From 8fac0cdab8fa5fe7f8598c4538bcd9178876f779 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Mon, 16 Feb 2026 02:57:31 -0800 Subject: [PATCH] test: fix retention tests to expect correct AWS S3 behavior Tests were expecting SeaweedFS old (incorrect) behavior where DeleteObject succeeded under COMPLIANCE retention. Updated to expect correct AWS S3 behavior: simple DELETE (without versionId) is blocked by active COMPLIANCE/legal-hold, returning AccessDenied instead of creating a delete marker. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- test/s3/retention/object_lock_validation_test.go | 8 ++++---- test/s3/retention/s3_retention_test.go | 14 +++++++------- test/s3/retention/s3_worm_integration_test.go | 8 ++++---- 3 files changed, 15 insertions(+), 15 deletions(-) diff --git a/test/s3/retention/object_lock_validation_test.go b/test/s3/retention/object_lock_validation_test.go index 4293486e8..3633e6c24 100644 --- a/test/s3/retention/object_lock_validation_test.go +++ b/test/s3/retention/object_lock_validation_test.go @@ -77,14 +77,14 @@ func TestObjectLockValidation(t *testing.T) { require.NoError(t, err, "Setting Object Lock retention should succeed") t.Log(" Object Lock retention applied successfully") - // Verify retention allows simple DELETE (creates delete marker) but blocks version deletion - // AWS S3 behavior: Simple DELETE (without version ID) is ALWAYS allowed and creates delete marker + // Verify retention blocks simple DELETE (COMPLIANCE mode is strict WORM) + // AWS S3 behavior: Simple DELETE (without version ID) is blocked by COMPLIANCE retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.NoError(t, err, "Simple DELETE should succeed and create delete marker (AWS S3 behavior)") - t.Log(" Simple DELETE succeeded (creates delete marker - correct AWS behavior)") + require.Error(t, err, "Simple DELETE should be blocked by COMPLIANCE retention (AWS S3 behavior)") + t.Log(" Simple DELETE correctly blocked by COMPLIANCE retention") // Now verify that DELETE with version ID is properly blocked by retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ diff --git a/test/s3/retention/s3_retention_test.go b/test/s3/retention/s3_retention_test.go index 4abdf6d87..fc606030e 100644 --- a/test/s3/retention/s3_retention_test.go +++ b/test/s3/retention/s3_retention_test.go @@ -329,12 +329,12 @@ func TestRetentionModeCompliance(t *testing.T) { require.NoError(t, err) assert.Equal(t, types.ObjectLockRetentionModeCompliance, retentionResp.Retention.Mode) - // Try simple DELETE - should succeed and create delete marker (AWS S3 behavior) + // Try simple DELETE - should fail for COMPLIANCE mode (strict WORM) _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.NoError(t, err, "Simple DELETE should succeed and create delete marker") + require.Error(t, err, "Simple DELETE should be blocked by COMPLIANCE retention") // Try DELETE with version ID - should fail for COMPLIANCE mode _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ @@ -388,12 +388,12 @@ func TestLegalHoldWorkflow(t *testing.T) { require.NoError(t, err) assert.Equal(t, types.ObjectLockLegalHoldStatusOn, legalHoldResp.LegalHold.Status) - // Try simple DELETE - should succeed and create delete marker (AWS S3 behavior) + // Try simple DELETE - should fail due to legal hold _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.NoError(t, err, "Simple DELETE should succeed and create delete marker") + require.Error(t, err, "Simple DELETE should be blocked by legal hold") // Try DELETE with version ID - should fail due to legal hold _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ @@ -591,12 +591,12 @@ func TestRetentionAndLegalHoldCombination(t *testing.T) { }) require.NoError(t, err) - // Try simple DELETE - should succeed and create delete marker (AWS S3 behavior) + // Try simple DELETE - should fail due to legal hold + COMPLIANCE retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.NoError(t, err, "Simple DELETE should succeed and create delete marker") + require.Error(t, err, "Simple DELETE should be blocked by legal hold") // Try DELETE with version ID and bypass - should still fail due to legal hold _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ @@ -607,7 +607,7 @@ func TestRetentionAndLegalHoldCombination(t *testing.T) { }) require.Error(t, err, "Legal hold should prevent deletion even with governance bypass") - // Remove legal hold (must specify version ID since latest version is now delete marker) + // Remove legal hold (must specify version ID) _, err = client.PutObjectLegalHold(context.TODO(), &s3.PutObjectLegalHoldInput{ Bucket: aws.String(bucketName), Key: aws.String(key), diff --git a/test/s3/retention/s3_worm_integration_test.go b/test/s3/retention/s3_worm_integration_test.go index 19010092c..6dc0fda22 100644 --- a/test/s3/retention/s3_worm_integration_test.go +++ b/test/s3/retention/s3_worm_integration_test.go @@ -42,12 +42,12 @@ func TestWORMRetentionIntegration(t *testing.T) { }) require.NoError(t, err) - // Try simple DELETE - should succeed and create delete marker (AWS S3 behavior) + // Try simple DELETE - should fail due to GOVERNANCE retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.NoError(t, err, "Simple DELETE should succeed and create delete marker") + require.Error(t, err, "Simple DELETE should be blocked by GOVERNANCE retention") // Try DELETE with version ID - should fail due to GOVERNANCE retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ @@ -325,12 +325,12 @@ func TestRetentionWithMultipartUpload(t *testing.T) { }) require.NoError(t, err) - // Try simple DELETE - should succeed and create delete marker (AWS S3 behavior) + // Try simple DELETE - should fail due to GOVERNANCE retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.NoError(t, err, "Simple DELETE should succeed and create delete marker") + require.Error(t, err, "Simple DELETE should be blocked by GOVERNANCE retention") // Try DELETE with version ID - should fail due to GOVERNANCE retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{