Object locking need to persist the tags and set the headers (#6994)

* fix object locking read and write No logic to include object lock metadata in HEAD/GET response headers No logic to extract object lock metadata from PUT request headers * add tests for object locking * Update weed/s3api/s3api_object_handlers_put.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update weed/s3api/s3api_object_handlers.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * refactor * add unit tests * sync versions * Update s3_worm_integration_test.go * fix legal hold values * lint * fix tests * racing condition when enable versioning * fix tests * validate put object lock header * allow check lock permissions for PUT * default to OFF legal hold * only set object lock headers for objects that are actually from object lock-enabled buckets fix --- FAIL: TestAddObjectLockHeadersToResponse/Handle_entry_with_no_object_lock_metadata (0.00s) * address comments * fix tests * purge * fix * refactoring * address comment * address comment * Update weed/s3api/s3api_object_handlers_put.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update weed/s3api/s3api_object_handlers_put.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update weed/s3api/s3api_object_handlers.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * avoid nil * ensure locked objects cannot be overwritten --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-11-24 08:46:54 +08:00 · 2025-07-16 23:00:25 -07:00
parent 89706d36dc
commit a524b4f485
19 changed files with 1397 additions and 255 deletions
--- a/weed/notification/webhook/webhook_queue.go
+++ b/weed/notification/webhook/webhook_queue.go
@@ -196,7 +196,21 @@ func (w *Queue) logDeadLetterMessages() error {
 		for {
 			select {
 			case msg := <-ch:
-				glog.Errorf("received dead letter message: %s, key: %s", string(msg.Payload), msg.Metadata["key"])
+				if msg == nil {
+					glog.Errorf("received nil message from dead letter channel")
+					continue
+				}
+				key := "unknown"
+				if msg.Metadata != nil {
+					if keyValue, exists := msg.Metadata["key"]; exists {
+						key = keyValue
+					}
+				}
+				payload := ""
+				if msg.Payload != nil {
+					payload = string(msg.Payload)
+				}
+				glog.Errorf("received dead letter message: %s, key: %s", payload, key)
 			case <-w.ctx.Done():
 				return
 			}
--- a/weed/s3api/s3_constants/header.go
+++ b/weed/s3api/s3_constants/header.go
@@ -52,7 +52,10 @@ const (
 	AmzAclWriteAcp    = "X-Amz-Grant-Write-Acp"

 	// S3 Object Lock headers
-	AmzBucketObjectLockEnabled = "X-Amz-Bucket-Object-Lock-Enabled"
+	AmzBucketObjectLockEnabled   = "X-Amz-Bucket-Object-Lock-Enabled"
+	AmzObjectLockMode            = "X-Amz-Object-Lock-Mode"
+	AmzObjectLockRetainUntilDate = "X-Amz-Object-Lock-Retain-Until-Date"
+	AmzObjectLockLegalHold       = "X-Amz-Object-Lock-Legal-Hold"

 	// S3 conditional copy headers
 	AmzCopySourceIfMatch           = "X-Amz-Copy-Source-If-Match"
--- a/weed/s3api/s3api_object_handlers.go
+++ b/weed/s3api/s3api_object_handlers.go
@@ -6,6 +6,7 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"strconv"
 	"strings"
 	"time"

@@ -195,6 +196,9 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)

 		// Set version ID in response header
 		w.Header().Set("x-amz-version-id", targetVersionId)
+
+		// Add object lock metadata to response headers if present
+		s3a.addObjectLockHeadersToResponse(w, entry)
 	} else {
 		// Handle regular GET (non-versioned)
 		destUrl = s3a.toFilerUrl(bucket, object)
@@ -271,6 +275,9 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request

