1 files changed, 10 insertions, 8 deletions

diff --git a/internal/handler/websocket/handler.go b/internal/handler/websocket/handler.go
index 5201698..a23dd60 100644
--- a/internal/handler/websocket/handler.go
+++ b/internal/handler/websocket/handler.go
@@ -257,18 +257,19 @@ func (h *Handler) handleEvent(ctx context.Context, conn *websocket.Conn, raw []j
                 return fmt.Errorf("EVENT expects 2 elements")
         }
 
-        if err := h.requireAuth(ctx, conn, true, state); err != nil {
-                status = "error"
-                return err
-        }
-
-        // Parse event to get ID for OK response
+        // Parse event first to get ID for error responses
         var event nostr.Event
         if err := json.Unmarshal(raw[1], &event); err != nil {
                 status = "error"
                 return fmt.Errorf("invalid event: %w", err)
         }
 
+        if err := h.requireAuth(ctx, conn, true, state); err != nil {
+                status = "error"
+                h.sendOK(ctx, conn, event.ID, false, err.Error())
+                return nil
+        }
+
         if state.authenticatedPubkey == "" && h.authConfig != nil && h.authConfig.WriteEnabled {
                 status = "unauthenticated"
                 h.sendOK(ctx, conn, event.ID, false, "auth-required: authentication required")
@@ -283,7 +284,8 @@ func (h *Handler) handleEvent(ctx context.Context, conn *websocket.Conn, raw []j
                 }
                 if !h.limiter.Allow(identifier, "EVENT") {
                         status = "rate_limited"
-                        return fmt.Errorf("rate limit exceeded")
+                        h.sendOK(ctx, conn, event.ID, false, "rate-limited: slow down")
+                        return nil
                 }
         }
 
@@ -558,7 +560,7 @@ func (h *Handler) handleAuth(ctx context.Context, conn *websocket.Conn, raw []js
         state.authenticatedPubkey = authEvent.PubKey
         log.Printf("WebSocket client authenticated: %s", authEvent.PubKey[:16])
 
-        h.sendOK(ctx, conn, authEvent.ID, true, "")
+        // Don't send OK for AUTH - it's not an EVENT
         return nil
 }