feat(admin): add audit target APIs and harden target source handling (#2350)

Signed-off-by: houseme <housemecn@gmail.com>
Co-authored-by: 安正超 <anzhengchao@gmail.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: houseme <4829346+houseme@users.noreply.github.com>

crates/targets/src/target/mod.rs

@@ -21,6 +21,8 @@ use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};
 use std::fmt::Formatter;
 use std::sync::Arc;
+use std::time::{SystemTime, UNIX_EPOCH};
+use tracing::warn;
 
 pub mod mqtt;
 pub mod webhook;
@@ -45,14 +47,43 @@ where
     /// Saves an event (either sends it immediately or stores it for later)
     async fn save(&self, event: Arc<EntityTarget<E>>) -> Result<(), TargetError>;
 
-    /// Sends an event from the store
-    async fn send_from_store(&self, key: Key) -> Result<(), TargetError>;
+    /// Sends an event from the store using the queued raw body and metadata.
+    async fn send_raw_from_store(&self, key: Key, body: Vec<u8>, meta: QueuedPayloadMeta) -> Result<(), TargetError>;
+
+    /// Sends an event from the store.
+    async fn send_from_store(&self, key: Key) -> Result<(), TargetError> {
+        let store = self
+            .store()
+            .ok_or_else(|| TargetError::Configuration("No store configured".to_string()))?;
+
+        let raw = match store.get_raw(&key) {
+            Ok(raw) => raw,
+            Err(StoreError::NotFound) => return Ok(()),
+            Err(err) => return Err(TargetError::Storage(format!("Failed to read queued payload from store: {err}"))),
+        };
+
+        let queued = match QueuedPayload::decode(&raw) {
+            Ok(queued) => queued,
+            Err(err) => {
+                delete_stored_payload(store, &key).map_err(|delete_err| {
+                    TargetError::Storage(format!(
+                        "Failed to delete invalid queued payload {key} after decode error '{err}': {delete_err}"
+                    ))
+                })?;
+                warn!("Dropped invalid queued payload {key}: {err}");
+                return Ok(());
+            }
+        };
+
+        self.send_raw_from_store(key.clone(), queued.body, queued.meta).await?;
+        delete_stored_payload(store, &key)
+    }
 
     /// Closes the target and releases resources
     async fn close(&self) -> Result<(), TargetError>;
 
     /// Returns the store associated with the target (if any)
-    fn store(&self) -> Option<&(dyn Store<EntityTarget<E>, Error = StoreError, Key = Key> + Send + Sync)>;
+    fn store(&self) -> Option<&(dyn Store<QueuedPayload, Error = StoreError, Key = Key> + Send + Sync)>;
 