 		// Set version ID in response header
 		w.Header().Set("x-amz-version-id", targetVersionId)
+
+		// Add object lock metadata to response headers if present
+		s3a.addObjectLockHeadersToResponse(w, entry)
 	} else {
 		// Handle regular HEAD (non-versioned)
 		destUrl = s3a.toFilerUrl(bucket, object)
@@ -435,3 +442,44 @@ func passThroughResponse(proxyResponse *http.Response, w http.ResponseWriter) (s
 	}
 	return statusCode, bytesTransferred
 }
+
+// addObjectLockHeadersToResponse extracts object lock metadata from entry Extended attributes
+// and adds the appropriate S3 headers to the response
+func (s3a *S3ApiServer) addObjectLockHeadersToResponse(w http.ResponseWriter, entry *filer_pb.Entry) {
+	if entry == nil || entry.Extended == nil {
+		return
+	}
+
+	// Check if this entry has any object lock metadata (indicating it's from an object lock enabled bucket)
+	hasObjectLockMode := false
+	hasRetentionDate := false
+
+	// Add object lock mode header if present
+	if modeBytes, exists := entry.Extended[s3_constants.ExtObjectLockModeKey]; exists && len(modeBytes) > 0 {
+		w.Header().Set(s3_constants.AmzObjectLockMode, string(modeBytes))
+		hasObjectLockMode = true
+	}
+
+	// Add retention until date header if present
+	if dateBytes, exists := entry.Extended[s3_constants.ExtRetentionUntilDateKey]; exists && len(dateBytes) > 0 {
+		dateStr := string(dateBytes)
+		// Convert Unix timestamp to ISO8601 format for S3 compatibility
+		if timestamp, err := strconv.ParseInt(dateStr, 10, 64); err == nil {
+			retainUntilDate := time.Unix(timestamp, 0).UTC()
+			w.Header().Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+			hasRetentionDate = true
+		} else {
+			glog.Errorf("addObjectLockHeadersToResponse: failed to parse retention until date from stored metadata (dateStr: %s): %v", dateStr, err)
+		}
+	}
+
+	// Add legal hold header - AWS S3 behavior: always include legal hold for object lock enabled buckets
+	if legalHoldBytes, exists := entry.Extended[s3_constants.ExtLegalHoldKey]; exists && len(legalHoldBytes) > 0 {
+		// Return stored S3 standard "ON"/"OFF" values directly
+		w.Header().Set(s3_constants.AmzObjectLockLegalHold, string(legalHoldBytes))
+	} else if hasObjectLockMode || hasRetentionDate {
+		// If this entry has object lock metadata (indicating object lock enabled bucket)
+		// but no legal hold specifically set, default to "OFF" as per AWS S3 behavior
+		w.Header().Set(s3_constants.AmzObjectLockLegalHold, s3_constants.LegalHoldOff)
+	}
+}
--- a/weed/s3api/s3api_object_handlers_put.go
+++ b/weed/s3api/s3api_object_handlers_put.go
@@ -3,9 +3,11 @@ package s3api
 import (
 	"crypto/md5"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
+	"strconv"
 	"strings"
 	"time"

@@ -20,6 +22,18 @@ import (
 	stats_collect "github.com/seaweedfs/seaweedfs/weed/stats"
 )

+// Object lock validation errors
+var (
+	ErrObjectLockVersioningRequired       = errors.New("object lock headers can only be used on versioned buckets")
+	ErrInvalidObjectLockMode              = errors.New("invalid object lock mode")
+	ErrInvalidLegalHoldStatus             = errors.New("invalid legal hold status")
+	ErrInvalidRetentionDateFormat         = errors.New("invalid retention until date format")
+	ErrRetentionDateMustBeFuture          = errors.New("retention until date must be in the future")
+	ErrObjectLockModeRequiresDate         = errors.New("object lock mode requires retention until date")
+	ErrRetentionDateRequiresMode          = errors.New("retention until date requires object lock mode")
+	ErrGovernanceBypassVersioningRequired = errors.New("governance bypass header can only be used on versioned buckets")
+)
+
 func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request) {

 	// http://docs.aws.amazon.com/AmazonS3/latest/dev/UploadingObjects.html
@@ -85,13 +99,24 @@ func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request)

 		glog.V(1).Infof("PutObjectHandler: bucket %s, object %s, versioningEnabled=%v", bucket, object, versioningEnabled)

-		// Check object lock permissions before PUT operation (only for versioned buckets)
-		bypassGovernance := r.Header.Get("x-amz-bypass-governance-retention") == "true"
-		if err := s3a.checkObjectLockPermissionsForPut(r, bucket, object, bypassGovernance, versioningEnabled); err != nil {
-			s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
+		// Validate object lock headers before processing
+		if err := s3a.validateObjectLockHeaders(r, versioningEnabled); err != nil {
+			glog.V(2).Infof("PutObjectHandler: object lock header validation failed for bucket %s, object %s: %v", bucket, object, err)
+			s3err.WriteErrorResponse(w, r, mapValidationErrorToS3Error(err))
 			return
 		}

+		// For non-versioned buckets, check if existing object has object lock protections
+		// that would prevent overwrite (PUT operations overwrite existing objects in non-versioned buckets)
+		if !versioningEnabled {
+			bypassGovernance := r.Header.Get("x-amz-bypass-governance-retention") == "true"
+			if err := s3a.checkObjectLockPermissions(r, bucket, object, "", bypassGovernance); err != nil {
+				glog.V(2).Infof("PutObjectHandler: object lock permissions check failed for %s/%s: %v", bucket, object, err)
+				s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
+				return
+			}
+		}
+
 		if versioningEnabled {
 			// Handle versioned PUT
 			glog.V(1).Infof("PutObjectHandler: using versioned PUT for %s/%s", bucket, object)
@@ -287,6 +312,12 @@ func (s3a *S3ApiServer) putVersionedObject(r *http.Request, bucket, object strin
 	}
 	versionEntry.Extended[s3_constants.ExtETagKey] = []byte(etag)

