implement PubObjectRetention and WORM

weed/s3api/s3_constants/extend_key.go

@@ -11,4 +11,25 @@ const (
 	ExtETagKey                  = "Seaweed-X-Amz-ETag"
 	ExtLatestVersionIdKey       = "Seaweed-X-Amz-Latest-Version-Id"
 	ExtLatestVersionFileNameKey = "Seaweed-X-Amz-Latest-Version-File-Name"
+
+	// Object Retention and Legal Hold
+	ExtRetentionModeKey      = "Seaweed-X-Amz-Retention-Mode"
+	ExtRetentionUntilDateKey = "Seaweed-X-Amz-Retention-Until-Date"
+	ExtLegalHoldKey          = "Seaweed-X-Amz-Legal-Hold"
+	ExtObjectLockEnabledKey  = "Seaweed-X-Amz-Object-Lock-Enabled"
+	ExtObjectLockConfigKey   = "Seaweed-X-Amz-Object-Lock-Config"
+)
+
+// Object Lock and Retention Constants
+const (
+	// Retention modes
+	RetentionModeGovernance = "GOVERNANCE"
+	RetentionModeCompliance = "COMPLIANCE"
+
+	// Legal hold status
+	LegalHoldOn  = "ON"
+	LegalHoldOff = "OFF"
+
+	// Object lock enabled status
+	ObjectLockEnabled = "Enabled"
 )

weed/s3api/s3api_object_handlers_delete.go

@@ -49,6 +49,14 @@ func (s3a *S3ApiServer) DeleteObjectHandler(w http.ResponseWriter, r *http.Reque
 		auditLog = s3err.GetAccessLog(r, http.StatusNoContent, s3err.ErrNone)
 	}
 
+	// Check object lock permissions before deletion
+	bypassGovernance := r.Header.Get("x-amz-bypass-governance-retention") == "true"
+	if err := s3a.checkObjectLockPermissions(bucket, object, versionId, bypassGovernance); err != nil {
+		glog.V(2).Infof("DeleteObjectHandler: object lock check failed for %s/%s: %v", bucket, object, err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
+		return
+	}
+
 	if versioningEnabled {
 		// Handle versioned delete
 		if versionId != "" {
@@ -180,6 +188,10 @@ func (s3a *S3ApiServer) DeleteMultipleObjectsHandler(w http.ResponseWriter, r *h
 	if s3err.Logger != nil {
 		auditLog = s3err.GetAccessLog(r, http.StatusNoContent, s3err.ErrNone)
 	}
+
+	// Check for bypass governance retention header
+	bypassGovernance := r.Header.Get("x-amz-bypass-governance-retention") == "true"
+
 	s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 
 		// delete file entries
@@ -187,6 +199,17 @@ func (s3a *S3ApiServer) DeleteMultipleObjectsHandler(w http.ResponseWriter, r *h
 			if object.ObjectName == "" {
 				continue
 			}
+
+			// Check object lock permissions before deletion
+			if err := s3a.checkObjectLockPermissions(bucket, object.ObjectName, "", bypassGovernance); err != nil {
+				glog.V(2).Infof("DeleteMultipleObjectsHandler: object lock check failed for %s/%s: %v", bucket, object.ObjectName, err)
+				deleteErrors = append(deleteErrors, DeleteError{
+					Code:    "AccessDenied",
+					Message: err.Error(),
+					Key:     object.ObjectName,
+				})
+				continue
+			}
 			lastSeparator := strings.LastIndex(object.ObjectName, "/")
 			parentDirectoryPath, entryName, isDeleteData, isRecursive := "", object.ObjectName, true, false
 			if lastSeparator > 0 && lastSeparator+1 < len(object.ObjectName) {

weed/s3api/s3api_object_handlers_put.go

@@ -103,6 +103,14 @@ func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request)
 			setEtag(w, etag)
 		} else {
 			// Handle regular PUT (non-versioned)
+			// Check object lock permissions before overwriting (only for non-versioned buckets)
+			bypassGovernance := r.Header.Get("x-amz-bypass-governance-retention") == "true"
+			if err := s3a.checkObjectLockPermissions(bucket, object, "", bypassGovernance); err != nil {
+				glog.V(2).Infof("PutObjectHandler: object lock check failed for %s/%s: %v", bucket, object, err)
+				s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
+				return
+			}
+
 			glog.V(1).Infof("PutObjectHandler: using regular PUT for %s/%s", bucket, object)
 			uploadUrl := s3a.toFilerUrl(bucket, object)
 			if objectContentType == "" {

