Add security audit for NIP-29 admin access controls #nip29

[rabble]

Problem

The primary security concern for a NIP-29 client is ensuring that admin-restricted actions are properly gated. While the NIP-42 implementation appears solid, we need to verify that admin UI components properly check permissions.

Security Concerns

• Admin actions available to non-admin users
• Insufficient permission checking in UI
• Potential for privilege escalation
• Group access control bypass

Areas to Audit

• Admin UI component access controls
• Permission checking before admin actions
• Event validation for admin operations
• Role-based access control implementation
• NIP-42 authentication security

Security Requirements

• Only group admins can access admin functions
• Proper role verification before UI display
• Server-side validation (relay enforced)
• Secure event signing and publishing
• Protection against common attack vectors

Acceptance Criteria

• Security audit completed
• Permission checks verified
• Admin UI properly gated
• Security best practices documented
• Penetration testing for group access

Related

This depends on the admin UI components being implemented first (issue #404).

Tags: #nip29