fix(auth): enforce object-lock actions for POST uploads (#5701)

rustfs/src/storage/access.rs

@@ -2328,21 +2328,10 @@ impl S3Access for FS {
         authorize_request(req, Action::S3Action(S3Action::PutObjectAction)).await?;
         req.extensions.insert(bucket_generation?);
 
-        // POST-object form uploads (s3s routes them through this hook with the
-        // original POST method before the dedicated post_object hook) are
-        // governed by the POST policy document instead of the retention /
-        // legal-hold IAM actions: s3s validates every x-amz-object-lock-* form
-        // field against the policy conditions before dispatch, and signed POSTs
-        // sign the policy itself. Anonymous POSTs author their own policy, so
-        // requiring these PUT-header IAM actions here only breaks the
-        // policy-covered accept path (rustfs#4845) without adding a boundary —
-        // the same MinIO handler applies no per-field lock permission either.
-        if req.method == http::Method::POST {
-            return Ok(());
+        if req.method != http::Method::POST {
+            authorize_replication_only_put_headers(req).await?;
         }
 
-        authorize_replication_only_put_headers(req).await?;
-
         if legal_hold_write_requested(req.input.object_lock_legal_hold_status.as_ref()) {
             authorize_request(req, Action::S3Action(S3Action::PutObjectLegalHoldAction)).await?;
         }