     /// Returns the type of the target
     fn clone_dyn(&self) -> Box<dyn Target<E> + Send + Sync>;
@@ -78,6 +109,106 @@ where
     pub data: E,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct QueuedPayloadMeta {
+    pub event_name: EventName,
+    pub bucket_name: String,
+    pub object_name: String,
+    pub content_type: String,
+    pub queued_at_unix_ms: u64,
+    pub payload_len: usize,
+}
+
+impl QueuedPayloadMeta {
+    pub fn new(
+        event_name: EventName,
+        bucket_name: String,
+        object_name: String,
+        content_type: impl Into<String>,
+        payload_len: usize,
+    ) -> Self {
+        Self {
+            event_name,
+            bucket_name,
+            object_name,
+            content_type: content_type.into(),
+            queued_at_unix_ms: SystemTime::now().duration_since(UNIX_EPOCH).unwrap_or_default().as_millis() as u64,
+            payload_len,
+        }
+    }
+
+    pub fn best_effort_preview(&self, body: &[u8], limit: usize) -> String {
+        if limit == 0 || body.is_empty() {
+            return String::new();
+        }
+
+        let slice = &body[..body.len().min(limit)];
+        match std::str::from_utf8(slice) {
+            Ok(text) => {
+                if body.len() > limit {
+                    format!("{text}...")
+                } else {
+                    text.to_string()
+                }
+            }
+            Err(_) => format!("<{} bytes binary>", body.len()),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct QueuedPayload {
+    pub meta: QueuedPayloadMeta,
+    pub body: Vec<u8>,
+}
+
+impl QueuedPayload {
+    const MAGIC: [u8; 4] = *b"RQP1";
+
+    pub fn new(meta: QueuedPayloadMeta, body: Vec<u8>) -> Self {
+        Self { meta, body }
+    }
+
+    pub fn encode(&self) -> Result<Vec<u8>, TargetError> {
+        let meta = serde_json::to_vec(&self.meta)
+            .map_err(|err| TargetError::Serialization(format!("Failed to serialize queued payload metadata: {err}")))?;
+        let meta_len = u32::try_from(meta.len())
+            .map_err(|_| TargetError::Serialization("Queued payload metadata is too large".to_string()))?;
+
+        let mut out = Vec::with_capacity(Self::MAGIC.len() + 4 + meta.len() + self.body.len());
+        out.extend_from_slice(&Self::MAGIC);
+        out.extend_from_slice(&meta_len.to_le_bytes());
+        out.extend_from_slice(&meta);
+        out.extend_from_slice(&self.body);
+        Ok(out)
+    }
+
+    pub fn decode(raw: &[u8]) -> Result<Self, TargetError> {
+        if raw.len() < Self::MAGIC.len() + 4 {
+            return Err(TargetError::Serialization("Queued payload is too short".to_string()));
+        }
+        if raw[..Self::MAGIC.len()] != Self::MAGIC {
+            return Err(TargetError::Serialization("Queued payload magic mismatch".to_string()));
+        }
+
+        let mut meta_len_bytes = [0u8; 4];
+        meta_len_bytes.copy_from_slice(&raw[Self::MAGIC.len()..Self::MAGIC.len() + 4]);
+        let meta_len = u32::from_le_bytes(meta_len_bytes) as usize;
+        let meta_start = Self::MAGIC.len() + 4;
+        let meta_end = meta_start + meta_len;
+
+        if meta_end > raw.len() {
+            return Err(TargetError::Serialization("Queued payload metadata length exceeds input".to_string()));
+        }
+
+        let meta = serde_json::from_slice(&raw[meta_start..meta_end])
+            .map_err(|err| TargetError::Serialization(format!("Failed to deserialize queued payload metadata: {err}")))?;
+        let body = raw[meta_end..].to_vec();
+
+        Ok(Self { meta, body })
+    }
+}
+
 /// The `ChannelTargetType` enum represents the different types of channel Target
 /// used in the notification system.
 ///
@@ -187,3 +318,45 @@ pub fn decode_object_name(encoded: &str) -> Result<String, TargetError> {
         .map(|s| s.into_owned())
         .map_err(|e| TargetError::Encoding(format!("Failed to decode object key: {e}")))
 }
+
+pub(crate) fn delete_stored_payload(
+    store: &(dyn Store<QueuedPayload, Error = StoreError, Key = Key> + Send + Sync),
+    key: &Key,
+) -> Result<(), TargetError> {
+    match store.del(key) {
+        Ok(()) | Err(StoreError::NotFound) => Ok(()),
+        Err(err) => Err(TargetError::Storage(format!("Failed to delete event from store: {err}"))),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn queued_payload_round_trips_meta_and_body() {
+        let meta = QueuedPayloadMeta::new(
+            EventName::ObjectCreatedPut,
+            "bucket-a".to_string(),
+            "folder/object.txt".to_string(),
+            "application/json",
+            12,
+        );
+        let payload = QueuedPayload::new(meta.clone(), br#"{"ok":true}"#.to_vec());
+
+        let encoded = payload.encode().unwrap();
+        let decoded = QueuedPayload::decode(&encoded).unwrap();
+
+        assert_eq!(decoded.meta.event_name, meta.event_name);
+        assert_eq!(decoded.meta.bucket_name, meta.bucket_name);
+        assert_eq!(decoded.meta.object_name, meta.object_name);
+        assert_eq!(decoded.meta.content_type, meta.content_type);
+        assert_eq!(decoded.body, br#"{"ok":true}"#);
+    }
+
+    #[test]
+    fn queued_payload_decode_rejects_invalid_magic() {
+        let err = QueuedPayload::decode(b"bad-payload").unwrap_err();
+        assert!(err.to_string().contains("magic") || err.to_string().contains("short"));
+    }
+}

