incusd/auth: Add location support in ObjectFromRequest

Signed-off-by: Stéphane Graber <[email protected]>

internal/server/auth/authorization_objects.go

@@ -173,21 +173,6 @@ func ObjectFromRequest(r *http.Request, objectType ObjectType, muxVars ...string
 		return ObjectServer(), nil
 	}
 
-	muxValues := make([]string, 0, len(muxVars))
-	vars := mux.Vars(r)
-	for _, muxVar := range muxVars {
-		muxValue, err := url.PathUnescape(vars[muxVar])
-		if err != nil {
-			return "", fmt.Errorf("Failed to unescape mux var %q for object type %q: %w", muxVar, objectType, err)
-		}
-
-		if muxValue == "" {
-			return "", fmt.Errorf("Mux var %q not found for object type %q", muxVar, objectType)
-		}
-
-		muxValues = append(muxValues, muxValue)
-	}
-
 	values, err := url.ParseQuery(r.URL.RawQuery)
 	if err != nil {
 		return "", err
@@ -198,6 +183,35 @@ func ObjectFromRequest(r *http.Request, objectType ObjectType, muxVars ...string
 		projectName = "default"
 	}
 
+	location := values.Get("target")
+
+	muxValues := make([]string, 0, len(muxVars))
+	vars := mux.Vars(r)
+	for _, muxVar := range muxVars {
+		var err error
+		var muxValue string
+
+		if muxVar == "location" {
+			// Special handling for the location which is not present as a real mux var.
+			if location == "" {
+				continue
+			}
+
+			muxValue = location
+		} else {
+			muxValue, err = url.PathUnescape(vars[muxVar])
+			if err != nil {
+				return "", fmt.Errorf("Failed to unescape mux var %q for object type %q: %w", muxVar, objectType, err)
+			}
+
+			if muxValue == "" {
+				return "", fmt.Errorf("Mux var %q not found for object type %q", muxVar, objectType)
+			}
+		}
+
+		muxValues = append(muxValues, muxValue)
+	}
+
 	// If using projects API we want to pass in the mux var, not the query parameter.
 	if objectType == ObjectTypeProject && strings.HasPrefix(r.URL.Path, fmt.Sprintf("/%s/projects", version.APIVersion)) {
 		if len(muxValues) == 0 {