Authorizer does not support multiple Cognito user groups per node ID

[jordanpadams]

Checked for duplicates

Yes - I've already checked

🐛 Describe the bug

The DUM Lambda authorizer (index.js) checks only a single Cognito user group per node ID. The client sends a single UserGroup header value derived from NodeUtil.node_id_to_group_name(), which always returns exactly one group name (e.g. PDS_SBN_USERS).

SBN has two separate organizations (UMD and PSI), each with its own Cognito user group. A user authenticated under PDS_SBN_UMD_USERS attempts to upload with --node sbn, the client sends UserGroup: PDS_SBN_USERS, and the authorizer rejects the request with 401 Unauthorized because the user's actual group (PDS_SBN_UMD_USERS) does not match the single expected group.

🕵️ Expected behavior

A user in any Cognito group associated with the --node sbn flag should be authorized to upload. The system should support a configurable list of permitted groups per node ID and allow access if the user belongs to any of them.

📜 To Reproduce

1. Create a Cognito user in group PDS_SBN_UMD_USERS (not PDS_SBN_USERS)
2. Configure a DUM INI file targeting the production environment with node = sbn
3. Run: pds-ingress-client -c <config> -n sbn -- <path>
4. Observe 401 Unauthorized: "You are not authorized to use the ingestion service. Your account may not be in the required user group."

🖥 Environment Info

• Version of this software: v2.6.0-dev
• Operating System: N/A (Lambda authorizer + Python client)

📚 Version of Software Used

v2.6.0-dev

🩺 Test Data / Additional context

Proposed fix (Option A — multi-group support):

1. node_util.py: Rename node_id_to_group_name → node_id_to_group_names, return a list of permitted group names per node ID. For sbn, return e.g. ["PDS_SBN_USERS", "PDS_SBN_UMD_USERS", "PDS_SBN_PSI_USERS"] (exact names TBD with ops team).
2. pds_ingress_client.py: Send all group names as a comma-separated UserGroup header value.
3. authorizer/index.js: Split the UserGroup header on commas, then authorize if the user's cognito:groups intersects with any of the permitted groups.

This is the minimal-impact fix — no changes to node IDs, bucket maps, or Terraform config.

🦄 Related requirements

N/A

---

For Internal Dev Team To Complete

⚙️ Engineering Details

🎉 Integration & Test