From 75f4511c10fa1f2b75cd3bef13012b935d68e370 Mon Sep 17 00:00:00 2001 From: silverpill Date: Sun, 11 Aug 2024 14:22:49 +0000 Subject: [PATCH] FEP-c7d3: Authorization & same origin (#380) Reviewed-on: https://codeberg.org/fediverse/fep/pulls/380 Co-authored-by: silverpill Co-committed-by: silverpill --- fep/c7d3/fep-c7d3.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/fep/c7d3/fep-c7d3.md b/fep/c7d3/fep-c7d3.md index 6b58c4d..e1aaf5b 100644 --- a/fep/c7d3/fep-c7d3.md +++ b/fep/c7d3/fep-c7d3.md @@ -63,12 +63,16 @@ Collections without an `attributedTo` property are owned by the server. Unattrib ## Authorization -The actor that creates the object MUST be its owner. If activity modifies or deletes the object, its owner MUST match the object's owner. +The actor that creates the object MUST be its owner. + +If activity modifies or deletes an object, its owner SHOULD match the object's owner. If owners are different, their IDs MUST have the same origin. Examples: -- `Create`, `Update` and `Delete` activities, and objects indicated by their `object` property MUST have the same owner. -- `Add` and `Remove` activities, and objects indicated by their `target` property MUST have the same owner. +- `Create`, `Update` and `Delete` activities, and objects indicated by their `object` property SHOULD have the same owner. +- `Undo` activity and object indicated by its `object` property SHOULD have the same owner. +- `Add` and `Remove` activities, and objects indicated by their `target` property SHOULD have the same owner. +- `Announce` and `Like` activities don't modify objects indicated by their `object` property, therefore their owners can be different. ## Implementation notes