fix(object-lock): prevent locked version deletes (#4297)

crates/ecstore/src/object_api/types.rs

@@ -61,6 +61,7 @@ pub struct ObjectOptions {
 
     pub eval_metadata: Option<HashMap<String, String>>,
     pub object_lock_retention: Option<ObjectLockRetentionOptions>,
+    pub object_lock_delete: Option<crate::storage_api_contracts::object::ObjectLockDeleteOptions>,
 
     pub want_checksum: Option<Checksum>,
     pub skip_verify_bitrot: bool,

crates/ecstore/src/set_disk/mod.rs

@@ -45,7 +45,7 @@
 
 use crate::bucket::lifecycle::lifecycle::TRANSITION_COMPLETE;
 use crate::bucket::metadata_sys;
-use crate::bucket::object_lock::objectlock_sys::check_retention_for_modification;
+use crate::bucket::object_lock::objectlock_sys::{check_object_lock_for_deletion, check_retention_for_modification};
 use crate::bucket::replication::{
     ReplicateDecision, ReplicationObjectBridge, ReplicationState, ReplicationStatusType, VersionPurgeStatusType,
     replication_state_to_filemeta,
@@ -2528,6 +2528,29 @@ fn check_object_lock_retention_update(bucket: &str, object: &str, obj_info: &Obj
     Ok(())
 }
 
+async fn check_object_lock_delete(bucket: &str, object: &str, obj_info: &ObjectInfo, opts: &ObjectOptions) -> Result<()> {
+    if set_disk_delete_creates_delete_marker(opts) {
+        return Ok(());
+    }
+
+    let bypass_governance = opts
+        .object_lock_delete
+        .as_ref()
+        .is_some_and(|delete_opts| delete_opts.bypass_governance);
+    if check_object_lock_for_deletion(bucket, obj_info, bypass_governance)
+        .await
+        .is_some()
+    {
+        return Err(StorageError::PrefixAccessDenied(bucket.to_string(), object.to_string()));
+    }
+
+    Ok(())
+}
+
+fn set_disk_delete_creates_delete_marker(opts: &ObjectOptions) -> bool {
+    opts.version_id.is_none() && opts.versioned && !opts.version_suspended
+}
+
 fn should_preserve_delete_replication_state(opts: &ObjectOptions) -> bool {
     opts.delete_replication.as_ref().is_some_and(|state| {
         state.replica_status == ReplicationStatusType::Replica
@@ -5972,6 +5995,65 @@ mod tests {
             .expect("GOVERNANCE shortening with bypass should remain allowed");
     }
 
+    #[tokio::test]
+    async fn test_check_object_lock_delete_blocks_compliance_version_delete() {
+        let retain_until = OffsetDateTime::now_utc() + Duration::from_secs(60 * 60 * 24 * 60);
+        let mut user_defined = HashMap::new();
+        user_defined.insert(
+            X_AMZ_OBJECT_LOCK_MODE.as_str().to_string(),
+            s3s::dto::ObjectLockRetentionMode::COMPLIANCE.to_string(),
+        );
+        user_defined.insert(
+            X_AMZ_OBJECT_LOCK_RETAIN_UNTIL_DATE.as_str().to_string(),
+            retain_until.format(&time::format_description::well_known::Rfc3339).unwrap(),
+        );
+
+        let obj_info = ObjectInfo {
+            user_defined: Arc::new(user_defined),
+            ..Default::default()
+        };
+        let opts = ObjectOptions {
+            version_id: Some(Uuid::new_v4().to_string()),
+            versioned: true,
+            ..Default::default()
+        };
+
+        let err = check_object_lock_delete("bucket", "object", &obj_info, &opts)
+            .await
+            .expect_err("COMPLIANCE retention must block explicit version deletion");
+
+        assert!(matches!(err, StorageError::PrefixAccessDenied(_, _)));
+    }
+
+    #[tokio::test]
+    async fn test_check_object_lock_delete_allows_versioned_delete_marker_creation() {
+        let retain_until = OffsetDateTime::now_utc() + Duration::from_secs(60 * 60 * 24 * 60);
+        let mut user_defined = HashMap::new();
+        user_defined.insert(
+            X_AMZ_OBJECT_LOCK_MODE.as_str().to_string(),
+            s3s::dto::ObjectLockRetentionMode::COMPLIANCE.to_string(),
+        );
+        user_defined.insert(
+            X_AMZ_OBJECT_LOCK_RETAIN_UNTIL_DATE.as_str().to_string(),
+            retain_until.format(&time::format_description::well_known::Rfc3339).unwrap(),
+        );
+
+        let obj_info = ObjectInfo {
+            user_defined: Arc::new(user_defined),
+            ..Default::default()
+        };
+        let opts = ObjectOptions {
+            version_id: None,
+            versioned: true,
+            version_suspended: false,
+            ..Default::default()
+        };
+
+        check_object_lock_delete("bucket", "object", &obj_info, &opts)
+            .await
+            .expect("versioned delete marker creation should not delete the locked version");
+    }
+
     #[test]
     fn test_should_persist_encryption_original_size_rejects_plain_metadata() {
         let metadata = HashMap::from([("content-type".to_string(), "application/octet-stream".to_string())]);

