s3: route object-lock version-specific deletes off the distributed lock (#9657)

A version-specific DELETE (real version or the null version, including
object-lock WORM-checked ones and governance-bypass) now runs as one routed
transaction on the object's owner instead of holding the distributed lock.

For a real version: recompute the .versions pointer excluding the version
(repoint-before-delete, so a crash leaves a recoverable orphan rather than a
dangling pointer), then delete the version file, under the object's per-path lock.
The null version is the regular object entry, deleted directly (no pointer).

Object-lock buckets gate the delete on the version's WORM guards evaluated on the
owner: legal hold (always) + retention (while not elapsed). Governance bypass
scopes the retention guard to COMPLIANCE mode, so the filer allows a
governance-mode delete while still denying compliance and legal hold — the
gateway never reads the version.

Three primitives make this expressible:
- ObjectTransaction.condition_key: evaluate the condition against a named entry
  (the version) while the lock stays on lock_key (the object).
- Recompute.exclude_name: omit a child from the scan, to repoint before delete.
- WriteCondition.Clause gate_key/gate_value: scope IF_EXTENDED_TIME_ELAPSED to a
  mode, expressing governance bypass without a gateway-side read.

weed/s3api/s3api_object_versioned_finalize.go

@@ -23,37 +23,49 @@ func (s3a *S3ApiServer) objectWriteOwner(bucket, object string) pb.ServerAddress
 	return s3a.objectWriteLockClient.PrimaryForKey("s3.object.write:" + s3a.toFilerPath(bucket, object))
 }
 
+// latestPointerRecompute builds the RECOMPUTE_LATEST mutation that re-derives an
+// object's .versions pointer. excludeName, when set, omits a version about to be
+// deleted (so the pointer is repointed before the blob is removed); demote, when
+// set, stamps the displaced prior latest with NoncurrentSinceNs.
+func (s3a *S3ApiServer) latestPointerRecompute(bucket, object string, useInvertedFormat bool, excludeName string, demote bool) *filer_pb.ObjectMutation {
+	versionsPath := s3a.toFilerPath(bucket, object+s3_constants.VersionsFolder)
+	vdir, vname := util.FullPath(versionsPath).DirAndName()
+	rc := &filer_pb.Recompute{
+		ScanDir: versionsPath,
+		// Inverted ids sort newest-first, so the newest is the first ascending
+		// entry; legacy ids sort oldest-first (scan to the last).
+		Descending: !useInvertedFormat,
+		NameToKey:  s3_constants.ExtLatestVersionFileNameKey,
+		SizeToKey:  s3_constants.ExtLatestVersionSizeKey,
+		MtimeToKey: s3_constants.ExtLatestVersionMtimeKey,
+		CopyExtended: map[string]string{
+			s3_constants.ExtLatestVersionIdKey:          s3_constants.ExtVersionIdKey,
+			s3_constants.ExtLatestVersionETagKey:        s3_constants.ExtETagKey,
+			s3_constants.ExtLatestVersionOwnerKey:       s3_constants.ExtAmzOwnerKey,
+			s3_constants.ExtLatestVersionIsDeleteMarker: s3_constants.ExtDeleteMarkerKey,
+		},
+		ExcludeName: excludeName,
+	}
+	if demote {
+		rc.DemoteKey = s3_constants.ExtNoncurrentSinceNsKey
+		rc.DemoteValue = []byte(strconv.FormatInt(time.Now().UnixNano(), 10))
+	}
+	return &filer_pb.ObjectMutation{
+		Type:      filer_pb.ObjectMutation_RECOMPUTE_LATEST,
+		Directory: vdir,
+		Name:      vname,
+		Recompute: rc,
+	}
+}
+
 // routedVersionedFinalize flips the .versions pointer to the newest version and
 // demotes the prior latest, atomically under the object's per-path lock on the
 // owner filer, via a single RECOMPUTE_LATEST. The version file is already
 // written; the owner re-derives the pointer by scanning the directory.
 func (s3a *S3ApiServer) routedVersionedFinalize(owner pb.ServerAddress, bucket, object string, useInvertedFormat bool) s3err.ErrorCode {
-	versionsPath := s3a.toFilerPath(bucket, object+s3_constants.VersionsFolder)
-	vdir, vname := util.FullPath(versionsPath).DirAndName()
 	req := &filer_pb.ObjectTransactionRequest{
-		LockKey: s3a.toFilerPath(bucket, object),
-		Mutations: []*filer_pb.ObjectMutation{{
-			Type:      filer_pb.ObjectMutation_RECOMPUTE_LATEST,
-			Directory: vdir,
-			Name:      vname,
-			Recompute: &filer_pb.Recompute{
-				ScanDir: versionsPath,
-				// Inverted ids sort newest-first, so the newest is the first
-				// ascending entry; legacy ids sort oldest-first (scan to the last).
-				Descending: !useInvertedFormat,
-				NameToKey:  s3_constants.ExtLatestVersionFileNameKey,
-				SizeToKey:  s3_constants.ExtLatestVersionSizeKey,
-				MtimeToKey: s3_constants.ExtLatestVersionMtimeKey,
-				CopyExtended: map[string]string{
-					s3_constants.ExtLatestVersionIdKey:          s3_constants.ExtVersionIdKey,
-					s3_constants.ExtLatestVersionETagKey:        s3_constants.ExtETagKey,
-					s3_constants.ExtLatestVersionOwnerKey:       s3_constants.ExtAmzOwnerKey,
-					s3_constants.ExtLatestVersionIsDeleteMarker: s3_constants.ExtDeleteMarkerKey,
-				},
-				DemoteKey:   s3_constants.ExtNoncurrentSinceNsKey,
-				DemoteValue: []byte(strconv.FormatInt(time.Now().UnixNano(), 10)),
-			},
-		}},
+		LockKey:   s3a.toFilerPath(bucket, object),
+		Mutations: []*filer_pb.ObjectMutation{s3a.latestPointerRecompute(bucket, object, useInvertedFormat, "", true)},
 	}
 	resp, err := s3a.objectTxnOnFiler(owner, req)
 	switch {
@@ -68,6 +80,93 @@ func (s3a *S3ApiServer) routedVersionedFinalize(owner pb.ServerAddress, bucket,
 	}
 }
 