crates/targets/src/target/mqtt.rs

@@ -17,7 +17,7 @@ use crate::{
     arn::TargetID,
     error::TargetError,
     store::{Key, QueueStore, Store},
-    target::{ChannelTargetType, EntityTarget, TargetType},
+    target::{ChannelTargetType, EntityTarget, QueuedPayload, QueuedPayloadMeta, TargetType},
 };
 use async_trait::async_trait;
 use rumqttc::{AsyncClient, ConnectionError, EventLoop, MqttOptions, Outgoing, Packet, QoS, mqttbytes::Error as MqttBytesError};
@@ -25,6 +25,7 @@ use serde::Serialize;
 use serde::de::DeserializeOwned;
 use std::sync::Arc;
 use std::{
+    marker::PhantomData,
     path::PathBuf,
     sync::atomic::{AtomicBool, Ordering},
     time::Duration,
@@ -110,9 +111,10 @@ where
     id: TargetID,
     args: MQTTArgs,
     client: Arc<Mutex<Option<AsyncClient>>>,
-    store: Option<Box<dyn Store<EntityTarget<E>, Error = StoreError, Key = Key> + Send + Sync>>,
+    store: Option<Box<dyn Store<QueuedPayload, Error = StoreError, Key = Key> + Send + Sync>>,
     connected: Arc<AtomicBool>,
     bg_task_manager: Arc<BgTaskManager>,
+    _phantom: PhantomData<E>,
 }
 
 impl<E> MQTTTarget<E>
@@ -135,7 +137,7 @@ where
                 TargetType::NotifyEvent => rustfs_config::notify::NOTIFY_STORE_EXTENSION,
             };
 
-            let store = QueueStore::<EntityTarget<E>>::new(specific_queue_path, args.queue_limit, extension);
+            let store = QueueStore::<QueuedPayload>::new(specific_queue_path, args.queue_limit, extension);
             if let Err(e) = store.open() {
                 error!(
                     target_id = %target_id,
@@ -144,7 +146,7 @@ where
                 );
                 return Err(TargetError::Storage(format!("{e}")));
             }
-            Some(Box::new(store) as Box<dyn Store<EntityTarget<E>, Error = StoreError, Key = Key> + Send + Sync>)
+            Some(Box::new(store) as Box<dyn Store<QueuedPayload, Error = StoreError, Key = Key> + Send + Sync>)
         } else {
             None
         };
@@ -157,13 +159,14 @@ where
         });
 
         info!(target_id = %target_id, "MQTT target created");
-        Ok(MQTTTarget {
+        Ok(MQTTTarget::<E> {
             id: target_id,
             args,
             client: Arc::new(Mutex::new(None)),
             store: queue_store,
             connected: Arc::new(AtomicBool::new(false)),
             bg_task_manager,
+            _phantom: PhantomData,
         })
     }
 
@@ -251,14 +254,7 @@ where
         }
     }
 
-    #[instrument(skip(self, event), fields(target_id = %self.id))]
-    async fn send(&self, event: &EntityTarget<E>) -> Result<(), TargetError> {
-        let client_guard = self.client.lock().await;
-        let client = client_guard
-            .as_ref()
-            .ok_or_else(|| TargetError::Configuration("MQTT client not initialized".to_string()))?;
-
-        // Decode form-urlencoded object name
+    fn build_queued_payload(&self, event: &EntityTarget<E>) -> Result<QueuedPayload, TargetError> {
         let object_name = crate::target::decode_object_name(&event.object_name)?;
 
         let key = format!("{}/{}", event.bucket_name, object_name);
@@ -269,14 +265,35 @@ where
             records: vec![event.clone()],
         };
 
-        let data = serde_json::to_vec(&log).map_err(|e| TargetError::Serialization(format!("Failed to serialize event: {e}")))?;
+        let body = serde_json::to_vec(&log).map_err(|e| TargetError::Serialization(format!("Failed to serialize event: {e}")))?;
+        let meta = QueuedPayloadMeta::new(
+            event.event_name,
+            event.bucket_name.clone(),
+            event.object_name.clone(),
+            "application/json",
+            body.len(),
+        );
+        Ok(QueuedPayload::new(meta, body))
+    }
 
