fix(events): fail closed on unknown notify state

[cxymds]

Pull Request

Description

Make event destination management fail closed unless Console has a trusted notification-module state and a successful target-list response. Console now prefers notify_enabled from /target/list, falls back to /module-switches only when the field is absent for old-server compatibility, preserves previously trusted rows after refresh failures, and exposes distinct loading, disabled, unverifiable, and load-failure states.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• Performance improvement
• Test improvements
• Security fix

Testing

• Unit tests added/updated
• Manual testing completed

pnpm install --frozen-lockfile
pnpm test:run
pnpm type-check
pnpm lint
pnpm format:check
pnpm build
git diff --check

All 344 tests passed. The production build generated all 32 static routes successfully. Browser smoke testing confirmed the built Console loads without framework or console errors and correctly redirects an unauthenticated /events-target request to login; authenticated state screenshots were not available in the isolated local session.

Checklist

• Code follows the project's style guidelines
• Self-review completed
• TypeScript types are properly defined
• All commit messages are in English (Conventional Commits)
• All existing tests pass
• No new dependencies added, or they are justified

Related Issues

• Part of rustfs/backlog#1360.
• Depends on fix(admin): expose effective notify state rustfs#5097 being deployed across all RustFS nodes before this Console version.
• Follows Event destinations bug in RUSTFS v1.0.0-beta.10 rustfs#5052, fix(notify): restore webhook HTTPS target initialization rustfs#5060, and fix(notify): unify runtime lifecycle coordination rustfs#5088.

Screenshots (if applicable)

N/A. This change reuses existing alerts, buttons, and table surfaces; authenticated runtime states are covered by the production state-module and page contract tests.

Additional Notes

Compatibility behavior is deliberate: a missing notify_enabled field triggers the legacy /module-switches request, but a present null, undefined, string, number, 403, or network failure remains unknown and disables Add/Delete. This prevents delegated administrators from being forced onto the ServerInfoAdminAction permission domain once the new RustFS response is available.

Adversarial validation verdicts:

• Correctness: attacked first-load flashing, explicit false, invalid values, list failure, stale-data retention, fallback failure, and retry recovery; tests cover each state and no unresolved failure remains.
• Simplicity: removed the superseded event-destinations access alias and its duplicate test implementation; the remaining state module is shared by production behavior and direct TypeScript tests.
• Security: attacked permission-domain widening and fail-open paths; only literal true from a trusted response enables mutations, with no authorization changes or sensitive output.
• Concurrency/durability: attacked double refresh, unmount, stale completion, and refresh-over-stale-data paths; the single-flight ref, request version, disabled refresh control, and unmount invalidation prevent state races.
• Compatibility: attacked old servers and delegated administrators; fallback occurs only when the new field is absent, while new servers avoid the extra permission-sensitive request.
• Performance: attacked added request latency and rendering churn; new servers remove the parallel module-switch request and old servers perform one bounded compatibility fallback.
• Test coverage: reverting strict parsing, failure preservation, retry recovery, duplicate-refresh gating, or initial loading causes a named regression test to fail.