Hopefully fix some bugs.

internal/authproxy/appconfig.go

@@ -1,6 +1,9 @@
 package authproxy
 
 import (
+	"errors"
+	"io/fs"
+	"log"
 	"os"
 	"path/filepath"
 	"strings"
@@ -14,6 +17,13 @@ type accessLists struct {
 	AllowedDomains []string
 	AllowedEmails  []string
 	DeniedEmails   []string
+
+	// Unreadable records that one of the app's list files exists but could not
+	// be read, leaving its real rules unknown. Falling back to the global list
+	// would then silently widen access — the app is likely narrower than global,
+	// which is why it has a list at all — so an app in this state denies
+	// everyone until the file is readable again.
+	Unreadable bool
 }
 
 func (a accessLists) hasAllowRules() bool {
@@ -64,26 +74,40 @@ func (s *appStore) lists(app string) accessLists {
 		return hit.lists
 	}
 
-	lists := accessLists{
-		AllowedDomains: readDomainFile(filepath.Join(s.dir, app, "allowed-domains")),
-		AllowedEmails:  readListFile(filepath.Join(s.dir, app, "allowed-emails")),
-		DeniedEmails:   readListFile(filepath.Join(s.dir, app, "denied-emails")),
+	var lists accessLists
+	read := func(name string) []string {
+		entries, err := readListFile(filepath.Join(s.dir, app, name))
+		if err != nil {
+			log.Printf("appconfig: cannot read %s for app %q: %v — denying every account "+
+				"for that app until it is readable", name, app, err)
+			lists.Unreadable = true
+		}
+		return entries
 	}
+	lists.AllowedDomains = trimAts(read("allowed-domains"))
+	lists.AllowedEmails = read("allowed-emails")
+	lists.DeniedEmails = read("denied-emails")
+
 	s.cache[app] = cachedLists{lists: lists, loadedAt: s.now()}
 	return lists
 }
 
-func readListFile(path string) []string {
-	// A missing or unreadable file is normal: most apps have no overrides.
+// readListFile returns the entries in a list file. A missing file is normal —
+// most apps have no overrides — and reads as an empty list; any other error is
+// reported, because it means the app's rules are unknown rather than absent.
+func readListFile(path string) ([]string, error) {
 	raw, err := os.ReadFile(path)
 	if err != nil {
-		return nil
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil, nil
+		}
+		return nil, err
 	}
-	return splitList(string(raw))
+	return splitList(string(raw)), nil
 }
 
-func readDomainFile(path string) []string {
-	entries := readListFile(path)
+// trimAts accepts domains written either as "signal.org" or "@signal.org".
+func trimAts(entries []string) []string {
 	for i, d := range entries {
 		entries[i] = strings.TrimPrefix(d, "@")
 	}