[Xe]

Summary

• Add Go helpers covering the full Tigris soft-delete lifecycle to the storage and tigrisheaders packages (TIG-8441).
• Complements the existing tigrisheaders.WithSoftDelete bucket-create option with listing, restore, force/permanent delete, and existing-bucket enable/disable.

Details

storage.Client gains:

Method	Action
CreateBucketWithSoftDelete	Create a bucket with soft delete (0 = default 7-day window)
ListSoftDeletedObjects	List soft-deleted versions, surfacing Size, ETag, SoftDeleted, VersionID, LastModified (with pagination)
RestoreSoftDeletedObject	Restore the latest or a specific soft-deleted version
RestoreBucket	Restore a soft-deleted bucket
ForceDeleteBucket	Force/soft-delete a bucket (soft vs permanent governed by bucket config)
PermanentlyDeleteObject	Purge a specific soft-deleted version
SetBucketSoftDelete	Enable/disable soft delete on an existing bucket

tigrisheaders gains WithForceDelete() (X-Tigris-Force-Delete: true).

Operations the S3 SDK cannot express (restore object/bucket, the enriched
versions listing, and the PATCH bucket config) go through a shared
SigV4-signed raw-HTTP path extracted from bundle.go into a new rawhttp.go
(doSignedRequest); BundleObjects now reuses it instead of duplicating the
signing logic. Method names (RestoreSoftDeletedObject, ForceDeleteBucket,
PermanentlyDeleteObject) are chosen to avoid shadowing the embedded
*s3.Client methods. Object keys are escaped via net/url so the signed
canonical URI matches the request that is sent.

Test plan

• Code compiles with go build ./...
• Code formatted with npm run format
• go test ./... passes (httptest request-construction tests assert method/path/query/headers/SigV4; XML-decode and validation tests; credential-gated TestSoftDeleteLifecycle_integration skips without creds)
• go vet ./... clean
• Manual testing against a live Tigris endpoint

Refs: TIG-8441

---

Note

Medium Risk
Introduces destructive delete/restore APIs and changes signing/error behavior for bundle and raw-HTTP extensions; mistakes could cause data loss or auth failures on special object keys, though behavior is heavily tested.

Overview
Adds soft-delete support to storage.Client: create buckets with retention, list/restore soft-deleted objects and buckets, enable/disable on existing buckets, force-delete buckets, and permanently purge soft-deleted versions. S3-backed calls use tigrisheaders (WithSoftDelete, new WithForceDelete); list/restore/PATCH flows use SigV4 raw HTTP because the S3 SDK cannot express those endpoints.

rawhttp.go centralizes signing (doSignedRequest, DisableURIPathEscaping for object keys), APIError (smithy.APIError), and shared endpoint helpers. BundleObjects now uses this path instead of duplicated signing logic and returns typed HTTP errors.

README and examples document the lifecycle and error handling. Large httptest coverage plus optional live integration test.

^{Reviewed by Cursor Bugbot for commit 5faa633. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Adds Go helpers for Tigris's soft-delete lifecycle on top of the existing S3-compatible Client, plus a new tigrisheaders.WithForceDelete option. SDK-expressible operations go through tigrisheaders header injection on standard S3 calls, while Tigris-only operations (versions listing with enriched fields, restore object/bucket, PATCH bucket config) use a new shared SigV4-signed raw-HTTP path in rawhttp.go that BundleObjects is refactored to reuse.