-        let data_string = String::from_utf8(data.clone())
-            .map_err(|e| TargetError::Encoding(format!("Failed to convert event data to UTF-8: {e}")))?;
-        debug!("Sending event to mqtt target: {}, event log: {}", self.id, data_string);
+    #[instrument(skip(self, body, meta), fields(target_id = %self.id))]
+    async fn send_body(&self, body: Vec<u8>, meta: &QueuedPayloadMeta) -> Result<(), TargetError> {
+        let client_guard = self.client.lock().await;
+        let client = client_guard
+            .as_ref()
+            .ok_or_else(|| TargetError::Configuration("MQTT client not initialized".to_string()))?;
+
+        debug!(
+            target = %self.id,
+            bucket = %meta.bucket_name,
+            object = %meta.object_name,
+            event = %meta.event_name,
+            preview = %meta.best_effort_preview(&body, 256),
+            "Sending MQTT payload"
+        );
 
         client
-            .publish(&self.args.topic, self.args.qos, false, data)
+            .publish(&self.args.topic, self.args.qos, false, body)
             .await
             .map_err(|e| {
                 if e.to_string().contains("Connection") || e.to_string().contains("Timeout") {
@@ -293,13 +310,14 @@ where
     }
 
     pub fn clone_target(&self) -> Box<dyn Target<E> + Send + Sync> {
-        Box::new(MQTTTarget {
+        Box::new(MQTTTarget::<E> {
             id: self.id.clone(),
             args: self.args.clone(),
             client: self.client.clone(),
             store: self.store.as_ref().map(|s| s.boxed_clone()),
             connected: self.connected.clone(),
             bg_task_manager: self.bg_task_manager.clone(),
+            _phantom: PhantomData,
         })
     }
 }
@@ -494,11 +512,15 @@ where
 
     #[instrument(skip(self, event), fields(target_id = %self.id))]
     async fn save(&self, event: Arc<EntityTarget<E>>) -> Result<(), TargetError> {
+        let queued = self.build_queued_payload(&event)?;
+
         if let Some(store) = &self.store {
             debug!(target_id = %self.id, "Event saved to store start");
-            // If store is configured, ONLY put the event into the store.
-            // Do NOT send it directly here.
-            match store.put(event.clone()) {
+            match store.put_raw(
+                &queued
+                    .encode()
+                    .map_err(|e| TargetError::Storage(format!("Failed to encode queued payload: {e}")))?,
+            ) {
                 Ok(_) => {
                     debug!(target_id = %self.id, "Event saved to store for MQTT target successfully.");
                     Ok(())
@@ -516,7 +538,7 @@ where
             if !self.connected.load(Ordering::SeqCst) {
                 warn!(target_id = %self.id, "Attempting to send directly but not connected; trying to init.");
                 // Call the struct's init method, not the trait's default
-                match MQTTTarget::init(self).await {
+                match MQTTTarget::<E>::init(self).await {
                     Ok(_) => debug!(target_id = %self.id, "MQTT target initialized successfully."),
                     Err(e) => {
                         error!(target_id = %self.id, error = %e, "Failed to initialize MQTT target.");
@@ -528,13 +550,13 @@ where
                     return Err(TargetError::NotConnected);
                 }
             }
-            self.send(&event).await
+            self.send_body(queued.body, &queued.meta).await
         }
     }
 
-    #[instrument(skip(self), fields(target_id = %self.id))]
-    async fn send_from_store(&self, key: Key) -> Result<(), TargetError> {
-        debug!(target_id = %self.id, ?key, "Attempting to send event from store with key.");
+    #[instrument(skip(self, body, meta), fields(target_id = %self.id))]
+    async fn send_raw_from_store(&self, key: Key, body: Vec<u8>, meta: QueuedPayloadMeta) -> Result<(), TargetError> {
+        debug!(target_id = %self.id, ?key, "Attempting to send queued payload from store.");
 
         if !self.is_enabled() {
             return Err(TargetError::Disabled);
@@ -542,7 +564,7 @@ where
 
         if !self.connected.load(Ordering::SeqCst) {
             warn!(target_id = %self.id, "Not connected; trying to init before sending from store.");
-            match MQTTTarget::init(self).await {
+            match MQTTTarget::<E>::init(self).await {
                 Ok(_) => debug!(target_id = %self.id, "MQTT target initialized successfully."),
                 Err(e) => {
                     error!(target_id = %self.id, error = %e, "Failed to initialize MQTT target.");
@@ -555,33 +577,8 @@ where
             }
         }
 
