From 9343860321ea1568884e10695f2bcaeda55274ee Mon Sep 17 00:00:00 2001
From: Ben McClelland <ben.mcclelland@versity.com>
Date: Mon, 9 Feb 2026 12:27:02 -0800
Subject: [PATCH] fix: webui md5 missing error when enabling directory object
 lock

The PutBucketObjectLockConfiguration now requires Content-MD5
header to match AWS behavior. This broke the GUI from being able
to set object lock configuration for a bucket.

This fix adds the Content-MD5 header to this request.
---
 webui/web/js/api.js | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/webui/web/js/api.js b/webui/web/js/api.js
index d10d75e6..3e12e30a 100644
--- a/webui/web/js/api.js
+++ b/webui/web/js/api.js
@@ -457,6 +457,23 @@ class VersityAPI {
     }
   }
 
+  /**
+   * MD5 hash returning base64 (for Content-MD5 header)
+   */
+  md5Base64(message) {
+    // MD5 is not available in Web Crypto API (not secure), so use CryptoJS
+    const hash = CryptoJS.MD5(message);
+    const bytes = [];
+    for (let i = 0; i < hash.sigBytes; i++) {
+      bytes.push((hash.words[i >>> 2] >>> (24 - (i % 4) * 8)) & 0xff);
+    }
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++) {
+      binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+  }
+
   /**
    * HMAC-SHA256 (uses crypto.subtle in HTTPS, CryptoJS in HTTP)
    */
@@ -1616,7 +1633,12 @@ class VersityAPI {
   <ObjectLockEnabled>Enabled</ObjectLockEnabled>${ruleXml}
 </ObjectLockConfiguration>`;
     
-    await this.request('PUT', `/${bucket}`, { 'object-lock': '' }, body);
+    // Calculate Content-MD5 header
+    const contentMd5 = this.md5Base64(body);
+
+    await this.request('PUT', `/${bucket}`, { 'object-lock': '' }, body, false, 'application/xml', {
+      'Content-MD5': contentMd5
+    });
   }
 
   /**