weed/s3api/s3api_object_handlers_retention.go

@@ -0,0 +1,331 @@
+package s3api
+
+import (
+	"encoding/xml"
+	"net/http"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	stats_collect "github.com/seaweedfs/seaweedfs/weed/stats"
+)
+
+// PutObjectRetentionHandler Put object Retention
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectRetention.html
+func (s3a *S3ApiServer) PutObjectRetentionHandler(w http.ResponseWriter, r *http.Request) {
+	bucket, object := s3_constants.GetBucketAndObject(r)
+	glog.V(3).Infof("PutObjectRetentionHandler %s %s", bucket, object)
+
+	// Get version ID from query parameters
+	versionId := r.URL.Query().Get("versionId")
+
+	// Check for bypass governance retention header
+	bypassGovernance := r.Header.Get("x-amz-bypass-governance-retention") == "true"
+
+	// Parse retention configuration from request body
+	retention, err := parseObjectRetention(r)
+	if err != nil {
+		glog.Errorf("PutObjectRetentionHandler: failed to parse retention config: %v", err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrMalformedXML)
+		return
+	}
+
+	// Validate retention configuration
+	if err := validateRetention(retention); err != nil {
+		glog.Errorf("PutObjectRetentionHandler: invalid retention config: %v", err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+		return
+	}
+
+	// Set retention on the object
+	if err := s3a.setObjectRetention(bucket, object, versionId, retention, bypassGovernance); err != nil {
+		glog.Errorf("PutObjectRetentionHandler: failed to set retention: %v", err)
+
+		// Handle specific error cases
+		if strings.Contains(err.Error(), "object not found") || strings.Contains(err.Error(), "version not found") {
+			s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+			return
+		}
+
+		if strings.Contains(err.Error(), "COMPLIANCE mode") || strings.Contains(err.Error(), "GOVERNANCE mode") {
+			s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
+			return
+		}
+
+		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+		return
+	}
+
+	// Record metrics
+	stats_collect.RecordBucketActiveTime(bucket)
+
+	// Return success (HTTP 200 with no body)
+	w.WriteHeader(http.StatusOK)
+	glog.V(3).Infof("PutObjectRetentionHandler: successfully set retention for %s/%s", bucket, object)
+}
+
+// GetObjectRetentionHandler Get object Retention
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectRetention.html
+func (s3a *S3ApiServer) GetObjectRetentionHandler(w http.ResponseWriter, r *http.Request) {
+	bucket, object := s3_constants.GetBucketAndObject(r)
+	glog.V(3).Infof("GetObjectRetentionHandler %s %s", bucket, object)
+
+	// Get version ID from query parameters
+	versionId := r.URL.Query().Get("versionId")
+
+	// Get retention configuration for the object
+	retention, err := s3a.getObjectRetention(bucket, object, versionId)
+	if err != nil {
+		glog.Errorf("GetObjectRetentionHandler: failed to get retention: %v", err)
+
+		// Handle specific error cases
+		if strings.Contains(err.Error(), "object not found") || strings.Contains(err.Error(), "version not found") {
+			s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+			return
+		}
+
+		if strings.Contains(err.Error(), "no retention configuration found") {
+			s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchObjectLockConfiguration)
+			return
+		}
+
+		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+		return
+	}
+
+	// Marshal retention configuration to XML
+	retentionXML, err := xml.Marshal(retention)
+	if err != nil {
+		glog.Errorf("GetObjectRetentionHandler: failed to marshal retention: %v", err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+		return
+	}
+
+	// Set response headers
+	w.Header().Set("Content-Type", "application/xml")
+	w.WriteHeader(http.StatusOK)
+
+	// Write XML response
+	if _, err := w.Write([]byte(xml.Header)); err != nil {
+		glog.Errorf("GetObjectRetentionHandler: failed to write XML header: %v", err)
+		return
+	}
+
+	if _, err := w.Write(retentionXML); err != nil {
+		glog.Errorf("GetObjectRetentionHandler: failed to write retention XML: %v", err)
+		return
+	}
+
+	// Record metrics
+	stats_collect.RecordBucketActiveTime(bucket)
+
+	glog.V(3).Infof("GetObjectRetentionHandler: successfully retrieved retention for %s/%s", bucket, object)
+}
+
+// PutObjectLegalHoldHandler Put object Legal Hold
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLegalHold.html
+func (s3a *S3ApiServer) PutObjectLegalHoldHandler(w http.ResponseWriter, r *http.Request) {
+	bucket, object := s3_constants.GetBucketAndObject(r)
+	glog.V(3).Infof("PutObjectLegalHoldHandler %s %s", bucket, object)
+
+	// Get version ID from query parameters
+	versionId := r.URL.Query().Get("versionId")
+
+	// Parse legal hold configuration from request body
+	legalHold, err := parseObjectLegalHold(r)
+	if err != nil {
+		glog.Errorf("PutObjectLegalHoldHandler: failed to parse legal hold config: %v", err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrMalformedXML)
+		return
+	}
+
+	// Validate legal hold configuration
+	if err := validateLegalHold(legalHold); err != nil {
+		glog.Errorf("PutObjectLegalHoldHandler: invalid legal hold config: %v", err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+		return
+	}
+
+	// Set legal hold on the object
+	if err := s3a.setObjectLegalHold(bucket, object, versionId, legalHold); err != nil {
+		glog.Errorf("PutObjectLegalHoldHandler: failed to set legal hold: %v", err)
+
+		// Handle specific error cases
+		if strings.Contains(err.Error(), "object not found") || strings.Contains(err.Error(), "version not found") {
+			s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+			return
+		}
+
+		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+		return
+	}
+
+	// Record metrics
+	stats_collect.RecordBucketActiveTime(bucket)
+
+	// Return success (HTTP 200 with no body)
+	w.WriteHeader(http.StatusOK)
