writeable_requested = 1;
+        lws_callback_on_writable(wsi);
+    }
+
+    DEBUG_TRACE("Queued message (zero-copy): len=%zu, queue_count=%d", length, pss->message_queue_count);
+    return 0;
+}
+
 /**
 * Process message queue when the socket becomes writeable.
 * This function is called from LWS_CALLBACK_SERVER_WRITEABLE.
@@ -484,6 +546,28 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
            memset(pss->active_challenge, 0, sizeof(pss->active_challenge));
            pss->challenge_created = 0;
            pss->challenge_expires = 0;
+
+            // Check IP ban using the resolved client IP (which may be from X-Forwarded-For).
+            // This must happen AFTER pss->client_ip is populated so the same IP string
+            // is used for both ban recording (at CLOSED) and ban checking (here).
+            if (ip_ban_is_banned(pss->client_ip)) {
+                DEBUG_LOG("Rejecting banned IP %s at connection establishment", pss->client_ip);
+                return -1;  // Close connection immediately — no challenge, no processing
+            }
+
+            // Set libwebsockets auth timeout: if NIP-42 auth is required and the client
+            // doesn't authenticate within nip42_auth_timeout_sec seconds, lws will close
+            // the connection automatically — even if the client never sends a message.
+            // This prevents idle unauthenticated connections from accumulating.
+            if (pss->nip42_auth_required_events || pss->nip42_auth_required_subscriptions) {
+                int auth_timeout = get_config_int("nip42_auth_timeout_sec", 10);
+                if (auth_timeout > 0) {
+                    lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_PING, auth_timeout);
+                    DEBUG_TRACE("Auth timeout set: %d seconds for unauthenticated connection from %s",
+                                auth_timeout, pss->client_ip);
+                }
+            }
+
            DEBUG_TRACE("WebSocket connection initialization complete");
            break;
            
@@ -609,6 +693,27 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                            return 0;
                                        }

+                                        // Early duplicate check: skip expensive crypto for events already in DB.
+                                        // The event id is a 64-char hex string — look it up via primary key index (~10μs).
+                                        // This must happen AFTER we have the id string but BEFORE signature verification.
+                                        cJSON* id_obj_dup = cJSON_GetObjectItemCaseSensitive(event, "id");
+                                        if (id_obj_dup && cJSON_IsString(id_obj_dup)) {
+                                            const char* event_id_str = cJSON_GetStringValue(id_obj_dup);
+                                            if (event_id_str && event_id_exists_in_db(event_id_str)) {
+                                                // Already have this event — send OK true and skip crypto
+                                                DEBUG_TRACE("Duplicate event %s — skipping signature verification", event_id_str);
+                                                char ok_msg[128];
+                                                snprintf(ok_msg, sizeof(ok_msg),
+                                                    "[\"OK\",\"%s\",true,\"duplicate: already have this event\"]",
+                                                    event_id_str);
+                                                size_t ok_len = strlen(ok_msg);
+                                                queue_message(wsi, pss, ok_msg, ok_len, LWS_WRITE_TEXT);
+                                                free(event_json_str);
+                                                cJSON_Delete(json);
+                                                return 0;
+                                            }
+                                        }
+
                                        // Call unified validator with JSON string
                                        size_t event_json_len = strlen(event_json_str);
                                        int validation_result = nostr_validate_unified_request(event_json_str, event_json_len);
@@ -654,7 +759,7 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                        if (result == 0) {
                                            // Check if event has protected tag ["-"]
                                            int is_protected_event = 0;
-                                            cJSON* tags = cJSON_GetObjectItem(event, "tags");
+                                            cJSON* tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
                                            if (tags && cJSON_IsArray(tags)) {
                                                cJSON* tag = NULL;
                                                cJSON_ArrayForEach(tag, tags) {
@@ -681,7 +786,7 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                                    DEBUG_WARN("Protected event rejected: protected events not enabled");
                                                } else {
                                                    // Protected events enabled - check authentication
-                                                    cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+                                                    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
                                                    const char* event_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;

                                                    if (!pss || !pss->authenticated ||
@@ -698,7 +803,7 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso

                                        // Check for admin events (kind 23456) and intercept them
                                        if (result == 0) {
-                                            cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+                                            cJSON* kind_obj = cJSON_GetObjectItemCaseSensitive(event, "kind");
                                            if (kind_obj && cJSON_IsNumber(kind_obj)) {
                                                int event_kind = (int)cJSON_GetNumberValue(kind_obj);

@@ -890,7 +995,7 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                        }

