s3: evaluate all conditional write headers under the object lock (#12211)

* filer_pb,filer: per-mutation preconditions on ObjectTransaction

A transaction's request-level condition evaluates one entry before any
mutation runs, so a commit guarding two paths — the object it publishes
and the upload directory it assembles — could not be expressed. Give each
ObjectMutation an optional condition (evaluated against condition_key,
else the mutation's target, under the same lock just before the mutation
applies) and report which mutation failed through failed_mutation on the
response, so callers can tell a mutation guard's rejection apart from the
request-level precondition's.

* s3: evaluate multipart completion conditions under the object lock

CompleteMultipartUpload checked conditional headers gateway-side before
committing, and the routed commit transaction guarded only the upload
directory — nothing made If-None-Match: * atomic with the publish, so
concurrent conditional completions of the same absent key could all
report success.

The request's reducible write condition (If-None-Match/If-Match, star or
single strong ETag) now rides the commit as the transaction's request
condition on the owner filer: on the object path for unversioned buckets,
falling back to the .versions directory for suspended and enabled
versioning. The upload-exists guard moves onto the PUT mutation, keeping
its check-before-publish ordering. Conditions the reducer cannot express
stay on the distributed write lock, where check and commit already
serialize.

* filer,s3: resolve the latest version first for versioned conditional writes

* filer: keep directory entries holding content out of the absent-slot rule

* s3: keep a gateway-side upload-exists check for filers without mutation conditions

* filer: honor null-version-is-latest resolving prefer-alt conditions

* drop scratch multipart-race repro programs

* s3: note the write lock does not cover routed writes on non-reducible conditions

* filer: mirror the gateway's remote-etag precedence in condition evaluation

storedEntryETag only knew the extended attribute and the chunk fallback,
so a synced remote entry compared chunk-derived ETags while the gateway
compares the remote ETag. Follow the same precedence: extended attribute,
remote ETag while the entry still holds the remote bytes, Md5, then the
chunk hash — and no ETag for an entry holding none.

* s3: reduce all conditional write headers into owner-lock clauses

Time-based headers, combined conditions, ETag lists, and weak ETags stayed
on the distributed write lock because buildWriteCondition could not express
them, leaving their gateway check racing owner-routed writes. Reduce every
parseable header form to WriteCondition clauses — multiple clauses compose
AND, ETag candidates carry the raw list for the filer's canonicalization,
and RFC 7232 precedence keeps If-Unmodified-Since hidden by If-Match and
If-Modified-Since hidden by If-None-Match — so the owner filer evaluates
them under the same object-path lock as the commit. Only unparseable
headers still fall back, where the lock path reports the same parse error.

weed/s3api/s3api_object_routed_write.go

@@ -78,9 +78,13 @@ func routeWriteCondition(r *http.Request, uniqueWritePath bool) (*filer_pb.Write
 }
 
 // buildWriteCondition reduces the request's conditional headers to a
-// WriteCondition. ok=false (combined headers, time conditions, ETag lists, weak
-// ETags) keeps gateway-side evaluation under the lock; a nil condition with
-// ok=true means unconditional.
+// WriteCondition evaluated under the owner's object-path lock. Every header
+// form reduces to clauses (ETag lists and weak ETags compare through the same
+// canonicalization the gateway applies; time conditions become unix bounds),
+// composed per RFC 7232 precedence: If-Unmodified-Since is ignored when
+// If-Match is present, If-Modified-Since when If-None-Match is. ok=false only
+// when the headers cannot even parse; a nil condition with ok=true means
+// unconditional.
 func buildWriteCondition(r *http.Request) (*filer_pb.WriteCondition, bool) {
 	headers, errCode := parseConditionalHeaders(r)
 	if errCode != s3err.ErrNone {
@@ -89,31 +93,24 @@ func buildWriteCondition(r *http.Request) (*filer_pb.WriteCondition, bool) {
 	if !headers.isSet {
 		return nil, true
 	}
-	if !headers.ifModifiedSince.IsZero() || !headers.ifUnmodifiedSince.IsZero() {
-		return nil, false
+	var clauses []*filer_pb.WriteCondition_Clause
+	if headers.ifMatch == "*" {
+		clauses = append(clauses, &filer_pb.WriteCondition_Clause{Kind: filer_pb.WriteCondition_IF_EXISTS})
+	} else if headers.ifMatch != "" {
+		clauses = append(clauses, &filer_pb.WriteCondition_Clause{Kind: filer_pb.WriteCondition_IF_ETAG_MATCH, Etags: etagList(headers.ifMatch)})
 	}
-	hasMatch := headers.ifMatch != ""
-	hasNoneMatch := headers.ifNoneMatch != ""
-	switch {
-	case hasMatch && !hasNoneMatch:
-		if headers.ifMatch == "*" {
-			return clause(filer_pb.WriteCondition_IF_EXISTS), true
-		}
-		if etag, single := singleStrongETag(headers.ifMatch); single {
-			return etagClause(filer_pb.WriteCondition_IF_ETAG_MATCH, etag), true
-		}
-		return nil, false
-	case hasNoneMatch && !hasMatch:
-		if headers.ifNoneMatch == "*" {
-			return clause(filer_pb.WriteCondition_IF_NOT_EXISTS), true
-		}
-		if etag, single := singleStrongETag(headers.ifNoneMatch); single {
-			return etagClause(filer_pb.WriteCondition_IF_ETAG_NOT_MATCH, etag), true
-		}
-		return nil, false
-	default:
-		return nil, false
+	if !headers.ifUnmodifiedSince.IsZero() && headers.ifMatch == "" {
+		clauses = append(clauses, &filer_pb.WriteCondition_Clause{Kind: filer_pb.WriteCondition_IF_UNMODIFIED_SINCE, UnixTime: headers.ifUnmodifiedSince.Unix()})
 	}
+	if headers.ifNoneMatch == "*" {
+		clauses = append(clauses, &filer_pb.WriteCondition_Clause{Kind: filer_pb.WriteCondition_IF_NOT_EXISTS})
+	} else if headers.ifNoneMatch != "" {
+		clauses = append(clauses, &filer_pb.WriteCondition_Clause{Kind: filer_pb.WriteCondition_IF_ETAG_NOT_MATCH, Etags: etagList(headers.ifNoneMatch)})
+	}
+	if !headers.ifModifiedSince.IsZero() && headers.ifNoneMatch == "" {
+		clauses = append(clauses, &filer_pb.WriteCondition_Clause{Kind: filer_pb.WriteCondition_IF_MODIFIED_SINCE, UnixTime: headers.ifModifiedSince.Unix()})
+	}
+	return &filer_pb.WriteCondition{Clauses: clauses}, true
 }
 
 // buildDeleteCondition reduces a DeleteObject's If-Match header to a condition;
@@ -154,6 +151,16 @@ func singleStrongETag(v string) (string, bool) {
 	return strings.Trim(v, `"`), true
 }
 
+// etagList splits a conditional ETag header into its candidates, each kept
+// verbatim — the evaluator's canonicalization handles quotes and weak markers.
+func etagList(v string) []string {
+	parts := strings.Split(v, ",")
+	for i := range parts {
+		parts[i] = strings.TrimSpace(parts[i])
+	}
+	return parts
+}
+
 // objectTxnOnFiler applies a routed transaction, preferring the object's owner
 // filer but failing over to a live filer when the owner is unreachable, so a
 // restarted filer's stale ring address (e.g. a rolled K8s pod's old IP) can't hang