+	glog.V(3).Infof("PutObjectLegalHoldHandler: successfully set legal hold for %s/%s", bucket, object)
+}
+
+// GetObjectLegalHoldHandler Get object Legal Hold
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectLegalHold.html
+func (s3a *S3ApiServer) GetObjectLegalHoldHandler(w http.ResponseWriter, r *http.Request) {
+	bucket, object := s3_constants.GetBucketAndObject(r)
+	glog.V(3).Infof("GetObjectLegalHoldHandler %s %s", bucket, object)
+
+	// Get version ID from query parameters
+	versionId := r.URL.Query().Get("versionId")
+
+	// Get legal hold configuration for the object
+	legalHold, err := s3a.getObjectLegalHold(bucket, object, versionId)
+	if err != nil {
+		glog.Errorf("GetObjectLegalHoldHandler: failed to get legal hold: %v", err)
+
+		// Handle specific error cases
+		if strings.Contains(err.Error(), "object not found") || strings.Contains(err.Error(), "version not found") {
+			s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+			return
+		}
+
+		if strings.Contains(err.Error(), "no legal hold configuration found") {
+			s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchObjectLockConfiguration)
+			return
+		}
+
+		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+		return
+	}
+
+	// Marshal legal hold configuration to XML
+	legalHoldXML, err := xml.Marshal(legalHold)
+	if err != nil {
+		glog.Errorf("GetObjectLegalHoldHandler: failed to marshal legal hold: %v", err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+		return
+	}
+
+	// Set response headers
+	w.Header().Set("Content-Type", "application/xml")
+	w.WriteHeader(http.StatusOK)
+
+	// Write XML response
+	if _, err := w.Write([]byte(xml.Header)); err != nil {
+		glog.Errorf("GetObjectLegalHoldHandler: failed to write XML header: %v", err)
+		return
+	}
+
+	if _, err := w.Write(legalHoldXML); err != nil {
+		glog.Errorf("GetObjectLegalHoldHandler: failed to write legal hold XML: %v", err)
+		return
+	}
+
+	// Record metrics
+	stats_collect.RecordBucketActiveTime(bucket)
+
+	glog.V(3).Infof("GetObjectLegalHoldHandler: successfully retrieved legal hold for %s/%s", bucket, object)
+}
+
+// PutObjectLockConfigurationHandler Put object Lock configuration
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLockConfiguration.html
+func (s3a *S3ApiServer) PutObjectLockConfigurationHandler(w http.ResponseWriter, r *http.Request) {
+	bucket, _ := s3_constants.GetBucketAndObject(r)
+	glog.V(3).Infof("PutObjectLockConfigurationHandler %s", bucket)
+
+	// Parse object lock configuration from request body
+	config, err := parseObjectLockConfiguration(r)
+	if err != nil {
+		glog.Errorf("PutObjectLockConfigurationHandler: failed to parse object lock config: %v", err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrMalformedXML)
+		return
+	}
+
+	// Validate object lock configuration
+	if config.ObjectLockEnabled != "" && config.ObjectLockEnabled != s3_constants.ObjectLockEnabled {
+		glog.Errorf("PutObjectLockConfigurationHandler: invalid object lock enabled value: %s", config.ObjectLockEnabled)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+		return
+	}
+
+	// Set object lock configuration on the bucket
+	errCode := s3a.updateBucketConfig(bucket, func(bucketConfig *BucketConfig) error {
+		if bucketConfig.Entry.Extended == nil {
+			bucketConfig.Entry.Extended = make(map[string][]byte)
+		}
+
+		// Store the configuration as JSON in extended attributes
+		configXML, err := xml.Marshal(config)
+		if err != nil {
+			return err
+		}
+
+		bucketConfig.Entry.Extended[s3_constants.ExtObjectLockConfigKey] = configXML
+
+		if config.ObjectLockEnabled != "" {
+			bucketConfig.Entry.Extended[s3_constants.ExtObjectLockEnabledKey] = []byte(config.ObjectLockEnabled)
+		}
+
+		return nil
+	})
+
+	if errCode != s3err.ErrNone {
+		glog.Errorf("PutObjectLockConfigurationHandler: failed to set object lock config: %v", errCode)
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
+	// Record metrics
+	stats_collect.RecordBucketActiveTime(bucket)
+
+	// Return success (HTTP 200 with no body)
+	w.WriteHeader(http.StatusOK)
+	glog.V(3).Infof("PutObjectLockConfigurationHandler: successfully set object lock config for %s", bucket)
+}
+
+// GetObjectLockConfigurationHandler Get object Lock configuration
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectLockConfiguration.html
+func (s3a *S3ApiServer) GetObjectLockConfigurationHandler(w http.ResponseWriter, r *http.Request) {
+	bucket, _ := s3_constants.GetBucketAndObject(r)
+	glog.V(3).Infof("GetObjectLockConfigurationHandler %s", bucket)
+
+	// Get bucket configuration
+	bucketConfig, errCode := s3a.getBucketConfig(bucket)
+	if errCode != s3err.ErrNone {
+		glog.Errorf("GetObjectLockConfigurationHandler: failed to get bucket config: %v", errCode)
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
+	// Check if object lock configuration exists
+	if bucketConfig.Entry.Extended == nil {
+		s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchObjectLockConfiguration)
+		return
+	}
+
+	configXML, exists := bucketConfig.Entry.Extended[s3_constants.ExtObjectLockConfigKey]
+	if !exists {
+		s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchObjectLockConfiguration)
+		return
+	}
+
+	// Set response headers
+	w.Header().Set("Content-Type", "application/xml")
+	w.WriteHeader(http.StatusOK)
+
+	// Write XML response
+	if _, err := w.Write([]byte(xml.Header)); err != nil {
+		glog.Errorf("GetObjectLockConfigurationHandler: failed to write XML header: %v", err)
+		return
+	}
+
+	if _, err := w.Write(configXML); err != nil {
+		glog.Errorf("GetObjectLockConfigurationHandler: failed to write config XML: %v", err)
+		return
+	}
+
+	// Record metrics
+	stats_collect.RecordBucketActiveTime(bucket)
+
+	glog.V(3).Infof("GetObjectLockConfigurationHandler: successfully retrieved object lock config for %s", bucket)
+}

