only allow photos from the same author to be nested in status message

lib/diaspora_federation/entities/status_message.rb

@@ -30,6 +30,15 @@ module DiasporaFederation
       #   shows whether the status message is visible to everyone or only to some aspects
       #   @return [Boolean] is it public
       property :public, default: false
+
+      private
+
+      def validate
+        super
+        photos.each do |photo|
+          raise ValidationError, "nested photo has different author" if photo.author != author
+        end
+      end
     end
   end
 end

spec/lib/diaspora_federation/entities/status_message_spec.rb

@@ -1,10 +1,11 @@
 module DiasporaFederation
   describe Entities::StatusMessage do
-    let(:photo1) { FactoryGirl.build(:photo_entity) }
+    let(:photo1) { FactoryGirl.build(:photo_entity, author: alice.diaspora_id) }
-    let(:photo2) { FactoryGirl.build(:photo_entity) }
+    let(:photo2) { FactoryGirl.build(:photo_entity, author: alice.diaspora_id) }
     let(:location) { FactoryGirl.build(:location_entity) }
     let(:data) {
-      FactoryGirl.attributes_for(:status_message_entity).merge!(
+      FactoryGirl.attributes_for(:status_message_entity).merge(
+        author:                alice.diaspora_id,
         photos:                [photo1, photo2],
         location:              location,
         poll:                  nil,
@@ -80,5 +81,14 @@ module DiasporaFederation
         expect(parsed_instance.provider_display_name).to be_nil
       end
     end
+
+    context "nested entities" do
+      it "validates that nested photos have the same author" do
+        invalid_data = data.merge(author: FactoryGirl.generate(:diaspora_id))
+        expect {
+          Entities::StatusMessage.new(invalid_data)
+        }.to raise_error Entity::ValidationError, "nested photo has different author"
+      end
+    end
   end
 end