fix(security): boundary-aware Capability.resourceCovers + fail-closed empty with (#585)

[mikera]

Fixes #585.

Vulnerability

Capability.resourceCovers matched a granted resource against a requested one with a raw startsWith and no path-segment boundary, so a grant on w/notes also covered siblings like w/notesSECRET / w/report-confidential — a UCAN attenuation / delegation escape (cross-tenant over-read/over-write where delegation is used). Separately, a null/empty with was treated as "covers every resource" (fail-open), turning a malformed or truncated capability into a superuser grant.

This is the companion to #586 (the JWT issuer-spoofing fix): #586 made the token layer sound; this makes the authorization-decision layer underneath it sound.

Fix

• resourceCovers now requires a path-segment boundary on the prefix branch (mirroring the already-correct abilityCovers): the prefix matches only when the grant ends with / or the next char in the request is /. Exact-match and trailing-slash-parent are preserved; genuine children (w/notes/x) still match.
• Both resourceCovers and covers now fail closed on null/empty grant or request with. An absent resource pointer is never a wildcard.

grant	request	before	after
w/notes	w/notes/child	true	✅ true
w/notes	w/notesSECRET	true	✅ false
"" / null	w/anything	true	✅ false

Tests

CapabilityTest gains adversarial sibling-escape and empty/null-with superuser cases, plus genuine-child/exact regressions. The five existing tests that asserted the fail-open behaviour are flipped to expect fail-closed. Confirmed all seven adversarial assertions fail against the pre-fix code.

convex-core: 2135 pass.

🤖 Generated with Claude Code