weed/s3api/s3api_object_handlers_skip.go

@@ -19,27 +19,3 @@ func (s3a *S3ApiServer) PutObjectAclHandler(w http.ResponseWriter, r *http.Reque
 	w.WriteHeader(http.StatusNoContent)
 
 }
-
-// PutObjectRetentionHandler Put object Retention
-// https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectRetention.html
-func (s3a *S3ApiServer) PutObjectRetentionHandler(w http.ResponseWriter, r *http.Request) {
-
-	w.WriteHeader(http.StatusNoContent)
-
-}
-
-// PutObjectLegalHoldHandler Put object Legal Hold
-// https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLegalHold.html
-func (s3a *S3ApiServer) PutObjectLegalHoldHandler(w http.ResponseWriter, r *http.Request) {
-
-	w.WriteHeader(http.StatusNoContent)
-
-}
-
-// PutObjectLockConfigurationHandler Put object Lock configuration
-// https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLockConfiguration.html
-func (s3a *S3ApiServer) PutObjectLockConfigurationHandler(w http.ResponseWriter, r *http.Request) {
-
-	w.WriteHeader(http.StatusNoContent)
-
-}

weed/s3api/s3api_object_retention.go

@@ -0,0 +1,611 @@
+package s3api
+
+import (
+	"encoding/xml"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+)
+
+// ObjectRetention represents S3 Object Retention configuration
+type ObjectRetention struct {
+	XMLName         xml.Name   `xml:"http://s3.amazonaws.com/doc/2006-03-01/ Retention"`
+	Mode            string     `xml:"Mode,omitempty"`
+	RetainUntilDate *time.Time `xml:"RetainUntilDate,omitempty"`
+}
+
+// ObjectLegalHold represents S3 Object Legal Hold configuration
+type ObjectLegalHold struct {
+	XMLName xml.Name `xml:"http://s3.amazonaws.com/doc/2006-03-01/ LegalHold"`
+	Status  string   `xml:"Status,omitempty"`
+}
+
+// ObjectLockConfiguration represents S3 Object Lock Configuration
+type ObjectLockConfiguration struct {
+	XMLName           xml.Name        `xml:"http://s3.amazonaws.com/doc/2006-03-01/ ObjectLockConfiguration"`
+	ObjectLockEnabled string          `xml:"ObjectLockEnabled,omitempty"`
+	Rule              *ObjectLockRule `xml:"Rule,omitempty"`
+}
+
+// ObjectLockRule represents an Object Lock Rule
+type ObjectLockRule struct {
+	XMLName          xml.Name          `xml:"Rule"`
+	DefaultRetention *DefaultRetention `xml:"DefaultRetention,omitempty"`
+}
+
+// DefaultRetention represents default retention settings
+type DefaultRetention struct {
+	XMLName xml.Name `xml:"DefaultRetention"`
+	Mode    string   `xml:"Mode,omitempty"`
+	Days    int      `xml:"Days,omitempty"`
+	Years   int      `xml:"Years,omitempty"`
+}
+
+// Custom time marshalling for AWS S3 ISO8601 format
+func (or *ObjectRetention) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	type Alias ObjectRetention
+	aux := &struct {
+		*Alias
+		RetainUntilDate *string `xml:"RetainUntilDate,omitempty"`
+	}{
+		Alias: (*Alias)(or),
+	}
+
+	if or.RetainUntilDate != nil {
+		dateStr := or.RetainUntilDate.UTC().Format(time.RFC3339)
+		aux.RetainUntilDate = &dateStr
+	}
+
+	return e.EncodeElement(aux, start)
+}
+
+// Custom time unmarshalling for AWS S3 ISO8601 format
+func (or *ObjectRetention) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
+	type Alias ObjectRetention
+	aux := &struct {
+		*Alias
+		RetainUntilDate *string `xml:"RetainUntilDate,omitempty"`
+	}{
+		Alias: (*Alias)(or),
+	}
+
+	if err := d.DecodeElement(aux, &start); err != nil {
+		return err
+	}
+
+	if aux.RetainUntilDate != nil {
+		t, err := time.Parse(time.RFC3339, *aux.RetainUntilDate)
+		if err != nil {
+			return err
+		}
+		or.RetainUntilDate = &t
+	}
+
+	return nil
+}
+
+// parseObjectRetention parses XML retention configuration from request body
+func parseObjectRetention(r *http.Request) (*ObjectRetention, error) {
+	if r.Body == nil {
+		return nil, fmt.Errorf("empty request body")
+	}
+
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		return nil, fmt.Errorf("error reading request body: %v", err)
+	}
+
+	var retention ObjectRetention
+	if err := xml.Unmarshal(body, &retention); err != nil {
+		return nil, fmt.Errorf("error parsing XML: %v", err)
+	}
+
+	return &retention, nil
+}
+
+// parseObjectLegalHold parses XML legal hold configuration from request body
+func parseObjectLegalHold(r *http.Request) (*ObjectLegalHold, error) {
+	if r.Body == nil {
+		return nil, fmt.Errorf("empty request body")
+	}
+
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		return nil, fmt.Errorf("error reading request body: %v", err)
+	}
+
+	var legalHold ObjectLegalHold
+	if err := xml.Unmarshal(body, &legalHold); err != nil {
+		return nil, fmt.Errorf("error parsing XML: %v", err)
+	}
+
+	return &legalHold, nil
+}
+
+// parseObjectLockConfiguration parses XML object lock configuration from request body
+func parseObjectLockConfiguration(r *http.Request) (*ObjectLockConfiguration, error) {
+	if r.Body == nil {
+		return nil, fmt.Errorf("empty request body")
+	}
+
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		return nil, fmt.Errorf("error reading request body: %v", err)
+	}
+
+	var config ObjectLockConfiguration
+	if err := xml.Unmarshal(body, &config); err != nil {
+		return nil, fmt.Errorf("error parsing XML: %v", err)
+	}
+
+	return &config, nil
