Hopefully fix some bugs.

internal/authproxy/appconfig_test.go

@@ -53,6 +53,37 @@ func TestAppStoreReadsLists(t *testing.T) {
 	}
 }
 
+// A list file the service cannot read leaves the app's real rules unknown.
+// Inheriting the global list there would hand out access the app's own list was
+// written to withhold, so the app denies instead.
+func TestUnreadableListDeniesInsteadOfInheriting(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root reads files regardless of mode")
+	}
+	dir := t.TempDir()
+	writeAppLists(t, dir, "locked", map[string]string{"allowed-emails": "ceo@signal.org\n"})
+	if err := os.Chmod(filepath.Join(dir, "locked", "allowed-emails"), 0o000); err != nil {
+		t.Fatal(err)
+	}
+
+	s := newTestServer(t, "http://unused.invalid") // global list allows all of signal.org
+	s.cfg.AppConfigDir = dir
+	s.apps = newAppStore(dir)
+
+	if !s.apps.lists("locked").Unreadable {
+		t.Error("an unreadable list file should mark the app's lists unreadable")
+	}
+	for _, email := range []string{"ceo@signal.org", "anyone@signal.org"} {
+		if s.emailAllowedFor("locked", email) {
+			t.Errorf("emailAllowedFor(locked, %q) = true; an app whose list cannot be read must deny", email)
+		}
+	}
+	// Only that app is affected: everyone else still uses the global list.
+	if !s.emailAllowedFor("inherits", "anyone@signal.org") {
+		t.Error("an app with no config of its own should still inherit the global list")
+	}
+}
+
 // The app name reaches the service in a header, so it must never be able to
 // walk out of the config directory.
 func TestAppStoreRejectsUnusableNames(t *testing.T) {