+	// Extract and store object lock metadata from request headers
+	if err := s3a.extractObjectLockMetadataFromRequest(r, versionEntry); err != nil {
+		glog.Errorf("putVersionedObject: failed to extract object lock metadata: %v", err)
+		return "", "", s3err.ErrInvalidRequest
+	}
+
 	// Update the version entry with metadata
 	err = s3a.mkFile(bucketDir, versionObjectPath, versionEntry.Chunks, func(updatedEntry *filer_pb.Entry) {
 		updatedEntry.Extended = versionEntry.Extended
@@ -341,3 +372,128 @@ func (s3a *S3ApiServer) updateLatestVersionInDirectory(bucket, object, versionId

 	return nil
 }
+
+// extractObjectLockMetadataFromRequest extracts object lock headers from PUT requests
+// and stores them in the entry's Extended attributes
+func (s3a *S3ApiServer) extractObjectLockMetadataFromRequest(r *http.Request, entry *filer_pb.Entry) error {
+	if entry.Extended == nil {
+		entry.Extended = make(map[string][]byte)
+	}
+
+	// Extract object lock mode (GOVERNANCE or COMPLIANCE)
+	if mode := r.Header.Get(s3_constants.AmzObjectLockMode); mode != "" {
+		entry.Extended[s3_constants.ExtObjectLockModeKey] = []byte(mode)
+		glog.V(2).Infof("extractObjectLockMetadataFromRequest: storing object lock mode: %s", mode)
+	}
+
+	// Extract retention until date
+	if retainUntilDate := r.Header.Get(s3_constants.AmzObjectLockRetainUntilDate); retainUntilDate != "" {
+		// Parse the ISO8601 date and convert to Unix timestamp for storage
+		parsedTime, err := time.Parse(time.RFC3339, retainUntilDate)
+		if err != nil {
+			glog.Errorf("extractObjectLockMetadataFromRequest: failed to parse retention until date, expected format: %s, error: %v", time.RFC3339, err)
+			return ErrInvalidRetentionDateFormat
+		}
+		entry.Extended[s3_constants.ExtRetentionUntilDateKey] = []byte(strconv.FormatInt(parsedTime.Unix(), 10))
+		glog.V(2).Infof("extractObjectLockMetadataFromRequest: storing retention until date (timestamp: %d)", parsedTime.Unix())
+	}
+
+	// Extract legal hold status
+	if legalHold := r.Header.Get(s3_constants.AmzObjectLockLegalHold); legalHold != "" {
+		// Store S3 standard "ON"/"OFF" values directly
+		if legalHold == s3_constants.LegalHoldOn || legalHold == s3_constants.LegalHoldOff {
+			entry.Extended[s3_constants.ExtLegalHoldKey] = []byte(legalHold)
+			glog.V(2).Infof("extractObjectLockMetadataFromRequest: storing legal hold: %s", legalHold)
+		} else {
+			glog.Errorf("extractObjectLockMetadataFromRequest: unexpected legal hold value provided, expected 'ON' or 'OFF'")
+			return ErrInvalidLegalHoldStatus
+		}
+	}
+
+	return nil
+}
+
+// validateObjectLockHeaders validates object lock headers in PUT requests
+func (s3a *S3ApiServer) validateObjectLockHeaders(r *http.Request, versioningEnabled bool) error {
+	// Extract object lock headers from request
+	mode := r.Header.Get(s3_constants.AmzObjectLockMode)
+	retainUntilDateStr := r.Header.Get(s3_constants.AmzObjectLockRetainUntilDate)
+	legalHold := r.Header.Get(s3_constants.AmzObjectLockLegalHold)
+
+	// Check if any object lock headers are present
+	hasObjectLockHeaders := mode != "" || retainUntilDateStr != "" || legalHold != ""
+
+	// Object lock headers can only be used on versioned buckets
+	if hasObjectLockHeaders && !versioningEnabled {
+		return ErrObjectLockVersioningRequired
+	}
+
+	// Validate object lock mode if present
+	if mode != "" {
+		if mode != s3_constants.RetentionModeGovernance && mode != s3_constants.RetentionModeCompliance {
+			return ErrInvalidObjectLockMode
+		}
+	}
+
+	// Validate retention date if present
+	if retainUntilDateStr != "" {
+		retainUntilDate, err := time.Parse(time.RFC3339, retainUntilDateStr)
+		if err != nil {
+			return ErrInvalidRetentionDateFormat
+		}
+
+		// Retention date must be in the future
+		if retainUntilDate.Before(time.Now()) {
+			return ErrRetentionDateMustBeFuture
+		}
+	}
+
+	// If mode is specified, retention date must also be specified
+	if mode != "" && retainUntilDateStr == "" {
+		return ErrObjectLockModeRequiresDate
+	}
+
+	// If retention date is specified, mode must also be specified
+	if retainUntilDateStr != "" && mode == "" {
+		return ErrRetentionDateRequiresMode
+	}
+
+	// Validate legal hold if present
+	if legalHold != "" {
+		if legalHold != s3_constants.LegalHoldOn && legalHold != s3_constants.LegalHoldOff {
+			return ErrInvalidLegalHoldStatus
+		}
+	}
+
+	// Check for governance bypass header - only valid for versioned buckets
+	bypassGovernance := r.Header.Get("x-amz-bypass-governance-retention") == "true"
+
+	// Governance bypass headers are only valid for versioned buckets (like object lock headers)
+	if bypassGovernance && !versioningEnabled {
+		return ErrGovernanceBypassVersioningRequired
+	}
+
+	return nil
+}
+
+// mapValidationErrorToS3Error maps object lock validation errors to appropriate S3 error codes
+func mapValidationErrorToS3Error(err error) s3err.ErrorCode {
