Fix plugin updates.

internal/authproxy/appconfig_test.go

@@ -203,6 +203,30 @@ func TestPerAppDenyCombinesWithGlobal(t *testing.T) {
 	}
 }
 
+// The plugin reads healthz to find out whether the running binary honours
+// per-app lists at all — docker metadata cannot tell a current container from
+// one recreated from a stale image. Changing this shape breaks that check.
+func TestHealthzReportsAppConfigDir(t *testing.T) {
+	s := newPerAppServer(t, nil)
+	s.cfg.AppConfigDir = "/data/apps"
+
+	r := httptest.NewRequest("GET", "http://"+appHost+RoutePrefix+"/healthz", nil)
+	w := do(s.Routes(), r)
+	if w.Code != http.StatusOK {
+		t.Fatalf("healthz = %d, want 200", w.Code)
+	}
+	if got, want := w.Body.String(), `{"ok":true,"app_config_dir":"/data/apps"}`; got != want {
+		t.Errorf("healthz body = %s, want %s", got, want)
+	}
+
+	// Per-app config off: the field is present but empty, so the plugin can
+	// tell "configured with no directory" from "too old to answer".
+	s.cfg.AppConfigDir = ""
+	if got, want := do(s.Routes(), r).Body.String(), `{"ok":true,"app_config_dir":""}`; got != want {
+		t.Errorf("healthz body with per-app config off = %s, want %s", got, want)
+	}
+}
+
 // The app name is read from a header, so verify must use the value nginx set
 // and a session must not be portable to an app with stricter rules.
 func TestVerifyUsesAppHeader(t *testing.T) {

internal/authproxy/server.go

@@ -255,9 +255,19 @@ func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
 		<p><a href="/">Sign in again</a></p>`)
 }
 
+// handleHealthz is both the container health probe and the plugin's way of
+// asking the running binary what it is doing. It reports the per-app config
+// directory because nothing outside the process can: a container recreated
+// from a stale image has the bind mount and GOOGLE_AUTH_APP_CONFIG_DIR in its
+// environment while running a binary from before per-app lists existed, which
+// ignores both and quietly falls back to the global lists. That build answers
+// this endpoint with a bare "ok" and no directory, which is what tells the two
+// apart.
 func (s *Server) handleHealthz(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
 	w.WriteHeader(http.StatusOK)
-	fmt.Fprint(w, "ok")
+	fmt.Fprintf(w, `{"ok":true,"app_config_dir":%q}`, s.cfg.AppConfigDir)
 }
 
 // handleStatus is a small human-readable page for debugging.