Hopefully fix some bugs.

internal/authproxy/server.go

@@ -313,6 +313,7 @@ func (s *Server) effectiveLists(app string) accessLists {
 		AllowedDomains: s.cfg.AllowedDomains,
 		AllowedEmails:  s.cfg.AllowedEmails,
 		DeniedEmails:   s.cfg.DeniedEmails,
+		Unreadable:     own.Unreadable,
 	}
 	if own.hasAllowRules() {
 		out.AllowedDomains = own.AllowedDomains
@@ -326,10 +327,16 @@ func (s *Server) effectiveLists(app string) accessLists {
 
 // emailAllowedFor applies app's rules: the deny list first (it always wins),
 // then the allow list, where an address must match an allowed email or an
-// allowed domain. An empty app means "global rules only".
+// allowed domain. An empty app means "global rules only"; an app whose own
+// lists could not be read is denied outright rather than quietly handed the
+// broader global list.
 func (s *Server) emailAllowedFor(app, email string) bool {
 	email = strings.ToLower(email)
 	lists := s.effectiveLists(app)
+	if lists.Unreadable {
+		// The app has rules we could not read; see accessLists.Unreadable.
+		return false
+	}
 	if slices.Contains(lists.DeniedEmails, email) {
 		return false
 	}