+	switch {
+	case errors.Is(err, ErrObjectLockVersioningRequired):
+		return s3err.ErrInvalidRequest
+	case errors.Is(err, ErrInvalidObjectLockMode):
+		return s3err.ErrInvalidRequest
+	case errors.Is(err, ErrInvalidLegalHoldStatus):
+		return s3err.ErrInvalidRequest
+	case errors.Is(err, ErrInvalidRetentionDateFormat):
+		return s3err.ErrMalformedDate
+	case errors.Is(err, ErrRetentionDateMustBeFuture),
+		errors.Is(err, ErrObjectLockModeRequiresDate),
+		errors.Is(err, ErrRetentionDateRequiresMode):
+		return s3err.ErrInvalidRequest
+	case errors.Is(err, ErrGovernanceBypassVersioningRequired):
+		return s3err.ErrInvalidRequest
+	default:
+		return s3err.ErrInvalidRequest
+	}
+}
--- a/weed/s3api/s3api_object_lock_headers_test.go
+++ b/weed/s3api/s3api_object_lock_headers_test.go
@@ -0,0 +1,662 @@
+package s3api
+
+import (
+	"fmt"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+	"time"
+
+	"errors"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestExtractObjectLockMetadataFromRequest tests the function that extracts
+// object lock headers from PUT requests and stores them in Extended attributes.
+// This test would have caught the bug where object lock headers were ignored.
+func TestExtractObjectLockMetadataFromRequest(t *testing.T) {
+	s3a := &S3ApiServer{}
+
+	t.Run("Extract COMPLIANCE mode and retention date", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		retainUntilDate := time.Now().Add(24 * time.Hour)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+		entry := &filer_pb.Entry{
+			Extended: make(map[string][]byte),
+		}
+
+		err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+		assert.NoError(t, err)
+
+		// Verify mode was stored
+		assert.Contains(t, entry.Extended, s3_constants.ExtObjectLockModeKey)
+		assert.Equal(t, "COMPLIANCE", string(entry.Extended[s3_constants.ExtObjectLockModeKey]))
+
+		// Verify retention date was stored
+		assert.Contains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
+		storedTimestamp, err := strconv.ParseInt(string(entry.Extended[s3_constants.ExtRetentionUntilDateKey]), 10, 64)
+		assert.NoError(t, err)
+		storedTime := time.Unix(storedTimestamp, 0)
+		assert.WithinDuration(t, retainUntilDate, storedTime, 1*time.Second)
+	})
+
+	t.Run("Extract GOVERNANCE mode and retention date", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		retainUntilDate := time.Now().Add(12 * time.Hour)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+		entry := &filer_pb.Entry{
+			Extended: make(map[string][]byte),
+		}
+
+		err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+		assert.NoError(t, err)
+
+		assert.Equal(t, "GOVERNANCE", string(entry.Extended[s3_constants.ExtObjectLockModeKey]))
+		assert.Contains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
+	})
+
+	t.Run("Extract legal hold ON", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
+
+		entry := &filer_pb.Entry{
+			Extended: make(map[string][]byte),
+		}
+
+		err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+		assert.NoError(t, err)
+
+		assert.Contains(t, entry.Extended, s3_constants.ExtLegalHoldKey)
+		assert.Equal(t, "ON", string(entry.Extended[s3_constants.ExtLegalHoldKey]))
+	})
+
+	t.Run("Extract legal hold OFF", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "OFF")
+
+		entry := &filer_pb.Entry{
+			Extended: make(map[string][]byte),
+		}
+
+		err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+		assert.NoError(t, err)
+
+		assert.Contains(t, entry.Extended, s3_constants.ExtLegalHoldKey)
+		assert.Equal(t, "OFF", string(entry.Extended[s3_constants.ExtLegalHoldKey]))
+	})
+
+	t.Run("Handle all object lock headers together", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		retainUntilDate := time.Now().Add(24 * time.Hour)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
+
+		entry := &filer_pb.Entry{
+			Extended: make(map[string][]byte),
+		}
+
+		err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+		assert.NoError(t, err)
+
+		// All metadata should be stored
+		assert.Equal(t, "COMPLIANCE", string(entry.Extended[s3_constants.ExtObjectLockModeKey]))
+		assert.Contains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
+		assert.Equal(t, "ON", string(entry.Extended[s3_constants.ExtLegalHoldKey]))
+	})
+
+	t.Run("Handle no object lock headers", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		// No object lock headers set
+
+		entry := &filer_pb.Entry{
+			Extended: make(map[string][]byte),
+		}
+
+		err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+		assert.NoError(t, err)
+
+		// No object lock metadata should be stored
+		assert.NotContains(t, entry.Extended, s3_constants.ExtObjectLockModeKey)
+		assert.NotContains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
+		assert.NotContains(t, entry.Extended, s3_constants.ExtLegalHoldKey)
+	})
+
