fix: enforce object lock on browser-based POST object uploads

`POSTObject` wrote directly to the backend without the `CheckObjectAccess` object lock check that `PutObject`, `CopyObject` and `CompleteMultipartUpload` perform. In a versioning-disabled bucket, a browser-based `POST` could therefore silently overwrite an object protected by a legal hold, a `COMPLIANCE` retention or a `GOVERNANCE` retention. S3 has no such gap: it allows object lock only on versioned buckets, where an overwrite creates a new version.

`POSTObject` now calls `auth.CheckObjectAccess` with `BypassOverwrite` just before writing to the backend, matching `PutObject`. A legal hold or `COMPLIANCE` retention always blocks the overwrite. A `GOVERNANCE` retention blocks it unless the caller, root included, has an explicit `s3:BypassGovernanceRetention` grant. Versioning-enabled buckets skip the check because the upload creates a new version.

s3api/controllers/bucket-post.go

@@ -220,6 +220,15 @@ func (c S3ApiController) POSTObject(ctx fiber.Ctx) (*Response, error) {
 		}, err
 	}
 
+	err = auth.CheckObjectAccess(ctx, bucket, acct, []types.ObjectIdentifier{{Key: &key}}, auth.BypassOverwrite, IsBucketPublic, c.be, c.iam, true)
+	if err != nil {
+		return &Response{
+			MetaOpts: &MetaOptions{
+				BucketOwner: parsedAcl.Owner,
+			},
+		}, err
+	}
+
 	res, err := c.be.PutObject(ctx.RequestCtx(), s3response.PutObjectInput{
 		Bucket:                  &bucket,
 		Key:                     &key,

s3api/controllers/bucket-post_test.go

@@ -484,6 +484,27 @@ func TestS3ApiController_POSTObject(t *testing.T) {
 				err: s3err.GetMetadataTooLargeErr(2053, 2048),
 			},
 		},
+		{
+			name: "overwriting a locked object",
+			input: testInput{
+				// object lock enabled on the bucket; the mock reports a
+				// legal hold on every object
+				extraMockResp: []byte(`{"Enabled":true}`),
+				locals: postObjectLocalsForTest(middlewares.PostObjectResult{
+					Fields:        baseFields,
+					FileRdr:       newMockFileReader("payload"),
+					ContentLength: int64(len("payload")),
+				}),
+			},
+			output: testOutput{
+				response: &Response{
+					MetaOpts: &MetaOptions{
+						BucketOwner: "root",
+					},
+				},
+				err: s3err.GetAPIError(s3err.ErrObjectLocked),
+			},
+		},
 		{
 			name: "backend returns error",
 			input: testInput{
@@ -734,6 +755,22 @@ func TestS3ApiController_POSTObject(t *testing.T) {
 				GetBucketPolicyFunc: func(contextMoqParam context.Context, bucket string) ([]byte, error) {
 					return nil, s3err.GetAPIError(s3err.ErrAccessDenied)
 				},
+				GetBucketVersioningFunc: func(contextMoqParam context.Context, bucket string) (s3response.GetBucketVersioningOutput, error) {
+					return s3response.GetBucketVersioningOutput{}, s3err.GetAPIError(s3err.ErrNotImplemented)
+				},
+				GetObjectLockConfigurationFunc: func(contextMoqParam context.Context, bucket string) ([]byte, error) {
+					if tt.input.extraMockResp != nil {
+						return tt.input.extraMockResp.([]byte), nil
+					}
+					return nil, s3err.GetAPIError(s3err.ErrObjectLockConfigurationNotFound)
+				},
+				GetObjectRetentionFunc: func(contextMoqParam context.Context, bucket, object, versionId string) ([]byte, error) {
+					return nil, s3err.GetAPIError(s3err.ErrNoSuchObjectLockConfiguration)
+				},
+				GetObjectLegalHoldFunc: func(contextMoqParam context.Context, bucket, object, versionId string) (*bool, error) {
+					legalHold := true
+					return &legalHold, nil
+				},
 			}
 
 			ctrl := S3ApiController{