+}
+
+// validateRetention validates retention configuration
+func validateRetention(retention *ObjectRetention) error {
+	if retention.Mode == "" && retention.RetainUntilDate == nil {
+		return fmt.Errorf("retention configuration must specify either Mode or RetainUntilDate")
+	}
+
+	if retention.Mode != "" {
+		if retention.Mode != s3_constants.RetentionModeGovernance && retention.Mode != s3_constants.RetentionModeCompliance {
+			return fmt.Errorf("invalid retention mode: %s", retention.Mode)
+		}
+	}
+
+	if retention.RetainUntilDate != nil {
+		if retention.RetainUntilDate.Before(time.Now()) {
+			return fmt.Errorf("retain until date must be in the future")
+		}
+	}
+
+	return nil
+}
+
+// validateLegalHold validates legal hold configuration
+func validateLegalHold(legalHold *ObjectLegalHold) error {
+	if legalHold.Status != s3_constants.LegalHoldOn && legalHold.Status != s3_constants.LegalHoldOff {
+		return fmt.Errorf("invalid legal hold status: %s", legalHold.Status)
+	}
+
+	return nil
+}
+
+// getObjectRetention retrieves retention configuration from object metadata
+func (s3a *S3ApiServer) getObjectRetention(bucket, object, versionId string) (*ObjectRetention, error) {
+	var entry *filer_pb.Entry
+	var err error
+
+	if versionId != "" {
+		entry, err = s3a.getSpecificObjectVersion(bucket, object, versionId)
+	} else {
+		// Check if versioning is enabled
+		versioningEnabled, vErr := s3a.isVersioningEnabled(bucket)
+		if vErr != nil {
+			return nil, fmt.Errorf("error checking versioning: %v", vErr)
+		}
+
+		if versioningEnabled {
+			entry, err = s3a.getLatestObjectVersion(bucket, object)
+		} else {
+			bucketDir := s3a.option.BucketsPath + "/" + bucket
+			entry, err = s3a.getEntry(bucketDir, object)
+		}
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("object not found: %v", err)
+	}
+
+	if entry.Extended == nil {
+		return nil, fmt.Errorf("no retention configuration found")
+	}
+
+	retention := &ObjectRetention{}
+
+	if modeBytes, exists := entry.Extended[s3_constants.ExtRetentionModeKey]; exists {
+		retention.Mode = string(modeBytes)
+	}
+
+	if dateBytes, exists := entry.Extended[s3_constants.ExtRetentionUntilDateKey]; exists {
+		if timestamp, err := strconv.ParseInt(string(dateBytes), 10, 64); err == nil {
+			t := time.Unix(timestamp, 0)
+			retention.RetainUntilDate = &t
+		}
+	}
+
+	if retention.Mode == "" && retention.RetainUntilDate == nil {
+		return nil, fmt.Errorf("no retention configuration found")
+	}
+
+	return retention, nil
+}
+
+// setObjectRetention sets retention configuration on object metadata
+func (s3a *S3ApiServer) setObjectRetention(bucket, object, versionId string, retention *ObjectRetention, bypassGovernance bool) error {
+	var entry *filer_pb.Entry
+	var err error
+	var entryPath string
+
+	if versionId != "" {
+		entry, err = s3a.getSpecificObjectVersion(bucket, object, versionId)
+		if err != nil {
+			return fmt.Errorf("version not found: %v", err)
+		}
+		// For versioned objects, we need to update the version file
+		entryPath = object + ".versions/" + s3a.getVersionFileName(versionId)
+	} else {
+		// Check if versioning is enabled
+		versioningEnabled, vErr := s3a.isVersioningEnabled(bucket)
+		if vErr != nil {
+			return fmt.Errorf("error checking versioning: %v", vErr)
+		}
+
+		if versioningEnabled {
+			entry, err = s3a.getLatestObjectVersion(bucket, object)
+			if err != nil {
+				return fmt.Errorf("latest version not found: %v", err)
+			}
+			// Extract version ID from entry metadata
+			if entry.Extended != nil {
+				if versionIdBytes, exists := entry.Extended[s3_constants.ExtVersionIdKey]; exists {
+					versionId = string(versionIdBytes)
+					entryPath = object + ".versions/" + s3a.getVersionFileName(versionId)
+				}
+			}
+		} else {
+			bucketDir := s3a.option.BucketsPath + "/" + bucket
+			entry, err = s3a.getEntry(bucketDir, object)
+			if err != nil {
+				return fmt.Errorf("object not found: %v", err)
+			}
+			entryPath = object
+		}
+	}
+
+	// Check if object is already under retention
+	if entry.Extended != nil {
+		if existingMode, exists := entry.Extended[s3_constants.ExtRetentionModeKey]; exists {
+			if string(existingMode) == s3_constants.RetentionModeCompliance && !bypassGovernance {
+				return fmt.Errorf("cannot modify retention on object under COMPLIANCE mode")
+			}
+
+			if existingDateBytes, dateExists := entry.Extended[s3_constants.ExtRetentionUntilDateKey]; dateExists {
+				if timestamp, err := strconv.ParseInt(string(existingDateBytes), 10, 64); err == nil {
+					existingDate := time.Unix(timestamp, 0)
+					if existingDate.After(time.Now()) && string(existingMode) == s3_constants.RetentionModeGovernance && !bypassGovernance {
+						return fmt.Errorf("cannot modify retention on object under GOVERNANCE mode without bypass")
+					}
+				}
+			}
+		}
+	}
+
+	// Update retention metadata
+	if entry.Extended == nil {
+		entry.Extended = make(map[string][]byte)
+	}
+
+	if retention.Mode != "" {
+		entry.Extended[s3_constants.ExtRetentionModeKey] = []byte(retention.Mode)
+	}
+
+	if retention.RetainUntilDate != nil {