+	t.Run("Handle invalid retention date - should return error", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, "invalid-date")
+
+		entry := &filer_pb.Entry{
+			Extended: make(map[string][]byte),
+		}
+
+		err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+		assert.Error(t, err)
+		assert.True(t, errors.Is(err, ErrInvalidRetentionDateFormat))
+
+		// Mode should be stored but not invalid date
+		assert.Equal(t, "GOVERNANCE", string(entry.Extended[s3_constants.ExtObjectLockModeKey]))
+		assert.NotContains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
+	})
+
+	t.Run("Handle invalid legal hold value - should return error", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "INVALID")
+
+		entry := &filer_pb.Entry{
+			Extended: make(map[string][]byte),
+		}
+
+		err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+		assert.Error(t, err)
+		assert.True(t, errors.Is(err, ErrInvalidLegalHoldStatus))
+
+		// No legal hold metadata should be stored due to error
+		assert.NotContains(t, entry.Extended, s3_constants.ExtLegalHoldKey)
+	})
+}
+
+// TestAddObjectLockHeadersToResponse tests the function that adds object lock
+// metadata from Extended attributes to HTTP response headers.
+// This test would have caught the bug where HEAD responses didn't include object lock metadata.
+func TestAddObjectLockHeadersToResponse(t *testing.T) {
+	s3a := &S3ApiServer{}
+
+	t.Run("Add COMPLIANCE mode and retention date to response", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		retainUntilTime := time.Now().Add(24 * time.Hour)
+
+		entry := &filer_pb.Entry{
+			Extended: map[string][]byte{
+				s3_constants.ExtObjectLockModeKey:     []byte("COMPLIANCE"),
+				s3_constants.ExtRetentionUntilDateKey: []byte(strconv.FormatInt(retainUntilTime.Unix(), 10)),
+			},
+		}
+
+		s3a.addObjectLockHeadersToResponse(w, entry)
+
+		// Verify headers were set
+		assert.Equal(t, "COMPLIANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+		assert.NotEmpty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+
+		// Verify the date format is correct
+		returnedDate := w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate)
+		parsedTime, err := time.Parse(time.RFC3339, returnedDate)
+		assert.NoError(t, err)
+		assert.WithinDuration(t, retainUntilTime, parsedTime, 1*time.Second)
+	})
+
+	t.Run("Add GOVERNANCE mode to response", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		entry := &filer_pb.Entry{
+			Extended: map[string][]byte{
+				s3_constants.ExtObjectLockModeKey: []byte("GOVERNANCE"),
+			},
+		}
+
+		s3a.addObjectLockHeadersToResponse(w, entry)
+
+		assert.Equal(t, "GOVERNANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+	})
+
+	t.Run("Add legal hold ON to response", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		entry := &filer_pb.Entry{
+			Extended: map[string][]byte{
+				s3_constants.ExtLegalHoldKey: []byte("ON"),
+			},
+		}
+
+		s3a.addObjectLockHeadersToResponse(w, entry)
+
+		assert.Equal(t, "ON", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+	})
+
+	t.Run("Add legal hold OFF to response", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		entry := &filer_pb.Entry{
+			Extended: map[string][]byte{
+				s3_constants.ExtLegalHoldKey: []byte("OFF"),
+			},
+		}
+
+		s3a.addObjectLockHeadersToResponse(w, entry)
+
+		assert.Equal(t, "OFF", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+	})
+
+	t.Run("Add all object lock headers to response", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		retainUntilTime := time.Now().Add(12 * time.Hour)
+
+		entry := &filer_pb.Entry{
+			Extended: map[string][]byte{
+				s3_constants.ExtObjectLockModeKey:     []byte("GOVERNANCE"),
+				s3_constants.ExtRetentionUntilDateKey: []byte(strconv.FormatInt(retainUntilTime.Unix(), 10)),
+				s3_constants.ExtLegalHoldKey:          []byte("ON"),
+			},
+		}
+
+		s3a.addObjectLockHeadersToResponse(w, entry)
+
+		// All headers should be set
+		assert.Equal(t, "GOVERNANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+		assert.NotEmpty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+		assert.Equal(t, "ON", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+	})
+
+	t.Run("Handle entry with no object lock metadata", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		entry := &filer_pb.Entry{
+			Extended: map[string][]byte{
+				"other-metadata": []byte("some-value"),
+			},
+		}
+
+		s3a.addObjectLockHeadersToResponse(w, entry)
+
+		// No object lock headers should be set for entries without object lock metadata
+		assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockMode))
+		assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+		assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+	})
+
+	t.Run("Handle entry with object lock mode but no legal hold - should default to OFF", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		entry := &filer_pb.Entry{
+			Extended: map[string][]byte{
