Fix allowedAction comparison and root enforcement

[jameseaster]

Compares allowedAction sets rather than JSON types so a delegation that narrows nothing succeeds whether each side spells its actions as a string or an array, and seeds parentAllowedAction from the root zcap so a root's allowedAction is enforced by the verifier and not only when a delegation proof is generated.

Fixes #89

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.10%. Comparing base (80cbe01) to head (105adc4).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #90      +/-   ##
==========================================
+ Coverage   90.66%   91.10%   +0.44%     
==========================================
  Files           6        6              
  Lines        1897     1901       +4     
==========================================
+ Hits         1720     1732      +12     
+ Misses        177      169       -8     

Files with missing lines	Coverage Δ
lib/CapabilityInvocation.js	85.67% <100.00%> (ø)
lib/CapabilityProofPurpose.js	98.49% <100.00%> (ø)
lib/utils.js	87.11% <100.00%> (+1.26%)	⬆️

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 80cbe01...105adc4. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dlongley]

I think this should be a patch. A delegated zcap that was invalid that this library didn't catch (even if properly signed by the delegator) is still invalid and this patch will now properly reject it. Those zcaps shouldn't have been accepted to begin with, so this is a fix.

[jameseaster]

Updated changelog here: 98fdac6

[dlongley]

Can we add a test that covers an explicitly provided, but empty array for allowedAction? Added tests here should at least include negative tests where the child uses an empty array but the parent used a string or a non-empty array. It seems like an empty array in the child could pass here when it shouldn't.

[jameseaster]

Agreed, that the helper itself would return true there, but an empty array can't reach it: checkCapability rejects any allowedAction that isn't a string or non-empty array (utils.js#L578) and runs first on both paths - before hasValidAllowedAction in CapabilityDelegation.update (L145 vs L160), and on every zcap in the dereferenced chain (utils.js#L339, #L412) before _verifyCapabilityChain ever compares actions - which the three tests in 105adc4 now pin down at both layers.