Examine IRI when origin checking Update/Delete

Before we just always threw an error. Also update tests to check for
both cases.

pub/fed_test.go

@@ -2108,6 +2108,26 @@ func TestPostInbox_OriginMustMatch(t *testing.T) {
 				return a
 			},
 		},
+		{
+			name: "delete",
+			input: func() vocab.ActivityType {
+				a := &vocab.Delete{}
+				a.SetId(otherOriginIRI)
+				a.AppendActorIRI(otherOriginActorIRI)
+				a.AppendObject(testCreateNote)
+				return a
+			},
+		},
+		{
+			name: "update",
+			input: func() vocab.ActivityType {
+				a := &vocab.Update{}
+				a.SetId(otherOriginIRI)
+				a.AppendActorIRI(otherOriginActorIRI)
+				a.AppendObjectIRI(noteIRI)
+				return a
+			},
+		},
 		{
 			name: "delete",
 			input: func() vocab.ActivityType {

pub/internal.go

@@ -1968,9 +1968,10 @@ func (f *federator) ensureActivityOriginMatchesObjects(a vocab.ActivityType) err
 				return fmt.Errorf("object %q: not in activity origin", iri)
 			}
 		} else if a.IsObjectIRI(i) {
-			// TODO: Dereference IRI
 			iri := a.GetObjectIRI(i)
-			return fmt.Errorf("unimplemented: fetching IRI for origin check: %q", iri)
+			if originHost != iri.Host {
+				return fmt.Errorf("object %q: not in activity origin", iri)
+			}
 		}
 	}
 	return nil