+				s3_constants.ExtObjectLockModeKey: []byte("GOVERNANCE"),
+			},
+		}
+
+		s3a.addObjectLockHeadersToResponse(w, entry)
+
+		// Should set mode and default legal hold to OFF
+		assert.Equal(t, "GOVERNANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+		assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+		assert.Equal(t, "OFF", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+	})
+
+	t.Run("Handle entry with retention date but no legal hold - should default to OFF", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		retainUntilTime := time.Now().Add(24 * time.Hour)
+		entry := &filer_pb.Entry{
+			Extended: map[string][]byte{
+				s3_constants.ExtRetentionUntilDateKey: []byte(strconv.FormatInt(retainUntilTime.Unix(), 10)),
+			},
+		}
+
+		s3a.addObjectLockHeadersToResponse(w, entry)
+
+		// Should set retention date and default legal hold to OFF
+		assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockMode))
+		assert.NotEmpty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+		assert.Equal(t, "OFF", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+	})
+
+	t.Run("Handle nil entry gracefully", func(t *testing.T) {
+		w := httptest.NewRecorder()
+
+		// Should not panic
+		s3a.addObjectLockHeadersToResponse(w, nil)
+
+		// No headers should be set
+		assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockMode))
+		assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+		assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+	})
+
+	t.Run("Handle entry with nil Extended map gracefully", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		entry := &filer_pb.Entry{
+			Extended: nil,
+		}
+
+		// Should not panic
+		s3a.addObjectLockHeadersToResponse(w, entry)
+
+		// No headers should be set
+		assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockMode))
+		assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+		assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+	})
+
+	t.Run("Handle invalid retention timestamp gracefully", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		entry := &filer_pb.Entry{
+			Extended: map[string][]byte{
+				s3_constants.ExtObjectLockModeKey:     []byte("COMPLIANCE"),
+				s3_constants.ExtRetentionUntilDateKey: []byte("invalid-timestamp"),
+			},
+		}
+
+		s3a.addObjectLockHeadersToResponse(w, entry)
+
+		// Mode should be set but not retention date due to invalid timestamp
+		assert.Equal(t, "COMPLIANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+		assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+	})
+}
+
+// TestObjectLockHeaderRoundTrip tests the complete round trip:
+// extract from request → store in Extended attributes → add to response
+func TestObjectLockHeaderRoundTrip(t *testing.T) {
+	s3a := &S3ApiServer{}
+
+	t.Run("Complete round trip for COMPLIANCE mode", func(t *testing.T) {
+		// 1. Create request with object lock headers
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		retainUntilDate := time.Now().Add(24 * time.Hour)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
+
+		// 2. Extract and store in Extended attributes
+		entry := &filer_pb.Entry{
+			Extended: make(map[string][]byte),
+		}
+		err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+		assert.NoError(t, err)
+
+		// 3. Add to response headers
+		w := httptest.NewRecorder()
+		s3a.addObjectLockHeadersToResponse(w, entry)
+
+		// 4. Verify round trip preserved all data
+		assert.Equal(t, "COMPLIANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+		assert.Equal(t, "ON", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+
+		returnedDate := w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate)
+		parsedTime, err := time.Parse(time.RFC3339, returnedDate)
+		assert.NoError(t, err)
+		assert.WithinDuration(t, retainUntilDate, parsedTime, 1*time.Second)
+	})
+
+	t.Run("Complete round trip for GOVERNANCE mode", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		retainUntilDate := time.Now().Add(12 * time.Hour)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+		entry := &filer_pb.Entry{Extended: make(map[string][]byte)}
+		err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+		assert.NoError(t, err)
+
+		w := httptest.NewRecorder()
+		s3a.addObjectLockHeadersToResponse(w, entry)
+
+		assert.Equal(t, "GOVERNANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+		assert.NotEmpty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+	})
+}
+
+// TestValidateObjectLockHeaders tests the validateObjectLockHeaders function
+// to ensure proper validation of object lock headers in PUT requests
+func TestValidateObjectLockHeaders(t *testing.T) {
+	s3a := &S3ApiServer{}
+
+	t.Run("Valid COMPLIANCE mode with retention date on versioned bucket", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		retainUntilDate := time.Now().Add(24 * time.Hour)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.NoError(t, err)