-        let store = self
-            .store
-            .as_ref()
-            .ok_or_else(|| TargetError::Configuration("No store configured".to_string()))?;
-
-        let event = match store.get(&key) {
-            Ok(event) => {
-                debug!(target_id = %self.id, ?key, "Retrieved event from store for sending.");
-                event
-            }
-            Err(StoreError::NotFound) => {
-                // Assuming NotFound takes the key
-                debug!(target_id = %self.id, ?key, "Event not found in store for sending.");
-                return Ok(());
-            }
-            Err(e) => {
-                error!(
-                    target_id = %self.id,
-                    error = %e,
-                    "Failed to get event from store"
-                );
-                return Err(TargetError::Storage(format!("Failed to get event from store: {e}")));
-            }
-        };
-
         debug!(target_id = %self.id, ?key, "Sending event from store.");
-        if let Err(e) = self.send(&event).await {
+        if let Err(e) = self.send_body(body, &meta).await {
             if matches!(e, TargetError::NotConnected) {
                 warn!(target_id = %self.id, "Failed to send event from store: Not connected. Event remains in store.");
                 return Err(TargetError::NotConnected);
@@ -589,22 +586,7 @@ where
             error!(target_id = %self.id, error = %e, "Failed to send event from store with an unexpected error.");
             return Err(e);
         }
-        debug!(target_id = %self.id, ?key, "Event sent from store successfully. deleting from store. ");
-
-        match store.del(&key) {
-            Ok(_) => {
-                debug!(target_id = %self.id, ?key, "Event deleted from store after successful send.")
-            }
-            Err(StoreError::NotFound) => {
-                debug!(target_id = %self.id, ?key, "Event already deleted from store.");
-            }
-            Err(e) => {
-                error!(target_id = %self.id, error = %e, "Failed to delete event from store after send.");
-                return Err(TargetError::Storage(format!("Failed to delete event from store: {e}")));
-            }
-        }
-
-        debug!(target_id = %self.id, ?key, "Event deleted from store.");
+        debug!(target_id = %self.id, ?key, "Event sent from store successfully.");
         Ok(())
     }
 
@@ -637,7 +619,7 @@ where
         Ok(())
     }
 
-    fn store(&self) -> Option<&(dyn Store<EntityTarget<E>, Error = StoreError, Key = Key> + Send + Sync)> {
+    fn store(&self) -> Option<&(dyn Store<QueuedPayload, Error = StoreError, Key = Key> + Send + Sync)> {
         self.store.as_deref()
     }
 
@@ -651,7 +633,7 @@ where
             return Ok(());
         }
         // Call the internal init logic
-        MQTTTarget::init(self).await
+        MQTTTarget::<E>::init(self).await
     }
 
     fn is_enabled(&self) -> bool {

crates/targets/src/target/webhook.rs

@@ -17,7 +17,7 @@ use crate::{
     arn::TargetID,
     error::TargetError,
     store::{Key, QueueStore, Store},
-    target::{ChannelTargetType, EntityTarget, TargetType},
+    target::{ChannelTargetType, EntityTarget, QueuedPayload, QueuedPayloadMeta, TargetType},
 };
 use async_trait::async_trait;
 use reqwest::{Client, StatusCode, Url};
@@ -26,6 +26,7 @@ use rustfs_config::notify::NOTIFY_STORE_EXTENSION;
 use serde::Serialize;
 use serde::de::DeserializeOwned;
 use std::{
+    marker::PhantomData,
     path::PathBuf,
     sync::{
         Arc,
@@ -33,7 +34,6 @@ use std::{
     },
     time::Duration,
 };
-use tokio::net::lookup_host;
 use tokio::sync::mpsc;
 use tracing::{debug, error, info, instrument, warn};
 
@@ -105,10 +105,10 @@ where
     args: WebhookArgs,
     http_client: Arc<Client>,
     // Add Send + Sync constraints to ensure thread safety
-    store: Option<Box<dyn Store<EntityTarget<E>, Error = StoreError, Key = Key> + Send + Sync>>,
+    store: Option<Box<dyn Store<QueuedPayload, Error = StoreError, Key = Key> + Send + Sync>>,
     initialized: AtomicBool,
-    addr: String,
     cancel_sender: mpsc::Sender<()>,
+    _phantom: PhantomData<E>,
 }
 
 impl<E> WebhookTarget<E>
@@ -117,14 +117,14 @@ where
 {
     /// Clones the WebhookTarget, creating a new instance with the same configuration
     pub fn clone_box(&self) -> Box<dyn Target<E> + Send + Sync> {
-        Box::new(WebhookTarget {
+        Box::new(WebhookTarget::<E> {
             id: self.id.clone(),
             args: self.args.clone(),
             http_client: Arc::clone(&self.http_client),
             store: self.store.as_ref().map(|s| s.boxed_clone()),
             initialized: AtomicBool::new(self.initialized.load(Ordering::SeqCst)),
-            addr: self.addr.clone(),
             cancel_sender: self.cancel_sender.clone(),
+            _phantom: PhantomData,
         })
     }
 
