snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/s3api/s3_objectlock/object_lock_check.go

@@ -0,0 +1,241 @@
+package s3_objectlock
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+)
+
+// ====================================================================
+// SHARED OBJECT LOCK CHECKING FUNCTIONS
+// ====================================================================
+// These functions are used by S3 API, Admin UI, and shell commands for
+// checking Object Lock status before bucket deletion.
+
+// EntryHasActiveLock checks if an entry has an active retention or legal hold
+// This is a standalone function that can be used by any component
+func EntryHasActiveLock(entry *filer_pb.Entry, currentTime time.Time) bool {
+	if entry == nil || entry.Extended == nil {
+		return false
+	}
+
+	// Check for active legal hold (case-insensitive, trimmed for defensive parsing)
+	if legalHoldBytes, exists := entry.Extended[s3_constants.ExtLegalHoldKey]; exists {
+		legalHold := strings.TrimSpace(strings.ToUpper(string(legalHoldBytes)))
+		if legalHold == s3_constants.LegalHoldOn {
+			return true
+		}
+	}
+
+	// Check for active retention (case-insensitive, trimmed for defensive parsing)
+	if modeBytes, exists := entry.Extended[s3_constants.ExtObjectLockModeKey]; exists {
+		mode := strings.TrimSpace(strings.ToUpper(string(modeBytes)))
+		if mode == s3_constants.RetentionModeCompliance || mode == s3_constants.RetentionModeGovernance {
+			// Check if retention is still active
+			if dateBytes, dateExists := entry.Extended[s3_constants.ExtRetentionUntilDateKey]; dateExists {
+				dateStr := strings.TrimSpace(string(dateBytes))
+				timestamp, err := strconv.ParseInt(dateStr, 10, 64)
+				if err != nil {
+					// Fail-safe: if we can't parse the retention date, assume the object is locked
+					// to prevent accidental data loss
+					glog.Warningf("Failed to parse retention date '%s' for entry, assuming locked: %v", dateStr, err)
+					return true
+				}
+				retainUntil := time.Unix(timestamp, 0)
+				if retainUntil.After(currentTime) {
+					return true
+				}
+			}
+		}
+	}
+
+	return false
+}
+
+// HasObjectsWithActiveLocks checks if any objects in the bucket have active retention or legal hold
+// This function uses the filer gRPC client to scan the bucket directory
+func HasObjectsWithActiveLocks(ctx context.Context, client filer_pb.SeaweedFilerClient, bucketPath string) (bool, error) {
+	hasLocks := false
+	currentTime := time.Now()
+
+	err := recursivelyCheckLocksWithClient(ctx, client, bucketPath, &hasLocks, currentTime)
+	if err != nil {
+		return false, fmt.Errorf("error checking for locked objects: %w", err)
+	}
+
+	return hasLocks, nil
+}
+
+// paginateEntries is a generic helper that handles pagination logic for listing directory entries.
+// The processEntry callback is called for each entry; returning stop=true stops iteration early.
