Fix plugin updates.

internal/authproxy/appconfig_test.go

@@ -203,6 +203,30 @@ func TestPerAppDenyCombinesWithGlobal(t *testing.T) {
 	}
 }
 
+// The plugin reads healthz to find out whether the running binary honours
+// per-app lists at all — docker metadata cannot tell a current container from
+// one recreated from a stale image. Changing this shape breaks that check.
+func TestHealthzReportsAppConfigDir(t *testing.T) {
+	s := newPerAppServer(t, nil)
+	s.cfg.AppConfigDir = "/data/apps"
+
+	r := httptest.NewRequest("GET", "http://"+appHost+RoutePrefix+"/healthz", nil)
+	w := do(s.Routes(), r)
+	if w.Code != http.StatusOK {
+		t.Fatalf("healthz = %d, want 200", w.Code)
+	}
+	if got, want := w.Body.String(), `{"ok":true,"app_config_dir":"/data/apps"}`; got != want {
+		t.Errorf("healthz body = %s, want %s", got, want)
+	}
+
+	// Per-app config off: the field is present but empty, so the plugin can
+	// tell "configured with no directory" from "too old to answer".
+	s.cfg.AppConfigDir = ""
+	if got, want := do(s.Routes(), r).Body.String(), `{"ok":true,"app_config_dir":""}`; got != want {
+		t.Errorf("healthz body with per-app config off = %s, want %s", got, want)
+	}
+}
+
 // The app name is read from a header, so verify must use the value nginx set
 // and a session must not be portable to an app with stricter rules.
 func TestVerifyUsesAppHeader(t *testing.T) {