                                        // Send OK response
-                                        cJSON* event_id = cJSON_GetObjectItem(event, "id");
+                                        cJSON* event_id = cJSON_GetObjectItemCaseSensitive(event, "id");
                                        if (event_id && cJSON_IsString(event_id)) {
                                            cJSON* response = cJSON_CreateArray();
                                            cJSON_AddItemToArray(response, cJSON_CreateString("OK"));
@@ -929,6 +1034,21 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                        } else {
                                            send_notice_message(wsi, pss, "NIP-42 authentication required for subscriptions");
                                            DEBUG_WARN("REQ rejected: NIP-42 authentication required");
+
+                                            // Auth timeout: close connection if challenge was sent but client
+                                            // hasn't authenticated within nip42_auth_timeout_sec seconds
+                                            int auth_timeout = get_config_int("nip42_auth_timeout_sec", 10);
+                                            if (auth_timeout > 0 && pss->connection_established > 0) {
+                                                time_t connection_age = time(NULL) - pss->connection_established;
+                                                if (connection_age >= auth_timeout) {
+                                                    DEBUG_LOG("Closing unauthenticated connection from %s after %ld seconds (timeout=%d)",
+                                                              pss->client_ip, connection_age, auth_timeout);
+                                                    lws_close_reason(wsi, LWS_CLOSE_STATUS_POLICY_VIOLATION,
+                                                                     (unsigned char*)"Authentication timeout", 22);
+                                                    cJSON_Delete(json);
+                                                    return -1;
+                                                }
+                                            }
                                        }
                                        cJSON_Delete(json);
                                        // Note: complete_message points to reassembly_buffer, which is managed separately
@@ -1251,11 +1371,11 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                cJSON* event_obj = cJSON_GetArrayItem(json, 1);
                                if (event_obj && cJSON_IsObject(event_obj)) {
                                    // Extract event kind for kind-specific NIP-42 authentication check
-                                    cJSON* kind_obj = cJSON_GetObjectItem(event_obj, "kind");
+                                    cJSON* kind_obj = cJSON_GetObjectItemCaseSensitive(event_obj, "kind");
                                    int event_kind = kind_obj && cJSON_IsNumber(kind_obj) ? (int)cJSON_GetNumberValue(kind_obj) : -1;

                                    // Extract pubkey for debugging
-                                    cJSON* pubkey_obj = cJSON_GetObjectItem(event_obj, "pubkey");
+                                    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event_obj, "pubkey");
                                    const char* event_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : "unknown";

                                    // Check if NIP-42 authentication is required for this event kind or globally
@@ -1264,7 +1384,7 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                    // Special case: allow kind 14 DMs addressed to relay to bypass auth (admin commands)
                                    int bypass_auth = 0;
                                    if (event_kind == 14 && event_obj && cJSON_IsObject(event_obj)) {
-                                        cJSON* tags = cJSON_GetObjectItem(event_obj, "tags");
+                                        cJSON* tags = cJSON_GetObjectItemCaseSensitive(event_obj, "tags");
                                        if (tags && cJSON_IsArray(tags)) {
                                            const char* relay_pubkey = get_config_value("relay_pubkey");
                                            if (relay_pubkey) {
@@ -1344,6 +1464,25 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                        return 0;
                                    }
                                    
+                                    // Early duplicate check: skip expensive crypto for events already in DB.
+                                    cJSON* id_obj_dup2 = cJSON_GetObjectItemCaseSensitive(event, "id");
+                                    if (id_obj_dup2 && cJSON_IsString(id_obj_dup2)) {
+                                        const char* event_id_str2 = cJSON_GetStringValue(id_obj_dup2);
+                                        if (event_id_str2 && event_id_exists_in_db(event_id_str2)) {
+                                            DEBUG_TRACE("Duplicate event %s — skipping signature verification", event_id_str2);
+                                            char ok_msg2[128];
+                                            snprintf(ok_msg2, sizeof(ok_msg2),
+                                                "[\"OK\",\"%s\",true,\"duplicate: already have this event\"]",
+                                                event_id_str2);
+                                            size_t ok_len2 = strlen(ok_msg2);
+                                            queue_message(wsi, pss, ok_msg2, ok_len2, LWS_WRITE_TEXT);
+                                            free(event_json_str);
+                                            cJSON_Delete(json);
+                                            free(message);
+                                            return 0;
+                                        }
+                                    }
+
                                    // Call unified validator with JSON string
                                    size_t event_json_len = strlen(event_json_str);
                                    int validation_result = nostr_validate_unified_request(event_json_str, event_json_len);
@@ -1390,7 +1529,7 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                    if (result == 0) {
                                        // Check if event has protected tag ["-"]
                                        int is_protected_event = 0;
-                                        cJSON* tags = cJSON_GetObjectItem(event, "tags");
+                                        cJSON* tags = cJSON_GetObjectItemCaseSensitive(event, "tags");
                                        if (tags && cJSON_IsArray(tags)) {
                                            cJSON* tag = NULL;
                                            cJSON_ArrayForEach(tag, tags) {
@@ -1417,7 +1556,7 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                                DEBUG_WARN("Protected event rejected: protected events not enabled");
                                            } else {
                                                // Protected events enabled - check authentication
-                                                cJSON* pubkey_obj = cJSON_GetObjectItem(event, "pubkey");
+                                                cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(event, "pubkey");
                                                const char* event_pubkey = pubkey_obj ? cJSON_GetStringValue(pubkey_obj) : NULL;

