access: a token with a limit changes no credentials

A token's limit narrows every endpoint but those under /auth, which any
registered user may call. Among them, PUT and DELETE /auth/keys/{id}
change the keys the user logs in with, and POST /auth/logout ends every
token of the user. With the token a dashboard hands to another member's
(the member list, read, five minutes), its holder could add a key of its
own and log in by it as the user, with everything the user may do.

These now take a password or a token without a limit
(Need::Credentials, refused where Caps::limited). A narrowed token still
refreshes within its limit, says who it is, lists the user's keys and
ends its own session (DELETE /auth/session): a dashboard opened from
another member's logs out with it.

1 files changed, 5 insertions, 0 deletions

diff --git a/src/access/mod.rs b/src/access/mod.rs
index e04be02..ad50c72 100644
--- a/src/access/mod.rs
+++ b/src/access/mod.rs
@@ -192,6 +192,11 @@ impl Caps {
                 .is_none_or(|limit| limit.iter().any(|cap| cap.reaches(right, path)))
     }
 
+    /// Whether a token's limit narrows them (`within`).
+    pub(crate) fn limited(&self) -> bool {
+        self.limit.is_some()
+    }
+
     pub(crate) fn is_empty(&self) -> bool {
         self.caps.is_empty() || self.limit.as_ref().is_some_and(Vec::is_empty)
     }