+		entry.Extended[s3_constants.ExtRetentionUntilDateKey] = []byte(strconv.FormatInt(retention.RetainUntilDate.Unix(), 10))
+
+		// Also update the existing WORM fields for compatibility
+		entry.WormEnforcedAtTsNs = time.Now().UnixNano()
+	}
+
+	// Update the entry
+	bucketDir := s3a.option.BucketsPath + "/" + bucket
+	return s3a.mkFile(bucketDir, entryPath, entry.Chunks, func(updatedEntry *filer_pb.Entry) {
+		updatedEntry.Extended = entry.Extended
+		updatedEntry.WormEnforcedAtTsNs = entry.WormEnforcedAtTsNs
+	})
+}
+
+// getObjectLegalHold retrieves legal hold configuration from object metadata
+func (s3a *S3ApiServer) getObjectLegalHold(bucket, object, versionId string) (*ObjectLegalHold, error) {
+	var entry *filer_pb.Entry
+	var err error
+
+	if versionId != "" {
+		entry, err = s3a.getSpecificObjectVersion(bucket, object, versionId)
+	} else {
+		// Check if versioning is enabled
+		versioningEnabled, vErr := s3a.isVersioningEnabled(bucket)
+		if vErr != nil {
+			return nil, fmt.Errorf("error checking versioning: %v", vErr)
+		}
+
+		if versioningEnabled {
+			entry, err = s3a.getLatestObjectVersion(bucket, object)
+		} else {
+			bucketDir := s3a.option.BucketsPath + "/" + bucket
+			entry, err = s3a.getEntry(bucketDir, object)
+		}
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("object not found: %v", err)
+	}
+
+	if entry.Extended == nil {
+		return nil, fmt.Errorf("no legal hold configuration found")
+	}
+
+	legalHold := &ObjectLegalHold{}
+
+	if statusBytes, exists := entry.Extended[s3_constants.ExtLegalHoldKey]; exists {
+		legalHold.Status = string(statusBytes)
+	} else {
+		return nil, fmt.Errorf("no legal hold configuration found")
+	}
+
+	return legalHold, nil
+}
+
+// setObjectLegalHold sets legal hold configuration on object metadata
+func (s3a *S3ApiServer) setObjectLegalHold(bucket, object, versionId string, legalHold *ObjectLegalHold) error {
+	var entry *filer_pb.Entry
+	var err error
+	var entryPath string
+
+	if versionId != "" {
+		entry, err = s3a.getSpecificObjectVersion(bucket, object, versionId)
+		if err != nil {
+			return fmt.Errorf("version not found: %v", err)
+		}
+		entryPath = object + ".versions/" + s3a.getVersionFileName(versionId)
+	} else {
+		// Check if versioning is enabled
+		versioningEnabled, vErr := s3a.isVersioningEnabled(bucket)
+		if vErr != nil {
+			return fmt.Errorf("error checking versioning: %v", vErr)
+		}
+
+		if versioningEnabled {
+			entry, err = s3a.getLatestObjectVersion(bucket, object)
+			if err != nil {
+				return fmt.Errorf("latest version not found: %v", err)
+			}
+			// Extract version ID from entry metadata
+			if entry.Extended != nil {
+				if versionIdBytes, exists := entry.Extended[s3_constants.ExtVersionIdKey]; exists {
+					versionId = string(versionIdBytes)
+					entryPath = object + ".versions/" + s3a.getVersionFileName(versionId)
+				}
+			}
+		} else {
+			bucketDir := s3a.option.BucketsPath + "/" + bucket
+			entry, err = s3a.getEntry(bucketDir, object)
+			if err != nil {
+				return fmt.Errorf("object not found: %v", err)
+			}
+			entryPath = object
+		}
+	}
+
+	// Update legal hold metadata
+	if entry.Extended == nil {
+		entry.Extended = make(map[string][]byte)
+	}
+
+	entry.Extended[s3_constants.ExtLegalHoldKey] = []byte(legalHold.Status)
+
+	// Update the entry
+	bucketDir := s3a.option.BucketsPath + "/" + bucket
+	return s3a.mkFile(bucketDir, entryPath, entry.Chunks, func(updatedEntry *filer_pb.Entry) {
+		updatedEntry.Extended = entry.Extended
+	})
+}
+
+// isObjectRetentionActive checks if an object is currently under retention
+func (s3a *S3ApiServer) isObjectRetentionActive(bucket, object, versionId string) (bool, error) {
+	retention, err := s3a.getObjectRetention(bucket, object, versionId)
+	if err != nil {
+		// If no retention found, object is not under retention
+		if strings.Contains(err.Error(), "no retention configuration found") {
+			return false, nil
+		}
+		return false, err
+	}
+
+	if retention.RetainUntilDate != nil && retention.RetainUntilDate.After(time.Now()) {
+		return true, nil
+	}
+
+	return false, nil
+}
+
+// isObjectLegalHoldActive checks if an object is currently under legal hold
+func (s3a *S3ApiServer) isObjectLegalHoldActive(bucket, object, versionId string) (bool, error) {
+	legalHold, err := s3a.getObjectLegalHold(bucket, object, versionId)
+	if err != nil {
+		// If no legal hold found, object is not under legal hold
+		if strings.Contains(err.Error(), "no legal hold configuration found") {
+			return false, nil
+		}
+		return false, err
+	}
+
+	return legalHold.Status == s3_constants.LegalHoldOn, nil
+}
+
+// checkObjectLockPermissions checks if an object can be deleted or modified
+func (s3a *S3ApiServer) checkObjectLockPermissions(bucket, object, versionId string, bypassGovernance bool) error {
+	// Check if object is under retention
+	retentionActive, err := s3a.isObjectRetentionActive(bucket, object, versionId)
+	if err != nil {
+		glog.Warningf("Error checking retention for %s/%s: %v", bucket, object, err)
+	}
+
+	// Check if object is under legal hold
+	legalHoldActive, err := s3a.isObjectLegalHoldActive(bucket, object, versionId)
+	if err != nil {