                                                if (!pss || !pss->authenticated ||
@@ -1434,7 +1573,7 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso

                                    // Check for admin events (kind 23456) and intercept them
                                    if (result == 0) {
-                                        cJSON* kind_obj = cJSON_GetObjectItem(event, "kind");
+                                        cJSON* kind_obj = cJSON_GetObjectItemCaseSensitive(event, "kind");
                                        if (kind_obj && cJSON_IsNumber(kind_obj)) {
                                            int event_kind = (int)cJSON_GetNumberValue(kind_obj);

@@ -1626,7 +1765,7 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                    }
                                    
                                    // Send OK response
-                                    cJSON* event_id = cJSON_GetObjectItem(event, "id");
+                                    cJSON* event_id = cJSON_GetObjectItemCaseSensitive(event, "id");
                                    if (event_id && cJSON_IsString(event_id)) {
                                        cJSON* response = cJSON_CreateArray();
                                        cJSON_AddItemToArray(response, cJSON_CreateString("OK"));
@@ -1667,6 +1806,22 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                    } else {
                                        send_notice_message(wsi, pss, "NIP-42 authentication required for subscriptions");
                                        DEBUG_WARN("REQ rejected: NIP-42 authentication required");
+
+                                        // Auth timeout: close connection if challenge was sent but client
+                                        // hasn't authenticated within nip42_auth_timeout_sec seconds
+                                        int auth_timeout = get_config_int("nip42_auth_timeout_sec", 10);
+                                        if (auth_timeout > 0 && pss->connection_established > 0) {
+                                            time_t connection_age = time(NULL) - pss->connection_established;
+                                            if (connection_age >= auth_timeout) {
+                                                DEBUG_LOG("Closing unauthenticated connection from %s after %ld seconds (timeout=%d)",
+                                                          pss->client_ip, connection_age, auth_timeout);
+                                                lws_close_reason(wsi, LWS_CLOSE_STATUS_POLICY_VIOLATION,
+                                                                 (unsigned char*)"Authentication timeout", 22);
+                                                cJSON_Delete(json);
+                                                free(message);
+                                                return -1;
+                                            }
+                                        }
                                    }
                                    cJSON_Delete(json);
                                    free(message);
@@ -1959,6 +2114,15 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                if (g_shutdown_flag || !g_server_running) {
                    reason = "server_shutdown";
                }
+
+                // Record auth failure if connection closed while unauthenticated and auth was required.
+                // This covers both the lws_set_timeout path (idle bots) and the reactive REQ path.
+                if (!pss->authenticated &&
+                    (pss->nip42_auth_required_events || pss->nip42_auth_required_subscriptions) &&
+                    pss->auth_challenge_sent &&
+                    strlen(pss->client_ip) > 0) {
+                    ip_ban_record_failure(pss->client_ip);
+                }
                
                // Format authentication status
                char auth_status[80];
@@ -2125,6 +2289,10 @@ static void check_connection_age(int max_connection_seconds) {
    
    // Cleanup
    free(checked_wsis);
+
+    // Periodic IP ban maintenance: cleanup expired entries and log stats
+    ip_ban_cleanup();
+    ip_ban_log_stats();
 }

 // WebSocket protocol definition
@@ -2321,11 +2489,17 @@ int start_websocket_relay(int port_override, int strict_port) {
            }
        }
        
-        // Check connection age limits (every 60 seconds)
+        // Check connection age limits and run IP ban maintenance (every 60 seconds)
        int max_connection_seconds = get_config_int("max_connection_seconds", 86400);
-        if (max_connection_seconds > 0 && (current_time - last_connection_age_check >= 60)) {
+        if (current_time - last_connection_age_check >= 60) {
            last_connection_age_check = current_time;
-            check_connection_age(max_connection_seconds);
+            if (max_connection_seconds > 0) {
+                check_connection_age(max_connection_seconds);
+            } else {
+                // Even when connection age limit is disabled, run IP ban maintenance
+                ip_ban_cleanup();
+                ip_ban_log_stats();
+            }
        }
    }