+// wormDeleteCondition returns the object-lock guards for a delete, or nil when
+// the bucket has no object lock. Legal hold always blocks. Retention blocks
+// while not elapsed; with governance bypass the retention guard is gated to
+// COMPLIANCE mode, so a governance-mode version becomes deletable while a
+// compliance-mode one stays protected — the filer decides from the version's
+// mode under the lock, so the gateway never has to read it.
+func wormDeleteCondition(worm, bypass bool) *filer_pb.WriteCondition {
+	if !worm {
+		return nil
+	}
+	retention := &filer_pb.WriteCondition_Clause{
+		Kind:   filer_pb.WriteCondition_IF_EXTENDED_TIME_ELAPSED,
+		ExtKey: s3_constants.ExtRetentionUntilDateKey,
+	}
+	if bypass {
+		retention.GateKey = s3_constants.ExtObjectLockModeKey
+		retention.GateValue = s3_constants.RetentionModeCompliance
+	}
+	return &filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{
+		{Kind: filer_pb.WriteCondition_IF_EXTENDED_NOT_EQUAL, ExtKey: s3_constants.ExtLegalHoldKey, ExtValue: s3_constants.LegalHoldOn},
+		retention,
+	}}
+}
+
+// routedDeleteSpecificVersion deletes one version off the distributed lock: in a
+// single transaction on the owner it recomputes the .versions pointer excluding
+// the version (repoint-before-delete, so a crash leaves a recoverable orphan
+// rather than a dangling pointer) and deletes the version file. lock_key is the
+// object (serializing the pointer recompute); for object-lock buckets the
+// condition gates the delete on the version's WORM guards evaluated on the owner.
+func (s3a *S3ApiServer) routedDeleteSpecificVersion(owner pb.ServerAddress, bucket, object, versionId string, worm, bypass bool) s3err.ErrorCode {
+	versionFileName := s3a.getVersionFileName(versionId)
+	versionsPath := s3a.toFilerPath(bucket, object+s3_constants.VersionsFolder)
+	cond := wormDeleteCondition(worm, bypass)
+	req := &filer_pb.ObjectTransactionRequest{
+		LockKey:      s3a.toFilerPath(bucket, object),
+		ConditionKey: versionsPath + "/" + versionFileName,
+		Condition:    cond,
+		Mutations: []*filer_pb.ObjectMutation{
+			s3a.latestPointerRecompute(bucket, object, isNewFormatVersionId(versionId), versionFileName, false),
+			{Type: filer_pb.ObjectMutation_DELETE, Directory: versionsPath, Name: versionFileName, IsDeleteData: true},
+		},
+	}
+	resp, err := s3a.objectTxnOnFiler(owner, req)
+	switch {
+	case err != nil:
+		glog.Errorf("routedDeleteSpecificVersion: %s/%s %s on %s: %v", bucket, object, versionId, owner, err)
+		return s3err.ErrInternalError
+	case resp.ErrorCode == filer_pb.FilerError_PRECONDITION_FAILED:
+		// Legal hold or retention in force on the version.
+		return s3err.ErrAccessDenied
+	case resp.Error != "":
+		glog.Errorf("routedDeleteSpecificVersion: %s/%s %s: %s", bucket, object, versionId, resp.Error)
+		return s3err.ErrInternalError
+	default:
+		return s3err.ErrNone
+	}
+}
+
+// routedDeleteNullVersion deletes the null version (the regular object entry, not
+// a .versions file) off the distributed lock. There is no pointer to recompute;
+// the WORM guards, when present, gate the delete on the object entry itself
+// (condition defaults to lock_key).
+func (s3a *S3ApiServer) routedDeleteNullVersion(owner pb.ServerAddress, bucket, object string, worm, bypass bool) s3err.ErrorCode {
+	fullpath := util.NewFullPath(s3a.bucketDir(bucket), object)
+	dir, name := fullpath.DirAndName()
+	resp, err := s3a.objectTxnOnFiler(owner, &filer_pb.ObjectTransactionRequest{
+		LockKey:   string(fullpath),
+		Condition: wormDeleteCondition(worm, bypass),
+		Mutations: []*filer_pb.ObjectMutation{
+			{Type: filer_pb.ObjectMutation_DELETE, Directory: dir, Name: name, IsDeleteData: true},
+		},
+	})
+	switch {
+	case err != nil:
+		glog.Errorf("routedDeleteNullVersion: %s/%s on %s: %v", bucket, object, owner, err)
+		return s3err.ErrInternalError
+	case resp.ErrorCode == filer_pb.FilerError_PRECONDITION_FAILED:
+		return s3err.ErrAccessDenied
+	case resp.Error != "":
+		glog.Errorf("routedDeleteNullVersion: %s/%s: %s", bucket, object, resp.Error)
+		return s3err.ErrInternalError
+	default:
+		return s3err.ErrNone
+	}
+}
+
 // versionedAfterCreate returns the putToFiler hook that finalizes a versioned
 // write: the routed RECOMPUTE_LATEST when the owner is known, else the existing
 // lock-free updateLatestVersionInDirectory.