authorization: allow actor to update/delete itself

for #566

models.py

@@ -760,12 +760,12 @@ class Object(StringIdModel):
             obj.new = False
             orig_as1 = obj.as1
             if orig_as1:
-                authors_actors = (as1.get_ids(orig_as1, 'author') +
-                                  as1.get_ids(orig_as1, 'actor'))
+                authorized = (as1.get_ids(orig_as1, 'author') +
+                              as1.get_ids(orig_as1, 'actor'))
                 if not actor:
                     logger.warning(f'Cowardly refusing to overwrite {id} without checking actor')
-                elif actor not in authors_actors:
-                    logger.warning(f"actor {actor} isn't {id}'s author or actor {authors_actors}")
+                elif actor not in authorized + [id]:
+                    logger.warning(f"actor {actor} isn't {id}'s author or actor {authorized}")
         else:
             obj = Object(id=id)
             obj.new = True

tests/test_models.py

@@ -326,6 +326,31 @@ class ObjectTest(TestCase):
         self.assert_object('biff', as2={'a': 'b'}, mf2={'c': 'd'},
                            users=[ndb.Key(Web, 'me')])
 
+    def test_get_or_create_actor_check(self):
+        Object(id='foo', our_as1={'author': 'alice'}).put()
+        Object.get_or_create('foo', actor='alice', our_as1={
+            'author': 'alice',
+            'bar': 'baz',
+        })
+        self.assertEqual({
+            'id': 'foo',
+            'bar': 'baz',
+            'author': 'alice',
+        }, Object.get_by_id('foo').as1)
+
+        with self.assertLogs() as logs:
+            Object.get_or_create('foo', actor='eve', our_as1={'bar': 'biff'})
+
+        self.assertIn("WARNING:models:actor eve isn't foo's author or actor ['alice']",
+                      logs.output)
+
+        # actor is object id (eg user profile)
+        with self.assertLogs() as logs:
+            Object.get_or_create('foo', actor='foo', our_as1={})
+
+        self.assertNotIn("WARNING:models:actor foo isn't foo's author or actor []",
+                         logs.output)
+
     def test_activity_changed(self):
         obj = Object()
         self.assertFalse(obj.activity_changed(None))