return
			}
		case "Created":
			z.Created, err = dc.ReadTime()
			if err != nil {
				err = msgp.WrapError(err, "Created")
				return
			}
		case "LockEnabled":
			z.LockEnabled, err = dc.ReadBool()
			if err != nil {
				err = msgp.WrapError(err, "LockEnabled")
				return
			}
		case "PolicyConfigJSON":
			z.PolicyConfigJSON, err = dc.ReadBytes(z.PolicyConfigJSON)
			if err != nil {

		bucketTargetsFile,
		objectLockConfig,
	}

	configs := make(map[string][]byte, len(legacyConfigs))

	// Handle migration from lockEnabled to newer format.
	if b.LockEnabled {
		configs[objectLockConfig] = enabledBucketObjectLockConfig
		b.LockEnabled = false // legacy value unset it
		// we are only interested in b.ObjectLockConfigXML or objectLockConfig value
	}

	for _, legacyFile := range legacyConfigs {

		field, bts, err = msgp.ReadMapKeyZC(bts)
		if err != nil {
			err = msgp.WrapError(err)
			return
		}
		switch msgp.UnsafeString(field) {
		case "LockEnabled":
			z.LockEnabled, bts, err = msgp.ReadBoolBytes(bts)
			if err != nil {
				err = msgp.WrapError(err, "LockEnabled")
				return
			}
		case "VersioningEnabled":
			z.VersioningEnabled, bts, err = msgp.ReadBoolBytes(bts)
			if err != nil {

	retentionCfg, err := globalBucketObjectLockSys.Get(bucket)
	if err != nil {
		return mode, retainDate, legalHold, ErrInvalidBucketObjectLockConfiguration
	}

	if !retentionCfg.LockEnabled {
		if legalHoldRequested || retentionRequested {
			return mode, retainDate, legalHold, ErrInvalidBucketObjectLockConfiguration
		}

		// If this not a WORM enabled bucket, we should return right here.

		ilm       lifecycle.Lifecycle
		retention lock.Retention
		obj       ObjectInfo
		want      lifecycle.Action
	}{
		{
			// with object locking
			ilm:       *deleteAllLc,
			retention: lock.Retention{LockEnabled: true},
			obj:       obj,
			want:      lifecycle.NoneAction,
		},
		{
			// without object locking
			ilm:       *deleteAllLc,
			retention: lock.Retention{},
			obj:       obj,

			HTTPStatusCode: http.StatusBadRequest,
		}, r.URL)
		return
	}

	if rcfg, _ := globalBucketObjectLockSys.Get(bucket); rcfg.LockEnabled && (v.Suspended() || v.PrefixesExcluded()) {
		writeErrorResponse(ctx, w, APIError{
			Code:           "InvalidBucketState",

		return
	}

	lockEnabled := false
	lcfg, _, err := globalBucketMetadataSys.GetObjectLockConfig(bucket)
	if err != nil {
		if !errors.Is(err, BucketObjectLockConfigNotFound{Bucket: bucket}) {
			writeErrorResponse(ctx, w, errorCodes.ToAPIErrWithErr(ErrReplicationValidationError, err), r.URL)
			return
		}
	}
	if lcfg != nil {
		lockEnabled = lcfg.Enabled()
	}

		return time.Now().UTC(), nil
	}
	return ntp.Time(ntpServer)
}

// Retention - bucket level retention configuration.
type Retention struct {
	Mode        RetMode
	Validity    time.Duration
	LockEnabled bool
}

// Retain - check whether given date is retainable by validity time.
func (r Retention) Retain(created time.Time) bool {
	t, err := UTCNowNTP()
	if err != nil {
		lockLogIf(context.Background(), err)

		createdAt, cerr := time.Parse(time.RFC3339Nano, strings.TrimSpace(r.Form.Get("createdAt")))
		if cerr != nil {
			createdAt = timeSentinel
		}

		opts := MakeBucketOptions{
			LockEnabled:       r.Form.Get("lockEnabled") == "true",
			VersioningEnabled: r.Form.Get("versioningEnabled") == "true",
			ForceCreate:       r.Form.Get("forceCreate") == "true",
			CreatedAt:         createdAt,
		}

		return errLifecycleNoRule
	}

	// Validate all the rules in the lifecycle config
	for _, r := range lc.Rules {
		if err := r.Validate(); err != nil {
			return err
		}
		if lr.LockEnabled && (r.Expiration.DeleteAll.val || !r.DelMarkerExpiration.Empty()) {
			return errLifecycleBucketLocked
		}
	}
	// Make sure Rule ID is unique
	for i := range lc.Rules {
		if i == len(lc.Rules)-1 {
			break