fix: fail acl lookup when input domain doesn't match cookie domain

internal/controller/proxy_controller_test.go

@@ -918,6 +918,7 @@ func TestProxyController(t *testing.T) {
 	aclsService := service.NewAccessControlsService(service.AccessControlServiceInput{
 		Log:           log,
 		Config:        &cfg,
+		Runtime:       &runtime,
 		LabelProvider: nil,
 	})
 

internal/service/access_controls_service.go

@@ -66,15 +66,15 @@ func (service *AccessControlsService) getACLs(domain string, lookup func(locator
 
 	normalizedDomain := service.normalizeDomain(domain)
 
+	if !strings.HasSuffix(normalizedDomain, "."+service.runtime.CookieDomain) && normalizedDomain != service.runtime.CookieDomain {
+		return nil, fmt.Errorf("domain does not match cookie domain, expected %s (or a subdomain), got %s", service.runtime.CookieDomain, domain)
+	}
+
 	var domainMatch *model.App
 	var nameMatch *model.App
 	var nameMatchedApps []string
 
 	locatorFunc := func(name string, app *model.App) bool {
-		if !strings.HasSuffix(normalizedDomain, "."+service.runtime.CookieDomain) && normalizedDomain != service.runtime.CookieDomain {
-			service.log.App.Debug().Str("name", name).Msg("Domain does not match runtime cookie domain, skipping")
-			return false
-		}
 		if app.Config.Domain != "" {
 			if !service.ensureAscii(app.Config.Domain) {
 				service.log.App.Warn().Str("name", name).Str("domain", app.Config.Domain).Msg("Domain contains non-ascii characters, skipping")

internal/service/access_controls_service_test.go

@@ -123,6 +123,9 @@ func TestAccessControlsService(t *testing.T) {
 				},
 			},
 			want: nil,
+			errorFunc: func(t *testing.T, e error) {
+				assert.ErrorContains(t, e, "domain does not match cookie domain")
+			},
 		},
 		{
 			name:   "App in domain not matching with the cookie domain should return nothing with domain matching",
@@ -134,6 +137,9 @@ func TestAccessControlsService(t *testing.T) {
 				},
 			},
 			want: nil,
+			errorFunc: func(t *testing.T, e error) {
+				assert.ErrorContains(t, e, "domain does not match cookie domain")
+			},
 		},
 	}