+func paginateEntries(ctx context.Context, client filer_pb.SeaweedFilerClient, dir string,
+	processEntry func(entry *filer_pb.Entry) (stop bool, err error)) error {
+	lastFileName := ""
+	for {
+		resp, err := client.ListEntries(ctx, &filer_pb.ListEntriesRequest{
+			Directory:          dir,
+			StartFromFileName:  lastFileName,
+			InclusiveStartFrom: false,
+			Limit:              10000,
+		})
+		if err != nil {
+			return fmt.Errorf("failed to list directory %s: %w", dir, err)
+		}
+
+		entriesReceived := false
+		for {
+			entryResp, recvErr := resp.Recv()
+			if recvErr != nil {
+				if errors.Is(recvErr, io.EOF) {
+					break // Normal end of stream
+				}
+				return fmt.Errorf("failed to receive entry from %s: %w", dir, recvErr)
+			}
+			entry := entryResp.Entry
+			if entry == nil {
+				continue
+			}
+			entriesReceived = true
+			lastFileName = entry.Name
+
+			// Skip invalid entry names to prevent path traversal
+			if entry.Name == "" || entry.Name == "." || entry.Name == ".." ||
+				strings.ContainsAny(entry.Name, "/\\") {
+				glog.V(2).Infof("Skipping invalid entry name: %q in %s", entry.Name, dir)
+				continue
+			}
+
+			stop, err := processEntry(entry)
+			if err != nil {
+				return err
+			}
+			if stop {
+				return nil
+			}
+		}
+
+		if !entriesReceived {
+			break
+		}
+	}
+	return nil
+}
+
+// recursivelyCheckLocksWithClient recursively checks all objects and versions for active locks
+func recursivelyCheckLocksWithClient(ctx context.Context, client filer_pb.SeaweedFilerClient, dir string, hasLocks *bool, currentTime time.Time) error {
+	if *hasLocks {
+		return nil // Early exit if already found a locked object
+	}
+
+	return paginateEntries(ctx, client, dir, func(entry *filer_pb.Entry) (bool, error) {
+		if *hasLocks {
+			return true, nil // Stop iteration
+		}
+
+		// Skip special directories
+		if entry.Name == s3_constants.MultipartUploadsFolder {
+			return false, nil // Continue
+		}
+
+		if entry.IsDirectory {
+			subDir := dir + "/" + entry.Name
+			if entry.Name == s3_constants.VersionsFolder {
+				// Check all version files (exact match for .versions folder)
+				if err := checkVersionsForLocksWithClient(ctx, client, subDir, hasLocks, currentTime); err != nil {
+					return false, err
+				}
+			} else {
+				// A directory-marker object (key ending in "/") is stored as a
+				// directory entry and can carry a lock, so check it before recursing.
+				if EntryHasActiveLock(entry, currentTime) {
+					*hasLocks = true
+					glog.V(2).Infof("Found directory marker with active lock: %s/%s", dir, entry.Name)
+					return true, nil
+				}
+				// Recursively check subdirectories
+				if err := recursivelyCheckLocksWithClient(ctx, client, subDir, hasLocks, currentTime); err != nil {
+					return false, err
+				}
+			}
+		} else {
+			// Check if this object has an active lock
+			if EntryHasActiveLock(entry, currentTime) {
+				*hasLocks = true
+				glog.V(2).Infof("Found object with active lock: %s/%s", dir, entry.Name)
+				return true, nil // Stop iteration
+			}
+		}
+		return false, nil // Continue
+	})
+}
+
+// checkVersionsForLocksWithClient checks all versions in a .versions directory for active locks
+func checkVersionsForLocksWithClient(ctx context.Context, client filer_pb.SeaweedFilerClient, versionsDir string, hasLocks *bool, currentTime time.Time) error {
+	return paginateEntries(ctx, client, versionsDir, func(entry *filer_pb.Entry) (bool, error) {
+		if *hasLocks {
+			return true, nil // Stop iteration
+		}
+
+		if EntryHasActiveLock(entry, currentTime) {
+			*hasLocks = true
+			glog.V(2).Infof("Found version with active lock: %s/%s", versionsDir, entry.Name)
+			return true, nil // Stop iteration
+		}
+		return false, nil // Continue
+	})
+}
+
+// IsObjectLockEnabled checks if Object Lock is enabled on a bucket entry
+func IsObjectLockEnabled(entry *filer_pb.Entry) bool {
+	if entry == nil || entry.Extended == nil {
+		return false
+	}
+
+	enabledBytes, exists := entry.Extended[s3_constants.ExtObjectLockEnabledKey]
+	if !exists {
+		return false
+	}
+
+	enabled := string(enabledBytes)
+	return enabled == s3_constants.ObjectLockEnabled || enabled == "true"
+}
+
+// CheckBucketForLockedObjects is a unified function that checks if a bucket has Object Lock enabled
+// and if so, scans for objects with active locks. This combines the bucket lookup and lock check
+// into a single operation used by S3 API, Admin UI, and shell commands.
+// Returns an error if the bucket has locked objects or if the check fails.
