Fix --all-projects for restricted users

[presztak]

Allows to use --all-projects for restricted users.

Fixes: #591

[stgraber]

@presztak hmm, so that will definitely make --all-projects work but I don't see how this is then restricting the list of projects to those the user has access to, am I missing something?

Based on what I'm reading, I'd expect this PR to let me pass ?all-projects=true and see entries from any project even those that I'm not normally allowed to see.

[presztak]

@stgraber e.g. for instances we have this check:

incus/cmd/incusd/instances_get.go

Lines 313 to 315 in 0d5f33f

	if !userHasPermission(auth.ObjectInstance(inst.Project, inst.Name)) {
	continue
	}

which actually perform this part of code:

incus/internal/server/auth/driver_tls.go

Line 150 in 0d5f33f

return slices.Contains(projectNames, object.Project())

so entries for projects to which user doesn't have access will be not displayed.

[stgraber]

Ah, good, so we need to make sure that the same is true everywhere else all-projects is allowed.

That appears to include:

• instances
• images
• operations
• events
• network allocations
• storage volumes

[presztak]

@stgraber yup,

• images:
  

  incus/cmd/incusd/images.go

  Lines 1383 to 1385 in 0d5f33f

  	if !image.Public && !hasPermission(auth.ObjectImage(curProjectName, fingerprint)) {
  	continue
  	}

  
  

  incus/cmd/incusd/images.go

  Lines 3452 to 3454 in 0d5f33f

  	if !userHasPermission(auth.ObjectImageAlias(projectName, name)) {
  	continue
  	}

• operations
  

  incus/cmd/incusd/operations.go

  Lines 519 to 521 in 0d5f33f

  	if !userHasPermission(auth.ObjectProject(v.Project())) {
  	continue
  	}

• events
  

  incus/internal/server/events/events.go

  Lines 191 to 193 in 0d5f33f

  	if event.Project != "" && !listener.projectPermissionFunc(auth.ObjectProject(event.Project)) {
  	continue
  	}

• networks
  

  incus/cmd/incusd/networks.go

  Lines 221 to 223 in 0d5f33f

  	if !userHasPermission(auth.ObjectNetwork(projectName, networkName)) {
  	continue
  	}

• network allocations
  

  incus/cmd/incusd/network_allocations.go

  Lines 144 to 146 in 0d5f33f

  	if !userHasPermission(auth.ObjectNetwork(projectName, networkName)) {
  	continue
  	}

• network zones
  

  incus/cmd/incusd/network_zones.go

  Lines 166 to 168 in 0d5f33f

  	if !userHasPermission(auth.ObjectNetworkZone(projectName, zoneName)) {
  	continue
  	}

• network acls
  

  incus/cmd/incusd/network_acls.go

  Lines 177 to 179 in 0d5f33f

  	if !userHasPermission(auth.ObjectNetworkACL(projectName, aclName)) {
  	continue
  	}

• storage volumes
  

  incus/cmd/incusd/storage_volumes.go

  Lines 470 to 472 in 0d5f33f

  	if !userHasPermission(auth.ObjectStorageVolume(vol.Project, poolName, dbVol.Type, volumeName, location)) {
  	continue
  	}

but actually we don't need to modify CheckPermission method. Changes in GetPermissionChecker are enough.

[stgraber]

Thanks!