refactor(plugins): harden target-plugin system and admin plugin contract (#4217)

crates/targets/src/catalog/builtin.rs

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+use crate::plugin::PluginEvent;
 use crate::plugin::{
     BuiltinTargetAdminDescriptor, BuiltinTargetDescriptor, TargetAdminMetadata, TargetPluginDescriptor, TargetRequestValidator,
     boxed_target,
@@ -36,8 +37,6 @@ use rustfs_config::{
         AUDIT_POSTGRES_SUB_SYS, AUDIT_PULSAR_SUB_SYS, AUDIT_REDIS_SUB_SYS, AUDIT_WEBHOOK_SUB_SYS,
     },
 };
-use serde::Serialize;
-use serde::de::DeserializeOwned;
 
 use crate::config::{
     build_amqp_args, build_kafka_args, build_mqtt_args, build_mysql_args, build_nats_args, build_postgres_args,
@@ -57,7 +56,7 @@ fn build_descriptor<E, Create, Validate>(
     create_target: Create,
 ) -> BuiltinTargetDescriptor<E>
 where
-    E: Send + Sync + 'static + Clone + Serialize + DeserializeOwned,
+    E: PluginEvent,
     Create: Fn(String, &KVS) -> Result<BoxedTarget<E>, TargetError> + Send + Sync + 'static,
     Validate: Fn(&KVS) -> Result<(), TargetError> + Send + Sync + 'static,
 {
@@ -145,7 +144,7 @@ pub fn builtin_audit_target_admin_descriptors() -> Vec<BuiltinTargetAdminDescrip
 
 pub fn builtin_audit_target_descriptors<E>() -> Vec<BuiltinTargetDescriptor<E>>
 where
-    E: Send + Sync + 'static + Clone + Serialize + DeserializeOwned,
+    E: PluginEvent,
 {
     vec![
         build_descriptor(
@@ -317,7 +316,7 @@ pub fn builtin_notify_target_admin_descriptors() -> Vec<BuiltinTargetAdminDescri
 
 pub fn builtin_notify_target_descriptors<E>() -> Vec<BuiltinTargetDescriptor<E>>
 where
-    E: Send + Sync + 'static + Clone + Serialize + DeserializeOwned,
+    E: PluginEvent,
 {
     vec![
         build_descriptor(

crates/targets/src/catalog/extension.rs

@@ -341,7 +341,6 @@ mod tests {
                 S3HookPoint::PostAuthListObjects,
             ]
         );
-        assert!(contract.hook_points.iter().all(|hook_point| hook_point.is_post_auth()));
         assert!(!contract.mutates_object_data);
         assert!(!contract.bypasses_iam);
         assert!(validate_s3_hook_contract(&contract).is_ok());

crates/targets/src/catalog/mod.rs

@@ -33,6 +33,14 @@ pub struct ExampleInstallableTargetPlugin {
     pub valid_fields: Vec<String>,
 }
 
+/// Test/demo fixture describing what an installable external plugin would
+/// look like. It must never be exposed through production admin responses;
+/// it exists so control-plane planning and contract tests can exercise the
+/// external-plugin shape before a real marketplace source exists.
+/// Test/demo fixture describing what an installable external plugin would
+/// look like. It must never be exposed through production admin responses;
+/// it exists so control-plane planning and contract tests can exercise the
+/// external-plugin shape before a real marketplace source exists.
 pub fn example_external_webhook_plugin() -> ExampleInstallableTargetPlugin {
     let base = TargetPluginManifest {
         plugin_id: "external:webhook-sidecar",
@@ -55,7 +63,7 @@ pub fn example_external_webhook_plugin() -> ExampleInstallableTargetPlugin {
                 artifact_id: "sidecar-linux-amd64",
                 target_triple: "x86_64-unknown-linux-gnu",
                 download_uri: "https://plugins.example.test/webhook-sidecar.tar.zst",
-                digest_sha256: "0123456789abcdef0123456789abcdef",
+                digest_sha256: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
                 signature_uri: "https://plugins.example.test/webhook-sidecar.tar.zst.sig",
                 provenance_uri: "https://plugins.example.test/webhook-sidecar.tar.zst.intoto.jsonl",
                 size_bytes: 8192,
@@ -88,7 +96,7 @@ pub fn example_external_webhook_plugin() -> ExampleInstallableTargetPlugin {
         manifest,
         installation: external_target_plugin_installation(
             base.version,
-            "0123456789abcdef0123456789abcdef",
+            "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
             "sidecar-linux-amd64",
             Some("2026-05-13T20:00:00Z".to_string()),
         ),