+func CheckBucketForLockedObjects(ctx context.Context, client filer_pb.SeaweedFilerClient, bucketsPath, bucketName string) error {
+	// Look up the bucket entry
+	lookupResp, err := client.LookupDirectoryEntry(ctx, &filer_pb.LookupDirectoryEntryRequest{
+		Directory: bucketsPath,
+		Name:      bucketName,
+	})
+	if err != nil {
+		return fmt.Errorf("bucket not found: %w", err)
+	}
+
+	// Check if Object Lock is enabled
+	if !IsObjectLockEnabled(lookupResp.Entry) {
+		return nil // No Object Lock, nothing to check
+	}
+
+	// Check for objects with active locks
+	bucketPath := bucketsPath + "/" + bucketName
+	hasLockedObjects, checkErr := HasObjectsWithActiveLocks(ctx, client, bucketPath)
+	if checkErr != nil {
+		return fmt.Errorf("failed to check for locked objects: %w", checkErr)
+	}
+	if hasLockedObjects {
+		return fmt.Errorf("bucket has objects with active Object Lock retention or legal hold")
+	}
+
+	return nil
+}

weed/s3api/s3_objectlock/object_lock_check_test.go

@@ -0,0 +1,93 @@
+package s3_objectlock
+
+import (
+	"context"
+	"io"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+)
+
+type fakeListStream struct {
+	entries []*filer_pb.Entry
+	index   int
+}
+
+func (s *fakeListStream) Recv() (*filer_pb.ListEntriesResponse, error) {
+	if s.index >= len(s.entries) {
+		return nil, io.EOF
+	}
+	e := s.entries[s.index]
+	s.index++
+	return &filer_pb.ListEntriesResponse{Entry: e}, nil
+}
+
+func (s *fakeListStream) Header() (metadata.MD, error) { return metadata.MD{}, nil }
+func (s *fakeListStream) Trailer() metadata.MD         { return metadata.MD{} }
+func (s *fakeListStream) CloseSend() error             { return nil }
+func (s *fakeListStream) Context() context.Context     { return context.Background() }
+func (s *fakeListStream) SendMsg(any) error            { return nil }
+func (s *fakeListStream) RecvMsg(any) error            { return nil }
+
+// fakeFilerClient serves a fixed directory -> entries map.
+type fakeFilerClient struct {
+	filer_pb.SeaweedFilerClient
+	dirs map[string][]*filer_pb.Entry
+}
+
+func (c *fakeFilerClient) ListEntries(ctx context.Context, in *filer_pb.ListEntriesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[filer_pb.ListEntriesResponse], error) {
+	entries := c.dirs[in.Directory]
+	if in.StartFromFileName != "" {
+		// Already returned everything on the first page; the second call gets nothing.
+		return &fakeListStream{}, nil
+	}
+	return &fakeListStream{entries: entries}, nil
+}
+
+func lockedDirMarker(name string) *filer_pb.Entry {
+	until := strconv.FormatInt(time.Now().Add(24*time.Hour).Unix(), 10)
+	return &filer_pb.Entry{
+		Name:        name,
+		IsDirectory: true,
+		Extended: map[string][]byte{
+			s3_constants.ExtObjectLockModeKey:     []byte(s3_constants.RetentionModeCompliance),
+			s3_constants.ExtRetentionUntilDateKey: []byte(until),
+		},
+	}
+}
+
+func TestHasObjectsWithActiveLocksDirectoryMarker(t *testing.T) {
+	client := &fakeFilerClient{dirs: map[string][]*filer_pb.Entry{
+		"/buckets/lockb": {lockedDirMarker("records")},
+		// The marker's own subtree is empty; only the marker entry carries the lock.
+		"/buckets/lockb/records": {},
+	}}
+
+	has, err := HasObjectsWithActiveLocks(context.Background(), client, "/buckets/lockb")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !has {
+		t.Fatalf("expected the locked directory marker to be reported as an active lock")
+	}
+}
+
+func TestHasObjectsWithActiveLocksUnlockedDirectory(t *testing.T) {
+	client := &fakeFilerClient{dirs: map[string][]*filer_pb.Entry{
+		"/buckets/plainb":        {{Name: "prefix", IsDirectory: true}},
+		"/buckets/plainb/prefix": {{Name: "obj.txt"}},
+	}}
+
+	has, err := HasObjectsWithActiveLocks(context.Background(), client, "/buckets/plainb")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if has {
+		t.Fatalf("expected no active lock for an ordinary prefix and object")
+	}
+}