+		glog.Warningf("Error checking legal hold for %s/%s: %v", bucket, object, err)
+	}
+
+	// If object is under legal hold, it cannot be deleted or modified
+	if legalHoldActive {
+		return fmt.Errorf("object is under legal hold and cannot be deleted or modified")
+	}
+
+	// If object is under retention, check the mode
+	if retentionActive {
+		retention, err := s3a.getObjectRetention(bucket, object, versionId)
+		if err != nil {
+			return fmt.Errorf("error getting retention configuration: %v", err)
+		}
+
+		if retention.Mode == s3_constants.RetentionModeCompliance {
+			return fmt.Errorf("object is under COMPLIANCE mode retention and cannot be deleted or modified")
+		}
+
+		if retention.Mode == s3_constants.RetentionModeGovernance && !bypassGovernance {
+			return fmt.Errorf("object is under GOVERNANCE mode retention and cannot be deleted or modified without bypass")
+		}
+	}
+
+	// Check existing WORM enforcement for compatibility
+	if err := s3a.checkLegacyWormEnforcement(bucket, object, versionId, bypassGovernance); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// checkLegacyWormEnforcement checks the existing WORM infrastructure for compatibility
+func (s3a *S3ApiServer) checkLegacyWormEnforcement(bucket, object, versionId string, bypassGovernance bool) error {
+	var entry *filer_pb.Entry
+	var err error
+
+	if versionId != "" {
+		entry, err = s3a.getSpecificObjectVersion(bucket, object, versionId)
+	} else {
+		// Check if versioning is enabled
+		versioningEnabled, vErr := s3a.isVersioningEnabled(bucket)
+		if vErr != nil {
+			// If we can't check versioning, skip WORM check to avoid false positives
+			return nil
+		}
+
+		if versioningEnabled {
+			entry, err = s3a.getLatestObjectVersion(bucket, object)
+		} else {
+			bucketDir := s3a.option.BucketsPath + "/" + bucket
+			entry, err = s3a.getEntry(bucketDir, object)
+		}
+	}
+
+	if err != nil {
+		// If object doesn't exist, no WORM enforcement applies
+		return nil
+	}
+
+	// Check if legacy WORM is enforced
+	if entry.WormEnforcedAtTsNs == 0 {
+		return nil
+	}
+
+	// Check if this is under legacy WORM enforcement
+	// For compatibility, we treat legacy WORM similar to GOVERNANCE mode
+	// (can be bypassed with appropriate permissions)
+	if !bypassGovernance {
+		return fmt.Errorf("object is under legacy WORM enforcement and cannot be deleted or modified without bypass")
+	}
+
+	return nil
+}
+
+// integrateWithWormSystem ensures compatibility between S3 retention and legacy WORM
+func (s3a *S3ApiServer) integrateWithWormSystem(entry *filer_pb.Entry, retention *ObjectRetention) {
+	if retention == nil || retention.RetainUntilDate == nil {
+		return
+	}
+
+	// Set the legacy WORM timestamp for backward compatibility
+	if entry.WormEnforcedAtTsNs == 0 {
+		entry.WormEnforcedAtTsNs = time.Now().UnixNano()
+	}
+
+	// Store additional S3 retention metadata in extended attributes
+	if entry.Extended == nil {
+		entry.Extended = make(map[string][]byte)
+	}
+
+	if retention.Mode != "" {
+		entry.Extended[s3_constants.ExtRetentionModeKey] = []byte(retention.Mode)
+	}
+
+	if retention.RetainUntilDate != nil {
+		entry.Extended[s3_constants.ExtRetentionUntilDateKey] = []byte(strconv.FormatInt(retention.RetainUntilDate.Unix(), 10))
+	}
+}
+
+// isObjectWormProtected checks both S3 retention and legacy WORM for complete protection status
+func (s3a *S3ApiServer) isObjectWormProtected(bucket, object, versionId string) (bool, error) {
+	// Check S3 object retention
+	retentionActive, err := s3a.isObjectRetentionActive(bucket, object, versionId)
+	if err != nil {
+		glog.V(4).Infof("Error checking S3 retention for %s/%s: %v", bucket, object, err)
+	}
+
+	// Check S3 legal hold
+	legalHoldActive, err := s3a.isObjectLegalHoldActive(bucket, object, versionId)
+	if err != nil {
+		glog.V(4).Infof("Error checking S3 legal hold for %s/%s: %v", bucket, object, err)
+	}
+
+	// Check legacy WORM enforcement
+	legacyWormActive, err := s3a.isLegacyWormActive(bucket, object, versionId)
+	if err != nil {
+		glog.V(4).Infof("Error checking legacy WORM for %s/%s: %v", bucket, object, err)
+	}
+
+	return retentionActive || legalHoldActive || legacyWormActive, nil
+}
+
+// isLegacyWormActive checks if an object is under legacy WORM enforcement
+func (s3a *S3ApiServer) isLegacyWormActive(bucket, object, versionId string) (bool, error) {
+	var entry *filer_pb.Entry
+	var err error
+
+	if versionId != "" {
+		entry, err = s3a.getSpecificObjectVersion(bucket, object, versionId)
+	} else {
+		// Check if versioning is enabled
+		versioningEnabled, vErr := s3a.isVersioningEnabled(bucket)
+		if vErr != nil {
+			return false, nil
+		}
+
+		if versioningEnabled {
+			entry, err = s3a.getLatestObjectVersion(bucket, object)
+		} else {
+			bucketDir := s3a.option.BucketsPath + "/" + bucket
+			entry, err = s3a.getEntry(bucketDir, object)
+		}
+	}
+
+	if err != nil {
+		return false, nil
+	}
+
+	// Check if legacy WORM is enforced and still active
+	if entry.WormEnforcedAtTsNs == 0 {
+		return false, nil
+	}
+
+	// For now, we consider legacy WORM as always active when set
+	// The original WORM system should handle time-based expiration
+	return true, nil
+}