+	})
+
+	t.Run("Valid GOVERNANCE mode with retention date on versioned bucket", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		retainUntilDate := time.Now().Add(12 * time.Hour)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.NoError(t, err)
+	})
+
+	t.Run("Valid legal hold ON on versioned bucket", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.NoError(t, err)
+	})
+
+	t.Run("Valid legal hold OFF on versioned bucket", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "OFF")
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.NoError(t, err)
+	})
+
+	t.Run("Invalid object lock mode", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "INVALID_MODE")
+		retainUntilDate := time.Now().Add(24 * time.Hour)
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.Error(t, err)
+		assert.True(t, errors.Is(err, ErrInvalidObjectLockMode))
+	})
+
+	t.Run("Invalid legal hold status", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "INVALID_STATUS")
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.Error(t, err)
+		assert.True(t, errors.Is(err, ErrInvalidLegalHoldStatus))
+	})
+
+	t.Run("Object lock headers on non-versioned bucket", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+		retainUntilDate := time.Now().Add(24 * time.Hour)
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+		err := s3a.validateObjectLockHeaders(req, false) // non-versioned bucket
+		assert.Error(t, err)
+		assert.True(t, errors.Is(err, ErrObjectLockVersioningRequired))
+	})
+
+	t.Run("Invalid retention date format", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, "invalid-date-format")
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.Error(t, err)
+		assert.True(t, errors.Is(err, ErrInvalidRetentionDateFormat))
+	})
+
+	t.Run("Retention date in the past", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+		pastDate := time.Now().Add(-24 * time.Hour)
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, pastDate.Format(time.RFC3339))
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.Error(t, err)
+		assert.True(t, errors.Is(err, ErrRetentionDateMustBeFuture))
+	})
+
+	t.Run("Mode without retention date", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.Error(t, err)
+		assert.True(t, errors.Is(err, ErrObjectLockModeRequiresDate))
+	})
+
+	t.Run("Retention date without mode", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		retainUntilDate := time.Now().Add(24 * time.Hour)
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.Error(t, err)
+		assert.True(t, errors.Is(err, ErrRetentionDateRequiresMode))
+	})
+
+	t.Run("Governance bypass header on non-versioned bucket", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set("x-amz-bypass-governance-retention", "true")
+
+		err := s3a.validateObjectLockHeaders(req, false) // non-versioned bucket
+		assert.Error(t, err)
+		assert.True(t, errors.Is(err, ErrGovernanceBypassVersioningRequired))
+	})
+
+	t.Run("Governance bypass header on versioned bucket should pass", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		req.Header.Set("x-amz-bypass-governance-retention", "true")
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.NoError(t, err)
+	})
+
+	t.Run("No object lock headers should pass", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		// No object lock headers set
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.NoError(t, err)
+	})
+
+	t.Run("Mixed valid headers should pass", func(t *testing.T) {
+		req := httptest.NewRequest("PUT", "/bucket/object", nil)
+		retainUntilDate := time.Now().Add(48 * time.Hour)
+		req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
+		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
+
+		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		assert.NoError(t, err)
+	})
+}
+
+// TestMapValidationErrorToS3Error tests the error mapping function
+func TestMapValidationErrorToS3Error(t *testing.T) {
+	tests := []struct {
+		name         string
+		inputError   error
+		expectedCode s3err.ErrorCode
+	}{
+		{
+			name:         "ErrObjectLockVersioningRequired",
+			inputError:   ErrObjectLockVersioningRequired,
+			expectedCode: s3err.ErrInvalidRequest,
+		},
+		{
+			name:         "ErrInvalidObjectLockMode",
+			inputError:   ErrInvalidObjectLockMode,
+			expectedCode: s3err.ErrInvalidRequest,
+		},
+		{
+			name:         "ErrInvalidLegalHoldStatus",
+			inputError:   ErrInvalidLegalHoldStatus,
+			expectedCode: s3err.ErrInvalidRequest,
+		},
+		{
+			name:         "ErrInvalidRetentionDateFormat",
+			inputError:   ErrInvalidRetentionDateFormat,
+			expectedCode: s3err.ErrMalformedDate,
+		},
+		{
+			name:         "ErrRetentionDateMustBeFuture",
+			inputError:   ErrRetentionDateMustBeFuture,
+			expectedCode: s3err.ErrInvalidRequest,
+		},
+		{
+			name:         "ErrObjectLockModeRequiresDate",
+			inputError:   ErrObjectLockModeRequiresDate,