@@ -149,7 +149,7 @@ where
                 TargetType::NotifyEvent => NOTIFY_STORE_EXTENSION,
             };
 
-            let store = QueueStore::<EntityTarget<E>>::new(queue_dir, args.queue_limit, extension);
+            let store = QueueStore::<QueuedPayload>::new(queue_dir, args.queue_limit, extension);
 
             if let Err(e) = store.open() {
                 error!("Failed to open store for Webhook target {}: {}", target_id.id, e);
@@ -157,32 +157,22 @@ where
             }
 
             // Make sure that the Store trait implemented by QueueStore matches the expected error type
-            Some(Box::new(store) as Box<dyn Store<EntityTarget<E>, Error = StoreError, Key = Key> + Send + Sync>)
+            Some(Box::new(store) as Box<dyn Store<QueuedPayload, Error = StoreError, Key = Key> + Send + Sync>)
         } else {
             None
         };
 
-        // resolved address
-        let addr = {
-            let host = args.endpoint.host_str().unwrap_or("localhost");
-            let port = args
-                .endpoint
-                .port()
-                .unwrap_or_else(|| if args.endpoint.scheme() == "https" { 443 } else { 80 });
-            format!("{host}:{port}")
-        };
-
         // Create a cancel channel
         let (cancel_sender, _) = mpsc::channel(1);
         info!(target_id = %target_id.id, "Webhook target created");
-        Ok(WebhookTarget {
+        Ok(WebhookTarget::<E> {
             id: target_id,
             args,
             http_client,
             store: queue_store,
             initialized: AtomicBool::new(false),
-            addr,
             cancel_sender,
+            _phantom: PhantomData,
         })
     }
 
@@ -226,53 +216,80 @@ where
             .map_err(|e| TargetError::Configuration(format!("Failed to build HTTP client: {e}")))
     }
 
-    async fn init(&self) -> Result<(), TargetError> {
-        // Use CAS operations to ensure thread-safe initialization
-        if !self.initialized.load(Ordering::SeqCst) {
-            // Check the connection
-            match self.is_active().await {
-                Ok(true) => {
-                    info!("Webhook target {} is active", self.id);
-                }
-                Ok(false) => {
-                    return Err(TargetError::NotConnected);
-                }
-                Err(e) => {
-                    error!("Failed to check if Webhook target {} is active: {}", self.id, e);
-                    return Err(e);
+    async fn init_inner(&self) -> Result<(), TargetError> {
+        if self.initialized.load(Ordering::SeqCst) {
+            return Ok(());
+        }
+
+        // HTTP HEAD probe: verifies the full request path (proxy, TLS, firewall)
+        // unlike TCP connect which can't detect proxy issues.
+        let probe_timeout = Duration::from_secs(5);
+        match tokio::time::timeout(probe_timeout, self.http_client.head(self.args.endpoint.as_str()).send()).await {
+            Ok(Ok(resp)) => {
+                let status = resp.status();
+                if status.is_success() || status == StatusCode::NOT_FOUND {
+                    // NOT_FOUND is acceptable for HEAD probes — the endpoint may not
+                    // exist as a HEAD route, but the server is reachable.
+                    debug!("Webhook target {} HEAD probe returned {}", self.id, status);
+                } else if status == StatusCode::METHOD_NOT_ALLOWED {
+                    // Server is reachable but doesn't support HEAD — still valid.
+                    debug!("Webhook target {} HEAD probe: METHOD_NOT_ALLOWED (reachable)", self.id);
+                } else {
+                    warn!("Webhook target {} HEAD probe returned {}", self.id, status);
                 }
             }
-            self.initialized.store(true, Ordering::SeqCst);
-            info!("Webhook target {} initialized", self.id);
+            Ok(Err(e)) => {
+                // Connection-level error (DNS, TLS, refused, timeout)
+                return Err(if e.is_timeout() || e.is_connect() {
+                    TargetError::NotConnected
+                } else {
+                    TargetError::Network(format!("Webhook HEAD probe failed: {e}"))
+                });
+            }
+            Err(_) => {
+                return Err(TargetError::Timeout("Webhook HEAD probe timed out".to_string()));
+            }
         }
+
+        self.initialized.store(true, Ordering::SeqCst);
+        info!("Webhook target {} initialized", self.id);
         Ok(())
     }
 
