2 files changed, 10 insertions, 0 deletions

diff --git a/internal/handler/websocket/handler.go b/internal/handler/websocket/handler.go
index de71926..dfe7b9e 100644
--- a/internal/handler/websocket/handler.go
+++ b/internal/handler/websocket/handler.go
@@ -33,6 +33,7 @@ type MetricsRecorder interface {
         DecrementSubscriptions()
         SetActiveSubscriptions(count int)
         RecordRequest(method, status string, duration float64)
+        RecordAuthAttempt(success bool)
         RecordBlockedEvent(kind int32)
 }
 
@@ -522,6 +523,13 @@ func (h *Handler) sendAuthChallenge(ctx context.Context, conn *websocket.Conn, c
 }
 
 func (h *Handler) handleAuth(ctx context.Context, conn *websocket.Conn, raw []json.RawMessage, state *connState) error {
+        success := false
+        defer func() {
+                if h.metrics != nil {
+                        h.metrics.RecordAuthAttempt(success)
+                }
+        }()
+
         if len(raw) != 2 {
                 return fmt.Errorf("AUTH expects 2 elements")
         }
@@ -560,6 +568,7 @@ func (h *Handler) handleAuth(ctx context.Context, conn *websocket.Conn, raw []js
         state.authenticatedPubkey = authEvent.PubKey
         log.Printf("WebSocket client authenticated: %s", authEvent.PubKey[:16])
 
+        success = true
         // Don't send OK for AUTH - it's not an EVENT
         return nil
 }
diff --git a/internal/handler/websocket/handler_test.go b/internal/handler/websocket/handler_test.go
index 9982aea..10405b2 100644
--- a/internal/handler/websocket/handler_test.go
+++ b/internal/handler/websocket/handler_test.go
@@ -97,6 +97,7 @@ func (m *mockMetrics) RecordRequest(method, status string, duration float64) {
         key := fmt.Sprintf("%s:%s", method, status)
         m.requests[key]++
 }
+func (m *mockMetrics) RecordAuthAttempt(success bool) {}
 func (m *mockMetrics) RecordBlockedEvent(kind int32) {
         m.mu.Lock()
         defer m.mu.Unlock()