+			expectedCode: s3err.ErrInvalidRequest,
+		},
+		{
+			name:         "ErrRetentionDateRequiresMode",
+			inputError:   ErrRetentionDateRequiresMode,
+			expectedCode: s3err.ErrInvalidRequest,
+		},
+		{
+			name:         "ErrGovernanceBypassVersioningRequired",
+			inputError:   ErrGovernanceBypassVersioningRequired,
+			expectedCode: s3err.ErrInvalidRequest,
+		},
+		{
+			name:         "Unknown error defaults to ErrInvalidRequest",
+			inputError:   fmt.Errorf("unknown error"),
+			expectedCode: s3err.ErrInvalidRequest,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := mapValidationErrorToS3Error(tt.inputError)
+			assert.Equal(t, tt.expectedCode, result)
+		})
+	}
+}
+
+// TestObjectLockPermissionLogic documents the correct behavior for object lock permission checks
+// in PUT operations for both versioned and non-versioned buckets
+func TestObjectLockPermissionLogic(t *testing.T) {
+	t.Run("Non-versioned bucket PUT operation logic", func(t *testing.T) {
+		// In non-versioned buckets, PUT operations overwrite existing objects
+		// Therefore, we MUST check if the existing object has object lock protections
+		// that would prevent overwrite before allowing the PUT operation.
+		//
+		// This test documents the expected behavior:
+		// 1. Check object lock headers validity (handled by validateObjectLockHeaders)
+		// 2. Check if existing object has object lock protections (handled by checkObjectLockPermissions)
+		// 3. If existing object is under retention/legal hold, deny the PUT unless governance bypass is valid
+
+		t.Log("For non-versioned buckets:")
+		t.Log("- PUT operations overwrite existing objects")
+		t.Log("- Must check existing object lock protections before allowing overwrite")
+		t.Log("- Governance bypass headers can be used to override GOVERNANCE mode retention")
+		t.Log("- COMPLIANCE mode retention and legal holds cannot be bypassed")
+	})
+
+	t.Run("Versioned bucket PUT operation logic", func(t *testing.T) {
+		// In versioned buckets, PUT operations create new versions without overwriting existing ones
+		// Therefore, we do NOT need to check existing object permissions since we're not modifying them.
+		// We only need to validate the object lock headers for the new version being created.
+		//
+		// This test documents the expected behavior:
+		// 1. Check object lock headers validity (handled by validateObjectLockHeaders)
+		// 2. Skip checking existing object permissions (since we're creating a new version)
+		// 3. Apply object lock metadata to the new version being created
+
+		t.Log("For versioned buckets:")
+		t.Log("- PUT operations create new versions without overwriting existing objects")
+		t.Log("- No need to check existing object lock protections")
+		t.Log("- Only validate object lock headers for the new version being created")
+		t.Log("- Each version has independent object lock settings")
+	})
+
+	t.Run("Governance bypass header validation", func(t *testing.T) {
+		// Governance bypass headers should only be used in specific scenarios:
+		// 1. Only valid on versioned buckets (consistent with object lock headers)
+		// 2. For non-versioned buckets: Used to override existing object's GOVERNANCE retention
+		// 3. For versioned buckets: Not typically needed since new versions don't conflict with existing ones
+
+		t.Log("Governance bypass behavior:")
+		t.Log("- Only valid on versioned buckets (header validation)")
+		t.Log("- For non-versioned buckets: Allows overwriting objects under GOVERNANCE retention")
+		t.Log("- For versioned buckets: Not typically needed for PUT operations")
+		t.Log("- Must have s3:BypassGovernanceRetention permission")
+	})
+}
--- a/weed/s3api/s3api_object_retention.go
+++ b/weed/s3api/s3api_object_retention.go
@@ -611,22 +611,6 @@ func (s3a *S3ApiServer) isObjectLockAvailable(bucket string) error {
 	return nil
 }

-// checkObjectLockPermissionsForPut checks object lock permissions for PUT operations
-// This is a shared helper to avoid code duplication in PUT handlers
-func (s3a *S3ApiServer) checkObjectLockPermissionsForPut(request *http.Request, bucket, object string, bypassGovernance bool, versioningEnabled bool) error {
-	// Object Lock only applies to versioned buckets (AWS S3 requirement)
-	if !versioningEnabled {
-		return nil
-	}
-
-	// For PUT operations, we check permissions on the current object (empty versionId)
-	if err := s3a.checkObjectLockPermissions(request, bucket, object, "", bypassGovernance); err != nil {
-		glog.V(2).Infof("checkObjectLockPermissionsForPut: object lock check failed for %s/%s: %v", bucket, object, err)
-		return err
-	}
-	return nil
-}
-
 // handleObjectLockAvailabilityCheck is a helper function to check object lock availability
 // and write the appropriate error response if not available. This reduces code duplication
 // across all retention handlers.