@@ -2344,7 +2518,7 @@ int process_dm_stats_command(cJSON* dm_event, char* error_message, size_t error_
    }

    // Check if DM is addressed to relay
-    cJSON* tags = cJSON_GetObjectItem(dm_event, "tags");
+    cJSON* tags = cJSON_GetObjectItemCaseSensitive(dm_event, "tags");
    if (!tags || !cJSON_IsArray(tags)) {
        strncpy(error_message, "DM missing or invalid tags", error_size - 1);
        return -1;
@@ -2380,7 +2554,7 @@ int process_dm_stats_command(cJSON* dm_event, char* error_message, size_t error_
    }

    // Get sender pubkey
-    cJSON* pubkey_obj = cJSON_GetObjectItem(dm_event, "pubkey");
+    cJSON* pubkey_obj = cJSON_GetObjectItemCaseSensitive(dm_event, "pubkey");
    if (!pubkey_obj || !cJSON_IsString(pubkey_obj)) {
        strncpy(error_message, "DM missing sender pubkey", error_size - 1);
        return -1;
@@ -2419,7 +2593,7 @@ int process_dm_stats_command(cJSON* dm_event, char* error_message, size_t error_
    }

    // Get encrypted content
-    cJSON* content_obj = cJSON_GetObjectItem(dm_event, "content");
+    cJSON* content_obj = cJSON_GetObjectItemCaseSensitive(dm_event, "content");
    if (!content_obj || !cJSON_IsString(content_obj)) {
        strncpy(error_message, "DM missing content", error_size - 1);
        return -1;
@@ -2545,7 +2719,7 @@ int handle_count_message(const char* sub_id, cJSON* filters, struct lws *wsi, st
        // after retrieving events to ensure compatibility with all SQLite versions

        // Handle kinds filter
-        cJSON* kinds = cJSON_GetObjectItem(filter, "kinds");
+        cJSON* kinds = cJSON_GetObjectItemCaseSensitive(filter, "kinds");
        if (kinds && cJSON_IsArray(kinds)) {
            int kind_count = cJSON_GetArraySize(kinds);
            if (kind_count > 0) {
@@ -2573,7 +2747,7 @@ int handle_count_message(const char* sub_id, cJSON* filters, struct lws *wsi, st
        }

        // Handle authors filter
-        cJSON* authors = cJSON_GetObjectItem(filter, "authors");
+        cJSON* authors = cJSON_GetObjectItemCaseSensitive(filter, "authors");
        if (authors && cJSON_IsArray(authors)) {
            int author_count = 0;
            // Count valid authors
@@ -2617,7 +2791,7 @@ int handle_count_message(const char* sub_id, cJSON* filters, struct lws *wsi, st
        }

        // Handle ids filter
-        cJSON* ids = cJSON_GetObjectItem(filter, "ids");
+        cJSON* ids = cJSON_GetObjectItemCaseSensitive(filter, "ids");
        if (ids && cJSON_IsArray(ids)) {
            int id_count = 0;
            // Count valid ids
@@ -2719,7 +2893,7 @@ int handle_count_message(const char* sub_id, cJSON* filters, struct lws *wsi, st
        }

        // Handle search filter (NIP-50)
-        cJSON* search = cJSON_GetObjectItem(filter, "search");
+        cJSON* search = cJSON_GetObjectItemCaseSensitive(filter, "search");
        if (search && cJSON_IsString(search)) {
            const char* search_term = cJSON_GetStringValue(search);
            if (search_term && strlen(search_term) > 0) {
@@ -2747,7 +2921,7 @@ int handle_count_message(const char* sub_id, cJSON* filters, struct lws *wsi, st
        }

        // Handle since filter
-        cJSON* since = cJSON_GetObjectItem(filter, "since");
+        cJSON* since = cJSON_GetObjectItemCaseSensitive(filter, "since");
        if (since && cJSON_IsNumber(since)) {
            snprintf(sql_ptr, remaining, " AND created_at >= %ld", (long)cJSON_GetNumberValue(since));
            sql_ptr += strlen(sql_ptr);
@@ -2755,7 +2929,7 @@ int handle_count_message(const char* sub_id, cJSON* filters, struct lws *wsi, st
        }

