rustfs/rustfs · error · ExtensionContractError

ops diagnostics contract must require an admin action

Error message

ops diagnostics contract must require an admin action

What it means

Returned by validate_ops_diagnostics_contract (crates/extension-schema/src/lib.rs:423-425) when requires_admin_action is false. Every ops.diagnostics.v1 extension must bind its diagnostics behind an explicit admin action so that exposure stays access-controlled and auditable. A contract that permits non-admin triggering is invalid by definition.

Source

Thrown at crates/extension-schema/src/lib.rs:266

    #[error("s3 hook contract duplicates hook point {hook_point:?}")]
    DuplicateS3HookPoint { hook_point: S3HookPoint },

    #[error("s3 hook contract cannot mutate object data")]
    S3HookMutatesObjectData,

    #[error("s3 hook contract cannot bypass IAM")]
    S3HookBypassesIam,

    #[error("ops diagnostics contract must declare at least one surface")]
    EmptyOpsDiagnosticSurfaces,

    #[error("ops diagnostics contract duplicates surface {surface:?}")]
    DuplicateOpsDiagnosticSurface { surface: OpsDiagnosticSurface },

    #[error("ops diagnostics contract cannot mutate object data")]
    OpsDiagnosticsMutatesObjectData,

    #[error("ops diagnostics contract must require an admin action")]
    OpsDiagnosticsMissingAdminAction,

    #[error("ops profiler contract must describe capabilities, not execution requests")]
    OpsProfilerExecutionRequest,

    #[error("ops profiler contract must declare at least one backend")]
    EmptyOpsProfilerBackends,

    #[error("ops profiler contract has an empty backend name")]
    EmptyOpsProfilerBackend,

    #[error("ops profiler contract duplicates backend {backend}")]
    DuplicateOpsProfilerBackend { backend: String },

    #[error("ops profiler backend {backend} duplicates redaction field {field:?}")]
    DuplicateOpsProfilerRedactionField {
        backend: String,
        field: OpsProfilerRedactionField,

View on GitHub (pinned to 35af688cd9)

Solutions

1. Set requires_admin_action: true
2. If a public surface is genuinely needed, expose it through the server's built-in health endpoints rather than the extension
3. Re-validate the contract

Example fix

// before
requires_admin_action: false

// after
requires_admin_action: true

if !contract.requires_admin_action {
    return Err(manifest_error("ops diagnostics must be gated behind an admin action"));
}
validate_ops_diagnostics_contract(&contract)?;

fn is_admin_gated(contract: &OpsDiagnosticsContract) -> bool {
    contract.requires_admin_action
}

match validate_ops_diagnostics_contract(&contract) {
    Ok(()) => install(contract),
    Err(ExtensionContractError::OpsDiagnosticsMissingAdminAction) => report_manifest_error(
        "set requires_admin_action: true or use built-in public health endpoints",
    ),
    Err(other) => report_manifest_error(other),
}

When it happens

Trigger: A contract with requires_admin_action: false; a JSON manifest containing "requires_admin_action": false.

Common situations: A template that defaults boolean flags to false; wanting to expose health checks publicly and flipping this flag instead of using the server's built-in public health endpoints.

Related errors

• ops diagnostics contract cannot mutate object data
• ops diagnostics contract must declare at least one surface
• ops diagnostics contract duplicates surface {surface:?}
• ops profiler backend {backend} exports profiles without loca
• ops profiler external runtime must be disabled by default

AI-assisted analysis of rustfs/rustfs@35af688cd9 (2026-08-20). Data as JSON: /api/errors/b684acb7bb1bd192. Report an issue: GitHub.