-    async fn send(&self, event: &EntityTarget<E>) -> Result<(), TargetError> {
-        info!("Webhook Sending event to webhook target: {}", self.id);
-        // Decode form-urlencoded object name
+    fn build_queued_payload(&self, event: &EntityTarget<E>) -> Result<QueuedPayload, TargetError> {
         let object_name = crate::target::decode_object_name(&event.object_name)?;
-
         let key = format!("{}/{}", event.bucket_name, object_name);
-
         let log = TargetLog {
             event_name: event.event_name,
             key,
             records: vec![event.data.clone()],
         };
+        let body = serde_json::to_vec(&log).map_err(|e| TargetError::Serialization(format!("Failed to serialize event: {e}")))?;
+        let meta = QueuedPayloadMeta::new(
+            event.event_name,
+            event.bucket_name.clone(),
+            event.object_name.clone(),
+            "application/json",
+            body.len(),
+        );
+        Ok(QueuedPayload::new(meta, body))
+    }
 
-        let data = serde_json::to_vec(&log).map_err(|e| TargetError::Serialization(format!("Failed to serialize event: {e}")))?;
+    async fn send_body(&self, body: Vec<u8>, meta: &QueuedPayloadMeta) -> Result<(), TargetError> {
+        info!("Webhook sending queued payload to target: {}", self.id);
+        debug!(
+            target = %self.id,
+            bucket = %meta.bucket_name,
+            object = %meta.object_name,
+            event = %meta.event_name,
+            preview = %meta.best_effort_preview(&body, 256),
+            "Sending webhook payload"
+        );
 
-        // Vec<u8> Convert to String
-        let data_string = String::from_utf8(data.clone())
-            .map_err(|e| TargetError::Encoding(format!("Failed to convert event data to UTF-8: {e}")))?;
-        debug!("Sending event to webhook target: {}, event log: {}", self.id, data_string);
-
-        // build request
         let mut req_builder = self
             .http_client
             .post(self.args.endpoint.as_str())
-            .header("Content-Type", "application/json");
+            .header("Content-Type", meta.content_type.as_str());
 
         if !self.args.auth_token.is_empty() {
             // Split auth_token string to check if the authentication type is included
@@ -293,7 +310,7 @@ where
         }
 
         // Send a request
-        let resp = req_builder.body(data).send().await.map_err(|e| {
+        let resp = req_builder.body(body).send().await.map_err(|e| {
             if e.is_timeout() || e.is_connect() {
                 TargetError::NotConnected
             } else {
@@ -329,34 +346,39 @@ where
     }
 
     async fn is_active(&self) -> Result<bool, TargetError> {
-        let socket_addr = lookup_host(&self.addr)
-            .await
-            .map_err(|e| TargetError::Network(format!("Failed to resolve host: {e}")))?
-            .next()
-            .ok_or_else(|| TargetError::Network("No address found".to_string()))?;
-        debug!("is_active socket addr: {},target id:{}", socket_addr, self.id.id);
-        match tokio::time::timeout(Duration::from_secs(5), tokio::net::TcpStream::connect(socket_addr)).await {
-            Ok(Ok(_)) => {
-                debug!("Connection to {} is active", self.addr);
-                Ok(true)
-            }
-            Ok(Err(e)) => {
-                debug!("Connection to {} failed: {}", self.addr, e);
-                if e.kind() == std::io::ErrorKind::ConnectionRefused {
-                    Err(TargetError::NotConnected)
+        match tokio::time::timeout(Duration::from_secs(5), self.http_client.head(self.args.endpoint.as_str()).send()).await {
+            Ok(Ok(resp)) => {
+                let status = resp.status();
+                if status.is_server_error() {
+                    debug!("Webhook {} server error: {}", self.id, status);
+                    Ok(false)
                 } else {
-                    Err(TargetError::Network(format!("Connection failed: {e}")))
+                    debug!("Webhook {} is reachable (status: {})", self.id, status);
+                    Ok(true)
                 }
             }
-            Err(_) => Err(TargetError::Timeout("Connection timed out".to_string())),
+            Ok(Err(e)) => {
+                debug!("Webhook {} request failed: {}", self.id, e);
+                if e.is_timeout() || e.is_connect() {
+                    Err(TargetError::NotConnected)
+                } else {
+                    Err(TargetError::Network(format!("Webhook health check failed: {e}")))
+                }
+            }
+            Err(_) => Err(TargetError::Timeout("Webhook health check timed out".to_string())),
         }
     }
 
