Merge branch 'w/8.1/bugfix/S3C-4245_compliance_mode_fixes' into tmp/octopus/w/8.2/bugfix/S3C-4245_compliance_mode_fixes

lib/api/apiUtils/object/objectLockHelpers.js

@@ -144,15 +144,19 @@ function isObjectLocked(bucket, objectMD, headers) {
     return false;
 }
 
-function validateObjectLockUpdate(objectMD, retentionInfo) {
+function validateObjectLockUpdate(objectMD, retentionInfo, bypassGovernance) {
     const { retentionMode: existingMode, retentionDate: existingDateISO } = objectMD;
-    if (!existingMode || existingMode === 'GOVERNANCE') {
+    if (!existingMode) {
         return null;
     }
 
     const existingDate = new Date(existingDateISO);
     const isExpired = existingDate < Date.now();
 
+    if (existingMode === 'GOVERNANCE' && !isExpired && !bypassGovernance) {
+        return errors.AccessDenied;
+    }
+
     if (retentionInfo.mode === 'GOVERNANCE' && !isExpired) {
         return errors.AccessDenied;
     }

lib/api/objectPutRetention.js

@@ -80,7 +80,8 @@ function objectPutRetention(authInfo, request, log, callback) {
                 (err, retentionInfo) => next(err, bucket, retentionInfo, objectMD));
         },
         (bucket, retentionInfo, objectMD, next) => {
-            const validationError = validateObjectLockUpdate(objectMD, retentionInfo);
+            const bypassGovernance = request.headers['x-amz-bypass-governance-retention'] === 'true';
+            const validationError = validateObjectLockUpdate(objectMD, retentionInfo, bypassGovernance);
             if (validationError) {
                 return next(validationError, bucket, objectMD);
             }