access: `*` for any one key in a capability's path

A capability's path covered by prefix only, so what is the same at every key of a map
(each node's log filter, say, at `_continuum/local/<id>/log` from the next patch on)
took a capability per key. Now a `*` segment stands for any one key, as it already does
in signed paths and sealed places (`envelope`, `sealed`, which now share one `agree`):

* covering (`Capability::covers`): the pattern no longer than the path, and agreeing
  with it segment by segment;
* listings (`reaches`): pattern and path agreeing on the segments both have, so every
  key on the way shows, nothing past where the pattern differs;
* narrowing (`Capability::holds`, for a token's limit narrowed again and a refresh's):
  at or below, a `*` only under a `*`: a limit naming one key never widens to all.

A `*` first is outside protocol data, so it never covers `_continuum`, as `[]` doesn't.
A key that is `*` itself can't be named alone. Every node judges changes by
capabilities, so all must read them alike: they run the same version.

1 files changed, 3 insertions, 5 deletions

diff --git a/src/api/login.rs b/src/api/login.rs
index e3f8d02..cc70c18 100644
--- a/src/api/login.rs
+++ b/src/api/login.rs
@@ -163,11 +163,9 @@ impl LimitRequest {
 /// `limit` as a token may say it, within `earlier`'s (a refreshed one says no more): each
 /// of its capabilities at or below one of `earlier`'s, with some of its rights.
 fn within(limit: &[Capability], earlier: &[Capability]) -> bool {
-    limit.iter().all(|cap| {
-        earlier
-            .iter()
-            .any(|outer| cap.path.starts_with(&outer.path) && cap.rights.is_subset(&outer.rights))
-    })
+    limit
+        .iter()
+        .all(|cap| earlier.iter().any(|outer| outer.holds(cap)))
 }
 
 /// `claims` (issued now, by this node), signed, as the answer to a login or refresh.