Effective project handling

[markylaing]

Rewires effective project handling so that calls to the authorizer use the effective project rather than the requested project.

This is achieved by moving effective project handling to the TLS authorizer.

The motivation for this change is a) confusion around creating resources and then not being able to view them (see linked issue), b) we'll be always using the effective project any way once we've moved to using entity IDs instead of URLs, and c) the custom handling in the TLS authorizer will disappear once we've removed restricted TLS clients.

Closes #17257
Depends on #18440

Checklist

• I have read the contributing guidelines and attest that all commits in this PR are signed off, cryptographically signed, and follow this project's commit structure.
• I have checked and added or updated relevant documentation.

[Copilot]

Pull request overview

This PR rewires project-aware authorization so that permission checks are performed against the effective project (e.g., falling back to default when a feature is disabled in the requested project), centralizing the behavior in the TLS authorizer and adding global project checks for project-specific endpoints.

Changes:

• Introduces ProjectSpecific endpoints plus global handling of project/all-projects authorization checks in the API router.
• Updates many project-scoped endpoints to build entity URLs using the effective project and to use new AllProjectsMode behavior.
• Enhances restricted TLS identity handling by carrying per-project feature flags and updating TLS authorization logic; adjusts tests accordingly.

Reviewed changes

Copilot reviewed 33 out of 33 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
test/suites/auth.sh	Updates auth integration tests to validate effective-project behavior for restricted callers and creation entitlements.
lxd/storage_volumes.go	Marks endpoints project-specific, shifts listing access handling, and enforces effective-project checks for volume operations and creation.
lxd/storage_volumes_state.go	Marks volume state endpoint as project-specific for global project authorization.
lxd/storage_volumes_snapshot.go	Marks snapshot endpoints project-specific and uses effective-project access checks.
lxd/storage_volumes_backup.go	Marks backup endpoints project-specific and uses effective-project access checks.
lxd/storage_buckets.go	Marks bucket endpoints project-specific and refactors bucket access handler to account for effective project.
lxd/request/requestor.go	Changes restricted TLS allowed-projects representation to include feature flags; adds helpers.
lxd/project/permissions.go	Switches used-by filtering to use standard authorizer checks (no “ignore effective project” variants).
lxd/project/limits/permissions_test.go	Updates test setup to match new Projects map shape.
lxd/profiles.go	Marks endpoints project-specific; refactors access handling to use effective-project URLs and adjusts listing behavior.
lxd/placement_groups.go	Marks endpoints project-specific and updates list access handling.
lxd/operations.go	Marks operations endpoint project-specific and allows all-projects mode for authenticated callers.
lxd/networks.go	Marks endpoints project-specific; refactors network access handler and listing to use effective-project authorization.
lxd/network_zones.go	Marks endpoints project-specific; refactors access handler and listing to use effective-project authorization.
lxd/network_zones_records.go	Marks zone record endpoints project-specific.
lxd/network_peer.go	Marks peer endpoints project-specific.
lxd/network_load_balancers.go	Marks load balancer endpoints project-specific.
lxd/network_forwards.go	Marks forward endpoints project-specific.
lxd/network_allocations.go	Marks allocations endpoint project-specific and updates permission checks to align with new effective-project handling.
lxd/network_acls.go	Marks ACL endpoints project-specific; refactors ACL access handling and listing to use effective-project authorization.
lxd/instances.go	Marks endpoints project-specific and switches list/bulk handlers to new global access approach.
lxd/instance_logs.go	Marks log endpoints project-specific.
lxd/images.go	Marks image endpoints project-specific; reworks image list/get/export access logic to align with effective-project model and global project visibility checks.
lxd/events.go	Marks events endpoint project-specific and allows all-projects mode for authenticated callers.
lxd/devlxd.go	Refactors devlxd project enforcement helper to return project name and reuse it.
lxd/devlxd_storage.go	Updates devlxd storage volume creation/access checks to validate effective project/feature enablement.
lxd/db/cluster/certificates_legacy.go	Adds DB helper to load legacy restricted TLS allowed projects along with feature flags.
lxd/daemon.go	Adds ProjectSpecific + AllProjectsMode plumbing and centralizes project/all-projects global authorization checks.
lxd/auth/types.go	Removes “WithoutEffectiveProject” authorizer interface variants.
lxd/auth/drivers/tls.go	Moves effective-project logic for restricted TLS clients into the TLS authorizer using feature flags and creation entitlements.
lxd/auth/drivers/tls_test.go	Updates TLS authorizer tests for feature-flagged project access.
lxd/auth/drivers/openfga.go	Removes context-driven effective-project rewriting and relies on callers providing correct effective-project URLs.
lxd/api_replicators.go	Marks endpoints project-specific and sets all-projects behavior for listing.

[markylaing]

Addressed copilot comments