Changes:

• New softdelete.go adds CreateBucketWithSoftDelete, ListSoftDeletedObjects, RestoreSoftDeletedObject, RestoreBucket, ForceDeleteBucket, PermanentlyDeleteObject, SetBucketSoftDelete on storage.Client.
• New rawhttp.go extracts the shared SigV4 signing/transport helper (doSignedRequest, tigrisHTTPClient, baseEndpoint) used by both bundle and soft-delete code paths; bundle.go is refactored to use it.
• tigrisheaders gains WithSoftDelete([days]) and WithForceDelete(), plus tests and examples; example_test.go adds runnable examples for each new Client method.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
softdelete.go	New file implementing the soft-delete lifecycle API on Client, plus URL/path helpers and httpError wrapping.
softdelete_test.go	Request-construction httptest coverage for each new method plus a credential-gated live lifecycle integration test.
rawhttp.go	Shared SigV4-signed HTTP transport (doSignedRequest), reusable HTTP client, and baseEndpoint helper.
bundle.go	Refactored to delegate signing/transport to doSignedRequest; removes duplicated SigV4 plumbing and local sha256Hex/HTTP client.
tigrisheaders/tigrisheaders.go	Adds WithSoftDelete(days...) and WithForceDelete() header options.
tigrisheaders/tigrisheaders_test.go	Validates new header functions and adds varied-input tests for WithSoftDelete.
tigrisheaders/example_test.go	Documents the new header options with runnable examples.
example_test.go	Adds ExampleClient_* entries for each new soft-delete lifecycle method.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[greptile-apps]

Greptile Summary

This PR adds a full soft-delete lifecycle to the storage and tigrisheaders packages, covering bucket/object creation with soft delete, listing, restore, force delete, and permanent purge. A shared doSignedRequest helper in the new rawhttp.go replaces the duplicated SigV4 signing logic that was inline in bundle.go.

• New softdelete.go: Seven Client methods (CreateBucketWithSoftDelete, ForceDeleteBucket, PermanentlyDeleteObject, ListSoftDeletedObjects, RestoreSoftDeletedObject, RestoreBucket, SetBucketSoftDelete) using a raw HTTP path for operations the S3 SDK cannot express; key escaping is handled correctly via url.Parse.
• New rawhttp.go: doSignedRequest centralises SigV4 signing and the shared http.Client, with baseEndpoint() extracting the endpoint-resolution logic reused by BundleObjects.
• tigrisheaders: Two new option functions (WithSoftDelete, WithForceDelete) with accompanying examples and tests.

Confidence Score: 3/5

Safe to merge after addressing the missing validation in PermanentlyDeleteObject; the rest of the change is well-tested and structurally sound.

PermanentlyDeleteObject is the one function in this PR designed specifically to purge a known version — a versionID is semantically required — yet it ships without any guard on bucket, key, or versionID. An empty versionID causes the AWS SDK to send ?versionId= (empty string) to the server, whose behavior is undefined and could silently affect an unintended object. All other new methods validate their required fields; the omission here stands out and carries real data-loss risk on the changed code path.

softdelete.go — specifically PermanentlyDeleteObject, which is the only new method without input validation.

Important Files Changed

Filename	Overview
softdelete.go	New file implementing the full soft-delete lifecycle API; well-structured overall but PermanentlyDeleteObject lacks input validation (bucket, key, versionID), unlike every other method added here.
rawhttp.go	New shared SigV4 signing helper extracted cleanly from bundle.go; handles nil body, empty credentials, and region defaulting correctly.
bundle.go	Refactored to delegate signing and HTTP transport to the new doSignedRequest helper; logic is equivalent to what was removed.
tigrisheaders/tigrisheaders.go	Adds WithSoftDelete (variadic days) and WithForceDelete header helpers; implementation is correct and consistent with existing patterns.
softdelete_test.go	Comprehensive httptest-based tests covering request construction, XML parsing, pagination, error handling, and an integration test gated behind credentials.
example_test.go	New Example* functions for all seven new Client methods; clear and accurate.
tigrisheaders/tigrisheaders_test.go	Adds targeted tests for WithSoftDelete (default and custom windows) and WithForceDelete; consistent with existing test style.
tigrisheaders/example_test.go	New ExampleWithSoftDelete and ExampleWithForceDelete functions; straightforward and accurate.

_{Reviews (1): Last reviewed commit: "feat(storage): add soft-delete lifecycle..." | Re-trigger Greptile}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 540dd7e. Configure here.}