crates/ecstore/src/set_disk/ops/object.rs

@@ -1327,10 +1327,31 @@ impl crate::storage_api_contracts::object::ObjectOperations for SetDisks {
         let mut vers_map: HashMap<&String, FileInfoVersions> = HashMap::new();
 
         for (i, dobj) in objects.iter().enumerate() {
+            if del_errs[i].is_some() {
+                continue;
+            }
+
             let explicit_null_version = is_explicit_null_version(dobj.version_id);
+            let version_id = delete_file_info_version_id(dobj.version_id);
+            let check_opts = ObjectOptions {
+                version_id: version_id.map(|version_id| version_id.to_string()),
+                versioned: ver_cfg.prefix_enabled(dobj.object_name.as_str()),
+                version_suspended: ver_cfg.suspended(),
+                object_lock_delete: opts.object_lock_delete.clone(),
+                no_lock: true,
+                ..Default::default()
+            };
+            let (goi, _write_quorum, gerr) = self.get_object_info_and_quorum(bucket, &dobj.object_name, &check_opts).await;
+            if gerr.is_none()
+                && let Err(err) = check_object_lock_delete(bucket, &dobj.object_name, &goi, &check_opts).await
+            {
+                del_errs[i] = Some(err);
+                continue;
+            }
+
             let mut vr = FileInfo {
                 name: dobj.object_name.clone(),
-                version_id: delete_file_info_version_id(dobj.version_id),
+                version_id,
                 idx: i,
                 replication_state_internal: Some(dobj.replication_state()),
                 ..Default::default()
@@ -1531,6 +1552,10 @@ impl crate::storage_api_contracts::object::ObjectOperations for SetDisks {
             }
         }
 
+        if version_found {
+            check_object_lock_delete(bucket, object, &goi, &opts).await?;
+        }
+
         let otd = ObjectToDelete {
             object_name: object.to_string(),
             version_id: opts

crates/ecstore/src/storage_api_contracts/mod.rs

@@ -45,8 +45,8 @@ pub(crate) mod object {
     use super::{Debug, Error, FileInfo, GetObjectReader, ObjectInfo, ObjectOptions, PutObjReader};
     use crate::storage_api_contracts::range::HTTPRangeSpec;
     pub(crate) use rustfs_storage_api::{
-        DeletedObject, HTTPPreconditions, ObjectIO, ObjectLockRetentionOptions, ObjectOperations, ObjectPreconditionError,
-        ObjectPreconditionPart, ObjectPreconditionState, ObjectToDelete,
+        DeletedObject, HTTPPreconditions, ObjectIO, ObjectLockDeleteOptions, ObjectLockRetentionOptions, ObjectOperations,
+        ObjectPreconditionError, ObjectPreconditionPart, ObjectPreconditionState, ObjectToDelete,
     };
 
     pub(crate) trait EcstoreObjectIO:

crates/storage-api/src/lib.rs

@@ -30,6 +30,7 @@ pub use bucket::{BucketInfo, BucketOperations, BucketOptions, DeleteBucketOption
 pub use capability::{CapabilitySnapshotError, CapabilityState, CapabilityStatus};
 pub use error::{StorageErrorCode, StorageResult};
 pub use multipart::{CompletePart, ListMultipartsInfo, ListPartsInfo, MultipartInfo, MultipartUploadResult, PartInfo};
+pub use object::ObjectLockDeleteOptions;
 pub use object::{DeletedObject, ObjectToDelete};
 pub use object::{ExpirationOptions, TransitionedObject};
 pub use object::{HTTPPreconditions, HTTPRangeError, HTTPRangeSpec, ObjectLockRetentionOptions};

crates/storage-api/src/object.rs

@@ -53,6 +53,11 @@ pub struct ExpirationOptions {
     pub expire: bool,
 }
 
+#[derive(Debug, Default, Clone)]
+pub struct ObjectLockDeleteOptions {
+    pub bypass_governance: bool,
+}
+
 #[derive(Debug, Default, Clone)]
 pub struct TransitionedObject {
     pub name: String,