weed/s3api/s3api_server.go

@@ -211,6 +211,12 @@ func (s3a *S3ApiServer) registerRouter(router *mux.Router) {
 
 		// GetObjectACL
 		bucket.Methods(http.MethodGet).Path("/{object:.+}").HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetObjectAclHandler, ACTION_READ_ACP)), "GET")).Queries("acl", "")
+		// GetObjectRetention
+		bucket.Methods(http.MethodGet).Path("/{object:.+}").HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetObjectRetentionHandler, ACTION_READ)), "GET")).Queries("retention", "")
+		// GetObjectLegalHold
+		bucket.Methods(http.MethodGet).Path("/{object:.+}").HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetObjectLegalHoldHandler, ACTION_READ)), "GET")).Queries("legal-hold", "")
+		// GetObjectLockConfiguration
+		bucket.Methods(http.MethodGet).Path("/{object:.+}").HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetObjectLockConfigurationHandler, ACTION_READ)), "GET")).Queries("object-lock", "")
 
 		// objects with query
 

weed/s3api/s3err/s3api_errors.go

@@ -110,6 +110,7 @@ const (
 
 	OwnershipControlsNotFoundError
 	ErrNoSuchTagSet
+	ErrNoSuchObjectLockConfiguration
 )
 
 // Error message constants for checksum validation
@@ -197,6 +198,11 @@ var errorCodeResponse = map[ErrorCode]APIError{
 		Description:    "The TagSet does not exist",
 		HTTPStatusCode: http.StatusNotFound,
 	},
+	ErrNoSuchObjectLockConfiguration: {
+		Code:           "ObjectLockConfigurationNotFoundError",
+		Description:    "The specified object does not have an ObjectLock configuration",
+		HTTPStatusCode: http.StatusNotFound,
+	},
 	ErrNoSuchCORSConfiguration: {
 		Code:           "NoSuchCORSConfiguration",
 		Description:    "The CORS configuration does not exist",