Fix author checks on post attachments

Fixes #538

activities/migrations/0013_postattachment_author.py

@@ -0,0 +1,26 @@
+# Generated by Django 4.1.4 on 2023-03-12 22:14
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("users", "0015_bookmark"),
+        ("activities", "0012_in_reply_to_index"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="postattachment",
+            name="author",
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="attachments",
+                to="users.identity",
+            ),
+        ),
+    ]

activities/models/post_attachment.py

@@ -31,6 +31,13 @@ class PostAttachment(StatorModel):
         blank=True,
         null=True,
     )
+    author = models.ForeignKey(
+        "users.Identity",
+        on_delete=models.CASCADE,
+        related_name="attachments",
+        blank=True,
+        null=True,
+    )
 
     state = StateField(graph=PostAttachmentStates)
 

activities/views/compose.py

@@ -267,6 +267,7 @@ class ImageUpload(FormView):
             height=main_file.image.height,
             name=form.cleaned_data.get("description"),
             state=PostAttachmentStates.fetched,
+            author=self.request.identity,
         )
 
         attachment.file.save(

api/views/media.py

@@ -34,6 +34,7 @@ def upload_media(
         height=main_file.image.height,
         name=description or None,
         state=PostAttachmentStates.fetched,
+        author=request.identity,
     )
     attachment.file.save(
         main_file.name,
@@ -54,8 +55,11 @@ def get_media(
     id: str,
 ) -> schemas.MediaAttachment:
     attachment = get_object_or_404(PostAttachment, pk=id)
+    if attachment.post:
         if attachment.post.author != request.identity:
             raise ApiError(401, "Not the author of this attachment")
+    elif attachment.author and attachment.author != request.identity:
+        raise ApiError(401, "Not the author of this attachment")
     return schemas.MediaAttachment.from_post_attachment(attachment)