Clarify statement about object vs activity IDs in C2S creation context

[mariusor]

Section 6. Client to Server Interactions, mentions that:

If an Activity is submitted with a value in the id property, servers MUST ignore this and generate a new id for the Activity.

I think there should be a clarification that this does not include the objects of Create activities received in an outbox. Hence Objects with IDs are permitted and the server decides if the incoming ID is valid according to its specific rules, or if it gets overwritten, or even directly rejected.

[evanp]

Yeah, it seems like there are a number of properties that could have embedded objects as values, each of which could have an id value. For example, inReplyTo, instrument, to, and so on.

[evanp]

An example of a Create activity with an external object ID might be an ActivityPub API client with a server component. For example, this JSON submitted to the server would represent a drawing made on an external application:

{
   "@context": "https://www.w3.org/ns/activitystreams",
   "type": "Create",
   "to": "https://social.example/user/evanp/followers",
   "object": {
       "id": "https://drawing.example/image/29445",
       "type": "Image",
       "name": "My Drawing",
       "url": {
            "type": "Link",
            "href": "https://files.drawing.example/drawing/29445.svg",
            "mediaType": "image/svg+xml",
       },
       "to": "https://social.example/user/evanp/followers"
   }
}

[evanp]

I think the main reference is in section 3.1:

However, for client to server communication, a server receiving an object posted to the outbox with no specified id SHOULD allocate an object ID in the actor's namespace and attach it to the posted object.

There's also a bit in the section on implicit Create:

For non-transient objects, the server MUST attach an id to both the wrapping Create and its wrapped Object.

Honestly, I think an explicit addition to section 6.2 would be useful.

[trwnh]

Possible duplicate / overlap with #438