Apply the configured log user and group lists to daemon log requests

[rzo1]

The daemon log paths combined the daemon flag with the authorizer result as isDaemon || allowed, so the configured logs.users/logs.groups result was discarded for daemon files.

The three daemon log paths (page, download, search) now evaluate the same lists the worker log paths already use. Extends ResourceAuthorizerTest and the three handler tests.

[reiabreu]

Disclaimer: this comment was drafted with the help of an LLM.

Thanks for tightening up the daemon-log authorization here — the per-endpoint deny tests are a nice addition.

One small suggestion on coverage: both ResourceAuthorizer tests stub getUserGroups(...) to return an empty set, so the group-based path (logs.groups / nimbus.admins.groups) isn't actually exercised. A case where a user is authorized purely via group membership would close that gap. Separately, the three handler tests assert the 403 deny path but not the authorized 200 path — a positive case could guard against accidentally over-blocking.

Neither is a blocker — just an additional safeguard for a security-sensitive change.

[rzo1]

Disclaimer: this comment was drafted with the help of an LLM.

Thanks for tightening up the daemon-log authorization here — the per-endpoint deny tests are a nice addition.

One small suggestion on coverage: both ResourceAuthorizer tests stub getUserGroups(...) to return an empty set, so the group-based path (logs.groups / nimbus.admins.groups) isn't actually exercised. A case where a user is authorized purely via group membership would close that gap. Separately, the three handler tests assert the 403 deny path but not the authorized 200 path — a positive case could guard against accidentally over-blocking.

Neither is a blocker — just an additional safeguard for a security-sensitive change.

Done.