        // Handle until filter
-        cJSON* until = cJSON_GetObjectItem(filter, "until");
+        cJSON* until = cJSON_GetObjectItemCaseSensitive(filter, "until");
        if (until && cJSON_IsNumber(until)) {
            snprintf(sql_ptr, remaining, " AND created_at <= %ld", (long)cJSON_GetNumberValue(until));
            sql_ptr += strlen(sql_ptr);
@@ -107,6 +107,10 @@ int start_websocket_relay(int port_override, int strict_port);
 int queue_message(struct lws* wsi, struct per_session_data* pss, const char* message, size_t length, enum lws_write_protocol type);
 int process_message_queue(struct lws* wsi, struct per_session_data* pss);

+// Zero-copy variant: caller allocates (LWS_PRE + length) bytes, writes message at buf+LWS_PRE,
+// then passes ownership to the queue. The queue will free buf when done. No memcpy performed.
+int queue_message_take_ownership(struct lws* wsi, struct per_session_data* pss, unsigned char* buf, size_t length, enum lws_write_protocol type);
+
 // Auth rules checking function from request_validator.c
 int check_database_auth_rules(const char *pubkey, const char *operation, const char *resource_hash);
Author	SHA1	Message	Date
Your Name	fe7304ac7f	v1.2.25 - Add NIP-42 AUTH support to web UI: onauth callback in subscribeMany and publish calls	2026-02-23 18:03:29 -04:00
Your Name	e5d39c984b	v1.2.24 - Fix: run ip_ban maintenance unconditionally every 60s regardless of max_connection_seconds setting	2026-02-23 17:57:20 -04:00
Your Name	5e45f21e35	v1.2.23 - ip_ban: retain ban_count for 24 hours after last ban expiry, then fully clean entry	2026-02-23 17:16:02 -04:00
Your Name	5321a238b8	v1.2.22 - Fix ip_ban cleanup: preserve ban_count on cleanup so exponential backoff persists across ban expiry	2026-02-23 17:12:15 -04:00
Your Name	083bc14972	v1.2.21 - Fix IP ban check: use pss->client_ip (proxy-aware) instead of raw socket IP to match failure recording	2026-02-23 16:26:23 -04:00
Your Name	11aaccba9b	v1.2.20 - Add IP auth failure ban system: track failures per IP, ban after threshold with exponential backoff, periodic log stats	2026-02-23 16:02:07 -04:00
Your Name	bd1bbd763d	v1.2.19 - Add IP auth failure ban system: track failures per IP, ban after threshold with exponential backoff, periodic log stats	2026-02-23 16:00:53 -04:00
Your Name	2bd7aa5a10	v1.2.18 - Proactive auth timeout via lws_set_timeout: close idle unauthenticated connections after nip42_auth_timeout_sec even without REQ	2026-02-23 15:37:45 -04:00
Your Name	361912ec85	v1.2.17 - Add nip42_auth_timeout_sec (default 10s): close unauthenticated connections after timeout to prevent connection accumulation	2026-02-23 15:22:18 -04:00
Your Name	0de491382e	v1.2.16 - Fix auth rules UI: change label/placeholder/errors from nsec to npub (public key, not private key)	2026-02-23 14:36:19 -04:00
Your Name	3148bbbee7	v1.2.15 - Admin verification: show 'Waiting for response' with status updates, 60s timeout, no premature access denied	2026-02-23 14:26:02 -04:00
Your Name	3965ba04d8	v1.2.14 - Handle late admin verification response: grant access even if timeout already fired and access-denied overlay was shown	2026-02-23 14:24:55 -04:00
Your Name	b96af938bd	v1.2.13 - Add WoT status to NIP-11 response: restricted_writes, auth_required, and web_of_trust object when WoT enabled	2026-02-23 14:22:08 -04:00
Your Name	89c8248013	v1.2.12 - Increase admin verification timeout from 5s to 30s; continue waiting after publish timeout under heavy load	2026-02-23 14:16:56 -04:00
Your Name	d8f477c6cf	v1.2.11 - Early duplicate check before secp256k1 signature verification — skip crypto for events already in DB	2026-02-23 14:01:23 -04:00
Your Name	040eeadb13	v1.2.10 - Zero-copy message queue: eliminate memcpy in broadcast and REQ paths via queue_message_take_ownership()	2026-02-23 13:45:56 -04:00
Your Name	83f8b0ab88	v1.2.9 - Replace cJSON_GetObjectItem with CaseSensitive variant (178 calls) — eliminates 14% CPU from tolower+linear scan in hot path	2026-02-23 13:25:50 -04:00
Your Name	b82f7eaaf3	v1.2.8 - Add debug build support: _debug suffix in build_static.sh, deploy_lt_debug.sh with perf profiling workflow	2026-02-23 13:07:53 -04:00