Summary

Enhance the Harness log-service to fully proxy CI pipeline log downloads. Currently, downloading logs returns a pre-signed S3 URL that the browser hits directly. This exposes internal storage endpoints and credentials, violating strict network segregation policies for security-conscious customers.

Current Behavior

The /blob/download endpoint returns a pre-signed S3 URL.

The UI navigates the browser directly to this URL.

Even with LOG_SERVICE_S3_REVERSE_PROXY_ENABLED=true, the URL still contains S3 signature parameters (X-Amz-Credential, X-Amz-Signature, etc.) and reveals the object key and bucket structure.

Pain Point: Security architectures prohibit exposing internal storage endpoints to end-user workstations. The current implementation forces direct client-to-storage communication, bypassing the intended proxying logic.

Proposed Enhancement

Modify the log-service to return an internal proxy URL (e.g., GET /blob?accountID=&key=<prefix>/logs.zip) instead of a pre-signed storage URL.