     async fn save(&self, event: Arc<EntityTarget<E>>) -> Result<(), TargetError> {
+        let queued = self.build_queued_payload(&event)?;
+
         if let Some(store) = &self.store {
-            // Call the store method directly, no longer need to acquire the lock
             store
-                .put(event)
+                .put_raw(
+                    &queued
+                        .encode()
+                        .map_err(|e| TargetError::Storage(format!("Failed to encode queued payload: {e}")))?,
+                )
                 .map_err(|e| TargetError::Storage(format!("Failed to save event to store: {e}")))?;
             debug!("Event saved to store for target: {}", self.id);
             Ok(())
@@ -368,12 +390,12 @@ where
                     return Err(TargetError::NotConnected);
                 }
             }
-            self.send(&event).await
+            self.send_body(queued.body, &queued.meta).await
         }
     }
 
-    async fn send_from_store(&self, key: Key) -> Result<(), TargetError> {
-        debug!("Sending event from store for target: {}", self.id);
+    async fn send_raw_from_store(&self, key: Key, body: Vec<u8>, meta: QueuedPayloadMeta) -> Result<(), TargetError> {
+        debug!("Sending queued payload from store for target: {}, key: {}", self.id, key);
         match self.init().await {
             Ok(_) => {
                 debug!("Event sent to store for target: {}", self.name());
@@ -384,37 +406,13 @@ where
             }
         }
 
-        let store = self
-            .store
-            .as_ref()
-            .ok_or_else(|| TargetError::Configuration("No store configured".to_string()))?;
-
-        // Get events directly from the store, no longer need to acquire locks
-        let event = match store.get(&key) {
-            Ok(event) => event,
-            Err(StoreError::NotFound) => return Ok(()),
-            Err(e) => {
-                return Err(TargetError::Storage(format!("Failed to get event from store: {e}")));
-            }
-        };
-
-        if let Err(e) = self.send(&event).await {
+        if let Err(e) = self.send_body(body, &meta).await {
             if let TargetError::NotConnected = e {
                 return Err(TargetError::NotConnected);
             }
             return Err(e);
         }
 
-        // Use the immutable reference of the store to delete the event content corresponding to the key
-        debug!("Deleting event from store for target: {}, key:{}, start", self.id, key.to_string());
-        match store.del(&key) {
-            Ok(_) => debug!("Event deleted from store for target: {}, key:{}, end", self.id, key.to_string()),
-            Err(e) => {
-                error!("Failed to delete event from store: {}", e);
-                return Err(TargetError::Storage(format!("Failed to delete event from store: {e}")));
-            }
-        }
-
         debug!("Event sent from store and deleted for target: {}", self.id);
         Ok(())
     }
@@ -426,7 +424,7 @@ where
         Ok(())
     }
 
-    fn store(&self) -> Option<&(dyn Store<EntityTarget<E>, Error = StoreError, Key = Key> + Send + Sync)> {
+    fn store(&self) -> Option<&(dyn Store<QueuedPayload, Error = StoreError, Key = Key> + Send + Sync)> {
         // Returns the reference to the internal store
         self.store.as_deref()
     }
@@ -436,14 +434,11 @@ where
     }
 
     async fn init(&self) -> Result<(), TargetError> {
-        // If the target is disabled, return to success directly
         if !self.is_enabled() {
             debug!("Webhook target {} is disabled, skipping initialization", self.id);
             return Ok(());
         }
-
-        // Use existing initialization logic
-        WebhookTarget::init(self).await
+        self.init_inner().await
     }
 
     fn is_enabled(&self) -> bool {