fixes

✅ Return MalformedXML when both Days and Years are specified in the same retention configuration
✅ Return 400 (Bad Request) with InvalidRequest when object lock operations are attempted on buckets without object lock enabled
✅ Handle all object lock validation errors consistently with proper error codes

weed/s3api/s3api_object_handlers_put.go

@@ -565,6 +565,10 @@ func mapValidationErrorToS3Error(err error) s3err.ErrorCode {
 		return s3err.ErrMalformedXML
 	case errors.Is(err, ErrInvalidRetentionDateFormat):
 		return s3err.ErrMalformedXML
+	case errors.Is(err, ErrBothDaysAndYearsSpecified):
+		// For cases where both Days and Years are specified, return MalformedXML
+		// This is a specific s3-tests expectation
+		return s3err.ErrMalformedXML
 	case errors.Is(err, ErrInvalidRetentionPeriod):
 		// For invalid retention periods (0 days, negative years, etc.), return InvalidRetentionPeriod
 		// This includes cases where retention values are out of valid ranges

weed/s3api/s3api_object_retention.go

@@ -33,6 +33,7 @@ var (
 	ErrGovernanceBypassNotPermitted = errors.New("user does not have permission to bypass governance retention")
 	ErrInvalidRetentionPeriod       = errors.New("invalid retention period specified")
 	ErrInvalidRetentionMode         = errors.New("invalid retention mode specified")
+	ErrBothDaysAndYearsSpecified    = errors.New("both days and years cannot be specified in the same retention configuration")
 )
 
 const (
@@ -226,7 +227,7 @@ func validateDefaultRetention(retention *DefaultRetention) error {
 	}
 
 	if retention.Days > 0 && retention.Years > 0 {
-		return ErrInvalidRetentionPeriod
+		return ErrBothDaysAndYearsSpecified
 	}
 
 	// Validate ranges
@@ -657,9 +658,9 @@ func (s3a *S3ApiServer) handleObjectLockAvailabilityCheck(w http.ResponseWriter,
 		if errors.Is(err, ErrBucketNotFound) {
 			s3err.WriteErrorResponse(w, request, s3err.ErrNoSuchBucket)
 		} else {
-			// Return InvalidBucketState for object lock operations on buckets without object lock enabled
-			// This matches AWS S3 behavior and s3-tests expectations
-			s3err.WriteErrorResponse(w, request, s3err.ErrInvalidBucketState)
+			// Return InvalidRequest for object lock operations on buckets without object lock enabled
+			// This matches AWS S3 behavior and s3-tests expectations (400 Bad Request)
+			s3err.WriteErrorResponse(w, request, s3err.ErrInvalidRequest)
 		}
 		return false
 	}